Intune Win32 deployment
Each organisation manages its own installer download, enrolment keys and Intune deployment strings from its own portal, under Downloads (/portal/downloads). This page describes the shape of what you will find there; the exact filename, version, SHA-256 and product code are generated per build and shown live on that page.
Getting the installer and an enrolment key
- Sign in to your organisation's portal and open Downloads.
- Under Agent installer, download the current MSI. The page shows its version, size and SHA-256.
- Under New enrolment key, create a key (optionally scoped to one site; leave blank for an org-wide key any device can use). The key is shown once, copy it immediately. The portal then prints ready-to-use Intune install/uninstall commands for that key.
Creating the app (Intune admin center)
Apps > Windows > Add > App type: Windows app (Win32), upload the .intunewin package built from that MSI, then:
| Field | Value |
|---|---|
| Name | Lockdown Alert |
| Description | Full-screen lockdown alert client. The device enrols with a one-time key, is assigned a site by your organisation, and shows a full-screen alert when that site's lockdown is triggered. |
| Publisher | Input IT Limited |
| App version | the version shown on the Downloads page |
| Install command | msiexec /i "LockdownAlert-<version>.msi" ENROLKEY=<key> /qn |
| Uninstall command | msiexec /x <ProductCode> /qn when the Downloads page
shows one, otherwise msiexec /x "LockdownAlert-<version>.msi" /qn |
| Install behavior | System |
| Device restart behavior | No specific action |
The ENROLKEY MSI property is written to the
HKLM\SOFTWARE\InputIT\LockdownAlert registry value by the installer; the agent reads it on
first run and enrols itself. No further per-device configuration is needed.
Requirements: OS architecture 64-bit, minimum OS Windows 10 1607.
Detection rules
Manually configure, add one rule:
| Field | Value |
|---|---|
| Rule type | Registry |
| Key path | HKEY_LOCAL_MACHINE\SOFTWARE\InputIT\LockdownAlert |
| Value name | InstalledVersion |
| Detection method | Version comparison |
| Operator | Greater than or equal to |
| Value | the version you are deploying |
"Greater than or equal to" (not "equal to") stops Intune "repairing" a machine the self-updater has already moved past the version it installed.
Assignments: Required, a pilot device group first (one PC at one site); widen after the pilot drill passes.
Self-update (do not re-push through Intune)
From first install the agent updates itself: a daily scheduled task calls the update endpoint with its
device token, verifies the offered MSI's SHA-256, and silently upgrades via msiexec. Never
re-package or re-push a new version through Intune for an already-enrolled fleet; the whole fleet follows
the newly published MSI within roughly 24 hours. Intune's only jobs are the first install on a device and
reinstalling if someone removes the app.
- A scheduled update run defers, and logs why, when it falls inside teaching hours (weekdays 07:30-15:45), the machine is on battery, or the connection is metered. After 14 days with no successful check every guard is overridden.
- ProductCodes change every version. Never hard-code one in the Intune uninstall command if the fleet may have self-updated past the version Intune installed.
Locked PCs
The alert cannot draw on the Windows lock screen (a separate secure desktop); the tone still plays through the speakers and, on unlock, the client brings the alert to the front.
No contact details baked into the agent
By design the agent has no ticket-raising UI, remote-assistance launcher or phone number or email address anywhere in its interface. The Programs & Features help link points to lockdownalert.co.uk/support.html.