Intune / SCCM / GPO Deployment Guide ENT

Silent, per-machine enterprise deployment for Microsoft Intune (Win32), SCCM (MECM), and Active Directory Group Policy. No MSI required — the signed NSIS installer supports fully silent, elevated per-machine deployment and is verified in both interactive administrator sessions and non-interactive NT AUTHORITY\SYSTEM execution context (Session 0).

Audience: enterprise IT administrators · Applies to: Slim Archiver.

1. Verified architecture & installer facts

Attribute	Specification	Administrative notes
Installer Format	NSIS Per-Machine Executable	64-bit native payload, zero external runtime dependencies
Installation Path	`C:\Program Files\Slim Archiver`	All-users location (`%ProgramFiles%`)
Silent Install Switch	`/S /allusers`	Case-sensitive (`/S`), elevated, returns exit code 0 on success
Silent Uninstall Switch	`/allusers /S`	Invokes `Uninstall Slim Archiver.exe` cleanly
Add/Remove Programs	Slim Archiver 1.0.0	`DisplayVersion: 1.0.0`
Uninstall Registry Key	`HKLM\…\Uninstall\f34767be-ae6a-56df-bc55-01d2bec8ebeb`	No curly braces `{}` in key name
Integrations under SYSTEM	Automatic on install	Registers Explorer shell-extension DLL, Windows Event Log source, ProgramData audit-log ACLs

2. Packaging for Microsoft Intune (.intunewin)

Intune Win32 application deployment requires wrapping the setup executable using Microsoft's free Win32 Content Prep Tool.

Step 1 — Download the Win32 Content Prep Tool

Download IntuneWinAppUtil.exe from Microsoft's official GitHub repository: github.com/microsoft/Microsoft-Win32-Content-Prep-Tool

Step 2 — Prepare the source directory structure

Place the setup executable into a clean staging folder:

C:\pkg\
├── source\
│   └── Slim Archiver Setup 1.0.0.exe
└── output\

Authenticode code-signing prerequisiteBefore packaging for production Intune distribution, ensure Slim Archiver Setup 1.0.0.exe is digitally signed with your enterprise or commercial Authenticode certificate. Devices enforcing Windows Defender Application Control (WDAC), AppLocker, or SmartScreen will block unsigned executables run by the Intune Management Extension (IME).

Step 3 — Run the prep tool

.\IntuneWinAppUtil.exe -c "C:\pkg\source" -s "Slim Archiver Setup 1.0.0.exe" -o "C:\pkg\output" -q

The package C:\pkg\output\Slim Archiver Setup 1.0.0.intunewin is generated and ready for upload.

3. Microsoft Intune configuration, step by step

In the Microsoft Intune admin center, navigate to Apps > Windows > Add > App type: Windows app (Win32).

3.1 App information

App package file: select Slim Archiver Setup 1.0.0.intunewin
Name: Slim Archiver
Description: High-performance 64-bit Windows archiver built on Zstandard with enterprise DLP and Entra ID SSO governance.
Publisher: Slim Archiver
Version: 1.0.0

3.2 Program settings

Setting	Configuration value	Explanation
Install command	`"Slim Archiver Setup 1.0.0.exe" /S /allusers`	Silent per-machine installation
Uninstall command	`"C:\Program Files\Slim Archiver\Uninstall Slim Archiver.exe" /allusers /S`	Silent uninstallation
Install behavior	System	Executes elevated under `NT AUTHORITY\SYSTEM`
Device restart behavior	No specific action	Returns exit code 0 on success without requiring reboot

3.3 Requirements

Operating system architecture: 64-bit
Minimum operating system: Windows 10 1607 (or higher)
Disk space required: 400 MB (installed footprint is ~385 MB)

4. Detection rules

Configure detection rules using Option A (recommended) or Option B.

Option A — Registry detection (recommended)

In the Detection rules blade, select Rules format: Manually configure detection rules and click + Add:

Rule type	Registry
Key path	`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\f34767be-ae6a-56df-bc55-01d2bec8ebeb`
Value name	`DisplayVersion`
Detection method	String comparison
Operator	Greater than or equal to (or Equals)
Value	`1.0.0`
Associated with a 32-bit app on 64-bit clients	No (CRITICAL — must be set to “No”)

Critical Intune configuration pitfalls 1. Do NOT wrap the GUID in curly braces {}. The registry key generated by electron-builder uses the exact string f34767be-ae6a-56df-bc55-01d2bec8ebeb. Using {f34767be-…} causes Intune detection to fail with error 0x87D1041C.
2. “Associated with a 32-bit app on 64-bit clients” MUST be “No”. Setting this to Yes forces Intune to query HKLM\SOFTWARE\WOW6432Node\…. Slim Archiver is a 64-bit native application; checking the 32-bit registry view will report the app as missing.

