Skip to main content
The Windows package is an Authenticode-signed MSI wrapped for Intune. It installs per-machine into C:\Program Files\Runlayer\CLI\, adds that directory to the system PATH, and registers the hourly \Runlayer\CLIUpdate SYSTEM task. The MSI takes no tenant properties. Optional managed-update and skill-sync settings come from the registry after installation or fall back to an existing AI Watch configuration.

​
Prerequisites

  • Microsoft Intune admin access
  • Windows x64 devices
  • The Authenticode-signed runlayer-<version>-win-x64.intunewin from your Runlayer downloads access

​
Deployment Steps

1

Upload the .intunewin

Upload runlayer-<version>-win-x64.intunewin as a Win32 app in Intune.
2

Set install and uninstall commands

Install
Uninstall
3

Set the detection rule

Use a file detection rule that compares the file version, so Intune detects upgrades correctly instead of treating any installed build as current:A bare “file exists” rule reports the app installed even when an older build is present, so Intune never pushes the upgrade. Comparing the file version string fixes that. Alternatively, detect the registry value HKLM\Software\Runlayer\CLI\InstallDir.
4

Deploy in System context

The MSI installs per-machine, so assign the app to run in System context.
Because the installer updates the system PATH, already-open terminals won’t see runlayer until they are restarted (or the device is rebooted). New shells resolve it immediately.

​
Managed configuration (optional)

For the full CLI, configure managed values under HKLM\Software\Runlayer\CLI. The CLI reads that key first and fills any missing values from HKLM\Software\Runlayer\AIWatch, so devices already running AI Watch can reuse its host, organization API key, and update policy. You do not need to duplicate values already present under the AI Watch key. A value under the CLI key takes precedence over the corresponding AI Watch value.

​
Automatic updates

The MSI registers the hidden, protected \Runlayer\CLIUpdate task during installation. It runs runlayer.exe __scheduled-update as SYSTEM every 60 minutes, with its first check delayed about 73 minutes so it cannot overlap the MSI transaction that created it. Host and credentials stay in the registry and never appear in the task arguments. The task silently exits unless Host and OrgApiKey resolve from the CLI or AI Watch registry key. When they are present, auto-update is enabled by default and installs the backend-selected CLI version. Set AutoUpdate=0 to opt out. For a one-off update, run runlayer update from an elevated terminal with an organization API key.

​
Automatic skill sync

The MSI registers \Runlayer\CLISchedule, a protected SYSTEM task that runs hourly and whenever any user logs on. The task launches runlayer schedule with each logged-on user’s token, so managed skills are written as that user rather than as SYSTEM. The scheduler resolves the managed Host, SkillSyncOrgApiKey (or OrgApiKey), and SyncSkills values described in Managed configuration. Without a managed host and key it exits quietly. Set SyncSkills=0 to disable delivery while retaining disabled-status reporting. See Sync to devices. Only users logged on when a task fires are synced. The any-user logon trigger catches a returning user immediately; the hourly trigger converges users who remain logged on.

​
Upgrades and removal

  • Automatic upgrade — with managed Host and OrgApiKey values, CLIUpdate installs the backend-selected version on its hourly tick unless AutoUpdate=0.
  • Intune upgrade — push the newer .msi / .intunewin through the same Intune app; the MSI uses a major-upgrade, so it upgrades in place.
  • Remove — unassign the app in Intune, or run msiexec /x runlayer-<version>-win-x64.msi /qn on the device. The uninstall also removes the \Runlayer\CLIUpdate and \Runlayer\CLISchedule scheduled tasks; there are no profiles to clean up.

​
Verification

Monitor install status in the Intune admin center under the app’s device and user install report. On a target device, open a new terminal (so it picks up the updated PATH) and confirm the binary resolves:
In Task Scheduler, confirm \Runlayer\CLIUpdate and \Runlayer\CLISchedule are present. CLISchedule’s Last Run Result reports orchestrator failures; per-user sync status is shown on the device page in Runlayer.