> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Intune Deployment (Windows)

> Deploy the Runlayer CLI to Windows devices as an Intune Win32 app

The Windows package is an Authenticode-signed MSI wrapped for Intune. It installs per-machine into `C:\Program Files\Runlayer\CLI\` and adds that directory to the system `PATH`. The MSI takes **no properties** — there is nothing tenant-specific to configure.

## Prerequisites

* Microsoft Intune admin access
* Windows x64 devices
* The Authenticode-signed `runlayer-<version>-win-x64.intunewin` from your Runlayer downloads access

## Deployment Steps

<Steps>
  <Step title="Upload the .intunewin">
    Upload `runlayer-<version>-win-x64.intunewin` as a **Win32 app** in Intune.
  </Step>

  <Step title="Set install and uninstall commands">
    ```text Install theme={null}
    msiexec /i runlayer-<version>-win-x64.msi /qn
    ```

    ```text Uninstall theme={null}
    msiexec /x runlayer-<version>-win-x64.msi /qn
    ```
  </Step>

  <Step title="Set the detection rule">
    Use a **file** detection rule that compares the file version, so Intune detects upgrades correctly instead of treating any installed build as current:

    | Field            | Value                                                                                                                            |
    | ---------------- | -------------------------------------------------------------------------------------------------------------------------------- |
    | Rule type        | File                                                                                                                             |
    | Path             | `C:\Program Files\Runlayer\CLI\`                                                                                                 |
    | File             | `runlayer.exe`                                                                                                                   |
    | Detection method | String (version)                                                                                                                 |
    | Operator         | Greater than or equal to                                                                                                         |
    | Value            | The packaged version as a four-part file version — the release padded to `major.minor.patch.0` (e.g. `1.2.3` ships as `1.2.3.0`) |

    A bare "file exists" rule reports the app installed even when an older build is present, so Intune never pushes the upgrade. Comparing the file version string fixes that. Alternatively, detect the registry value `HKLM\Software\Runlayer\CLI\InstallDir`.
  </Step>

  <Step title="Deploy in System context">
    The MSI installs per-machine, so assign the app to run in **System** context.
  </Step>
</Steps>

<Note>
  Because the installer updates the **system** `PATH`, already-open terminals won't see `runlayer` until they are restarted (or the device is rebooted). New shells resolve it immediately.
</Note>

## Upgrades and removal

* **Upgrade** — push the newer `.msi` / `.intunewin` through the same Intune app; the MSI uses a major-upgrade, so it upgrades in place. There is no configuration to re-push.
* **Remove** — unassign the app in Intune, or run `msiexec /x runlayer-<version>-win-x64.msi /qn` on the device. There are no profiles, agents, or scheduled tasks to clean up.

## Verification

Monitor install status in the Intune admin center under the app's device and user install report. On a target device, open a **new** terminal (so it picks up the updated `PATH`) and confirm the binary resolves:

```bash theme={null}
runlayer --version
```