Intune / SCCM / GPO Deployment Guide ENT

Silent, per-machine enterprise deployment for Microsoft Intune (Win32), SCCM (MECM), and Active Directory Group Policy. No MSI required — the NSIS installer supports fully silent, elevated per-machine deployment and is verified in both interactive administrator sessions and non-interactive NT AUTHORITY\SYSTEM execution context (Session 0).

Audience: enterprise IT administrators · Applies to: Slim Archiver.

1. Verified architecture & installer facts

2. Packaging for Microsoft Intune (.intunewin)

Intune Win32 application deployment requires wrapping the setup executable using Microsoft's free Win32 Content Prep Tool.

Step 1 — Download the Win32 Content Prep Tool

Download IntuneWinAppUtil.exe from Microsoft's official GitHub repository: github.com/microsoft/Microsoft-Win32-Content-Prep-Tool

Step 2 — Prepare the source directory structure

Place the setup executable into a clean staging folder:

C:\pkg\
├── source\
│   └── Slim Archiver Setup 1.0.0.exe
└── output\

Step 3 — Run the prep tool

.\IntuneWinAppUtil.exe -c "C:\pkg\source" -s "Slim Archiver Setup 1.0.0.exe" -o "C:\pkg\output" -q

The package C:\pkg\output\Slim Archiver Setup 1.0.0.intunewin is generated and ready for upload.

3. Microsoft Intune configuration, step by step

In the Microsoft Intune admin center, navigate to Apps > Windows > Add > App type: Windows app (Win32).

3.1 App information

• App package file: select Slim Archiver Setup 1.0.0.intunewin
• Name: Slim Archiver
• Description: High-performance 64-bit Windows archiver built on Zstandard with enterprise DLP and Entra ID SSO governance.
• Publisher: Slim Archiver
• Version: 1.0.0

3.2 Program settings

3.3 Requirements

• Operating system architecture: 64-bit
• Minimum operating system: Windows 10 1607 (or higher)
• Disk space required: 400 MB (installed footprint is ~385 MB)

4. Detection rules

Configure detection rules using Option A (recommended) or Option B.

Option A — Registry detection (recommended)

In the Detection rules blade, select Rules format: Manually configure detection rules and click + Add:

Option B — File detection (alternative)

5. SCCM / MECM application deployment

Application creation: Software Library > Application Management > Applications > Create Application. Deployment type: add a Script Installer deployment type.

• Installation program: "Slim Archiver Setup 1.0.0.exe" /S /allusers /ACCEPTEULA=1
• Uninstall program: "C:\Program Files\Slim Archiver\Uninstall Slim Archiver.exe" /allusers /S

Detection method: Setting Type Registry · Hive HKEY_LOCAL_MACHINE · Key SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\f34767be-ae6a-56df-bc55-01d2bec8ebeb · Value DisplayVersion · Operator Greater than or equal to · Value 1.0.0. This registry setting must indicate a 64-bit application on 64-bit systems: Check (True).

User experience: Installation behavior Install for system · Visibility Hidden.

6. Active Directory Group Policy (GPO) startup script

Deploy via a Computer Startup Script (Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown) > Startup):

@echo off
setlocal
set "INSTALL_EXE=\\corp.domain.com\NETLOGON\SlimArchiver\Slim Archiver Setup 1.0.0.exe"
set "UNINSTALL_REG=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\f34767be-ae6a-56df-bc55-01d2bec8ebeb"

:: Check if already installed
reg query "%UNINSTALL_REG%" /v "DisplayVersion" 2>nul | findstr /i "1.0.0" >nul
if %errorlevel% equ 0 (
    exit /b 0
)

:: Execute silent per-machine install under SYSTEM context
"%INSTALL_EXE%" /S /allusers /ACCEPTEULA=1
exit /b %errorlevel%

7. Enterprise governance & security integrations

When installed per-machine under SYSTEM, Slim Archiver automatically provisions the following enterprise infrastructure:

1. Windows Event Log provider

• Log Name: Application · Source: Slim Archiver
• Registry Key: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Slim Archiver
• Audit coverage (when the policy sets writeToEventLog): compress and extract operations, cloud actions, Entra ID sign-in, sign-out and expired sessions, DLP matches and DLP blocks. Archive integrity tests are not recorded.

2. ProgramData audit-log ACLs

• Path: C:\ProgramData\Slim Archiver\Logs\
• Configured access: icacls "C:\ProgramData\Slim Archiver\Logs" /grant *S-1-5-11:(OI)(CI)M /T /C
• Lets standard users (Authenticated Users) write the audit logs without elevation. The grant is Modify, so local users can also alter or delete local log files; forward events to the Windows Event Log or a SIEM as the tamper-resistant record (see the Deployment & Policy guide).

3. Shell-extension integration

• DLL: C:\Program Files\Slim Archiver\slimarch_shell.dll
• Registered per-machine via regsvr32.exe /s "$INSTDIR\slimarch_shell.dll"
• CommandStore: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\SlimArchiver.*

8. Troubleshooting reference

cmd.exe /c cd /d %TEMP% & for /l %i in (1,1,8) do (ping 127.0.0.1 -n 2 >nul & rmdir "C:\Program Files\Slim Archiver" 2>nul && exit /b 0)