Packaging & Deploying Complex Win32 Apps in Microsoft Intune: Advanced Detection Rules, Silent Transforms & Exit Code Architecture

# ==============================================================================
# Enterprise Win32 App Installer Wrapper (Deploy-Application.ps1)
# ==============================================================================
[CmdletBinding()]
param()

$AppName    = "CheckPointEndpointSecurity"
$AppVersion = "E88.20"
$LogDir     = "$env:ProgramData\Microsoft\IntuneManagementExtension\Logs"
$LogFile    = "$LogDir\$($AppName)_Install.log"

if (-not (Test-Path $LogDir)) { New-Item -Path $LogDir -ItemType Directory -Force | Out-Null }

function Write-Log {
    param([string]$Message)
    $stamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    "[$stamp] $Message" | Out-File -FilePath $LogFile -Append -Encoding UTF8
    Write-Host "[$stamp] $Message"
}

Write-Log ">>> Starting Installation of $AppName ($AppVersion)..."

# 1. Terminate conflicting processes gracefully
$blockingProcesses = @("EPLogListener", "CPDA", "FortiClient", "Setup")
foreach ($proc in $blockingProcesses) {
    Get-Process -Name $proc -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
}

# 2. Execute MSI with Transform and Logging
$msiPath = Join-Path -Path $PSScriptRoot -ChildPath "CheckPointEndpoint.msi"
$mstPath = Join-Path -Path $PSScriptRoot -ChildPath "EnterpriseConfig.mst"
$msiLog  = "$LogDir\$($AppName)_MSI.log"

$arguments = "/i `"$msiPath`" TRANSFORMS=`"$mstPath`" /qn /norestart ALLUSERS=1 /lv*v `"$msiLog`""

Write-Log "Invoking msiexec.exe with arguments: $arguments"
$process = Start-Process -FilePath "msiexec.exe" -ArgumentList $arguments -Wait -PassThru -NoNewWindow

Write-Log "MSI execution finished with Exit Code: $($process.ExitCode)"

# 3. Handle Exit Codes for Intune Management Extension
switch ($process.ExitCode) {
    0    { Write-Log "SUCCESS: Installation completed successfully."; exit 0 }
    3010 { Write-Log "SUCCESS: Soft reboot required (Exit Code 3010)."; exit 3010 }
    1641 { Write-Log "SUCCESS: Hard reboot initiated (Exit Code 1641)."; exit 1641 }
    default {
        Write-Log "ERROR: Installation failed with unhandled exit code: $($process.ExitCode)"
        exit $process.ExitCode
    }
}

# ==============================================================================
# Custom Detection Script for Win32 App
# Intune Requirement: Output to STDOUT + Exit 0 = Installed
# ==============================================================================
$targetBinary = "$env:ProgramFiles(x86)\CheckPoint\Endpoint Security\Endpoint Common\cpda.exe"
$minVersion   = [version]"88.20.0.12"

if (Test-Path $targetBinary) {
    try {
        $rawVersion = (Get-ItemProperty -Path $targetBinary).VersionInfo.FileVersion
        $currentVersion = [version]($rawVersion -replace '[^\d\.]', '')

        if ($currentVersion -ge $minVersion) {
            Write-Host "Detected $targetBinary with version $currentVersion (Minimum required: $minVersion)"
            exit 0
        } else {
            # Version is lower than expected
            exit 1
        }
    } catch {
        exit 1
    }
} else {
    # File does not exist on disk
    exit 1
}