Enterprise Deployment (MDM)

Nobody types a token on 200 warehouse stations. IT can put the enrollment token on each station at install time. The app finds it at first launch and enrolls the device without operator interaction.

Two recipes do this. Recipe 1 deploys the per-machine MSI with Microsoft Intune. Recipe 2 writes one registry value, and works with any MDM and with the standard .exe installer.

The managed token location

Both recipes end at the same machine-wide location.

The value sits directly under the key. Some policy tooling writes each setting into a subkey named after the setting. A token at …\ZPL Tools\EnrollmentToken\ is not read. Write a value on the key itself.

The key is readable machine-wide. A per-user install of the app therefore reads it as well.

Choose an installer

The .exe stays the default download. Use the .msi for a fleet. To move a managed fleet to a new version, deploy the new .msi.

Both installers work with recipe 2, because the registry value is independent of the installer.

Recipe 1. Intune Win32 app with the MSI

1. Read the install_url and install_sha256 fields from https://releases.zpl.tools/manifests/stable/windows/x86_64/msi/latest.json.

2. Download the MSI from install_url. Verify it against install_sha256.

3. Read the product code out of the MSI. Keep it for step 8.

   $msi = 'C:\pkg\ZPL Tools_0.0.0_x64_en-US.msi'
   $installer = New-Object -ComObject WindowsInstaller.Installer
   $db = $installer.OpenDatabase($msi, 0)
   $view = $db.OpenView("SELECT Value FROM Property WHERE Property='ProductCode'")
   $view.Execute()
   $view.Fetch().StringData(1)

4. Put the MSI alone in a source folder. Wrap the folder with the Microsoft Win32 Content Prep Tool.

   IntuneWinAppUtil -c C:\pkg -s "ZPL Tools_0.0.0_x64_en-US.msi" -o C:\out

5. Create a Win32 app in Intune. Upload the .intunewin file.

6. Set the install command. Substitute your own token.

   msiexec /i "ZPL Tools_0.0.0_x64_en-US.msi" /qn ENROLLMENTTOKEN=zpet_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

7. Set the uninstall command to msiexec /x {PRODUCT-CODE} /qn.

8. Set the install behavior to System. Add a detection rule of type MSI, with the product code from step 3.

9. Assign the app to your device group.

ENROLLMENTTOKEN is a secure public property, so the elevated system-context install can read it. The MSI stores the token, and then remembers it. An upgrade or a repair keeps the stored value, with no token on the command line.

Do not add a second detection rule for the .exe installer. A station can otherwise hold both installs at once.

Token rotation on a station that already has one

An upgrade or a repair never clears a stored token. To replace one, pass the new token in the install command of the next deployment. To remove one, uninstall the app, or delete the registry value with recipe 2.

Recipe 2. Registry write, any MDM

This recipe needs no repackaging. Run the script in system context, before or after the app itself is installed.

$key = 'HKLM:\SOFTWARE\Policies\zpl.tools\ZPL Tools'
New-Item -Path $key -Force | Out-Null
New-ItemProperty -Path $key -Name 'EnrollmentToken' `
  -Value 'zpet_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' -PropertyType String -Force | Out-Null

In Intune, add this as a platform script. Set Run this script using the logged on credentials to No. The Intune management extension then runs it as SYSTEM.

With Group Policy, use a computer-scope registry preference item for the same key, value name and type. Any MDM or configuration-management tool that writes HKLM works the same way.

Recipe interaction

The registry value is the MSI component keypath. An MSI install therefore adopts a value already at that key as its own component state.

A later msiexec /x uninstall then removes the value, because Windows Installer removes a component's keypath on uninstall. An uninstall of the MSI can therefore delete a token that recipe 2 wrote by hand.

What the app does with the token

At first launch with no enrollment state, the app reads the managed token and enrolls the device. The device joins your organization with the profile the token carries. No operator interaction is needed.

Manual token entry stays available at all times. An operator, or a technician, can enroll one station by hand.

An enrollment that presents a device UUID already known to the organization updates that device record. It never creates a second record. A station that lost its local license state, but kept its device UUID, therefore returns to the same record.

A station whose whole application-data folder is gone has no device UUID either. It enrolls as a new device, and the old record goes stale. Revoke stale records from the device list.

Token security

Every user of the station can read the registry value, not only an administrator. A standard account can read HKLM\SOFTWARE\Policies by default. Treat the token as a shared secret for the site, not as a per-user credential.

• Mint one token per site, or per deployment batch. A leak is then bounded to that site.
• Set an expiry on the token. Organization policy can require one.
• An expired or disabled token stops new enrollments only. Devices already enrolled keep their license and keep working.
• To stop one station, revoke that device. Revocation ends that device's credential, and the station stops holding a valid license.
• On a managed station, also remove the registry value or disable the token. A valid managed token re-enrolls a revoked station at its next check, because the token is the authorization gate.
• The app also accepts the same value under HKCU for user-context deployments. The machine-wide HKLM value wins when both exist. A user can write their own HKCU value, so this path is not a security boundary.
• The installer logs hide the token value. The MSI marks the token properties hidden, so a /l*v log shows the masked value, not the token.

The token enrolls floor devices into one organization. It carries no user identity and grants no access to your account.

Signed installers

The current installers are not signed with an Authenticode certificate. A silent system-context install accepts them. A fleet that enforces publisher rules, through WDAC or AppLocker, needs the signed build. Contact us before a pilot on such a fleet.