Option B — File detection (alternative)

Rule type	File
Path	`C:\Program Files\Slim Archiver`
File or folder	`Slim Archiver.exe`
Detection method	String (version)
Operator	Greater than or equal to
Value	`1.0.0`
Associated with a 32-bit app on 64-bit clients	No

Targeting noteAlways target Slim Archiver.exe for version-comparison rules — it contains the compiled PE VERSIONINFO resource (1.0.0). The CLI executable slimarch.exe does not embed a PE version table and can only be used with “File exists”.

Prohibition — never detect on “folder exists”Do NOT configure a detection rule checking “Folder exists: C:\Program Files\Slim Archiver”. During uninstallation, Windows prevents a directory from being deleted while an executable running inside it is active. The uninstaller dispatches an asynchronous detached background helper (cmd.exe) that waits for the uninstaller process to exit before removing the empty folder in a retry loop. The Intune Management Extension evaluates detection within milliseconds of uninstaller exit, racing ahead of the async cleanup — a folder-exists rule will inspect the folder before cleanup finishes, falsely report an uninstall failure, and flag 0x87D1041C. Always use Option A or Option B.

5. SCCM / MECM application deployment

Application creation: Software Library > Application Management > Applications > Create Application. Deployment type: add a Script Installer deployment type.

Installation program: "Slim Archiver Setup 1.0.0.exe" /S /allusers
Uninstall program: "C:\Program Files\Slim Archiver\Uninstall Slim Archiver.exe" /allusers /S

Detection method: Setting Type Registry · Hive HKEY_LOCAL_MACHINE · Key SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\f34767be-ae6a-56df-bc55-01d2bec8ebeb · Value DisplayVersion · Operator Greater than or equal to · Value 1.0.0. This registry setting must indicate a 64-bit application on 64-bit systems: Check (True).

User experience: Installation behavior Install for system · Visibility Hidden.

6. Active Directory Group Policy (GPO) startup script

Deploy via a Computer Startup Script (Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown) > Startup):

@echo off
setlocal
set "INSTALL_EXE=\\corp.domain.com\NETLOGON\SlimArchiver\Slim Archiver Setup 1.0.0.exe"
set "UNINSTALL_REG=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\f34767be-ae6a-56df-bc55-01d2bec8ebeb"

:: Check if already installed
reg query "%UNINSTALL_REG%" /v "DisplayVersion" 2>nul | findstr /i "1.0.0" >nul
if %errorlevel% equ 0 (
    exit /b 0
)

:: Execute silent per-machine install under SYSTEM context
"%INSTALL_EXE%" /S /allusers
exit /b %errorlevel%

7. Enterprise governance & security integrations

When installed per-machine under SYSTEM, Slim Archiver automatically provisions the following enterprise infrastructure:

1. Windows Event Log provider

Log Name: Application · Source: SlimArchiver
Registry Key: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\SlimArchiver
Audit coverage: DLP policy block/quarantine events, Entra ID SSO logins, archive integrity-check failures.

2. ProgramData audit-log ACLs

Path: C:\ProgramData\Slim Archiver\Logs\
Configured access: icacls "C:\ProgramData\Slim Archiver\Logs" /grant *S-1-5-11:(OI)(CI)M /T /C
Allows standard Authenticated Users to write DLP compliance logs without administrative elevation, while preventing external directory tampering.

3. Shell-extension integration

DLL: C:\Program Files\Slim Archiver\slimarch_shell.dll
Registered per-machine via regsvr32.exe /s "$INSTDIR\slimarch_shell.dll"
CommandStore: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\SlimArchiver.*

8. Troubleshooting reference

Symptom / error code	Root cause	Resolution
`0x87D1041C` (detection failure)	Curly braces `{}` in registry key path, or 32-bit architecture flag set to Yes.	Verify the key is exactly `f34767be-…` and set “Associated with a 32-bit app” to No.
`1618`	Another Windows Installer or servicing transaction was in progress.	The Intune Management Extension automatically retries on the next synchronization cycle.
Clean uninstallation	Background file lock during teardown.	The uninstaller sets its CWD to `%TEMP%` and dispatches a detached `cmd.exe` retry loop (below) that deletes the empty install directory once all handles release. A plain `rmdir` preserves any custom user files.

cmd.exe /c cd /d %TEMP% & for /l %i in (1,1,8) do (ping 127.0.0.1 -n 2 >nul & rmdir "C:\Program Files\Slim Archiver" 2>nul && exit /b 0)