Deploy the Windows app with Intune
Use this article if you push Mobile Locker to Windows PCs with Microsoft Intune or another mobile device management (MDM) product. You do not build the app. For Intune, download the signed .intunewin package we publish, upload it as a Win32 app, and assign it to users. For other MDM products, download the signed Setup EXE and run it silently.
This article is for the current Windows desktop app (version 5.x). For the iOS app in an MDM catalog, see Add the iOS app to your MDM.
Previous Windows app (version 2.x): If PCs still have the previous Windows app, remove it first. Then deploy this package. See Remove the previous Windows app.
Production fleets: Use the stable package. The beta package is for pilots and evaluation only. See Windows app release notes for the current version.
On this page
Before you start
Confirm each target PC meets these requirements:
- Windows 10 version 2004 (build 19041) or later, or Windows 11
- 64-bit (x64) only. On ARM PCs, run the x64 build under emulation. There is no ARM64 build.
- About 200 MB of free disk space for the app, plus space for presentations the user downloads later
- The user can install software for their own profile. The Setup does not need administrator rights, and it does not write to Program Files.
Allow the domains in IT Considerations for the Windows App on port 443. That article also covers Windows Defender and Zscaler.
Download the installer
For Intune Win32, download the .intunewin package below. Do not download the Microsoft Win32 Content Prep Tool. Do not wrap the Setup yourself unless you have a reason (custom scripts, or an older package you already maintain).
The Setup EXE and MSI stay available for website downloads, ConfigMgr, AppLocker tenants, and other MDM products.
Intune package
| Channel | Who should use it | Live package |
|---|---|---|
| Stable | Production fleets | MobileLocker-stable-Setup.intunewin |
| Beta | Pilots and evaluation | MobileLocker-beta-Setup.intunewin |
A versioned copy sits next to the matching Setup EXE. The file name includes the version number. Use the live channel file unless you need to pin a specific version. See Windows app release notes for the current version.
The wrap contains only:
MobileLocker-stable-Setup.exe(orMobileLocker-beta-Setup.exefor the beta wrap). This is the same signed Setup as the website.uninstall.cmd(silent uninstall; see the Program table)
Setup EXE and MSI
| Channel | Who should use it | Setup EXE |
|---|---|---|
| Stable | Production fleets | MobileLocker-stable-Setup.exe |
| Beta | Pilots and evaluation | MobileLocker-beta-Setup.exe |
The file is Authenticode-signed as Vorenus Ventures LLC. If SmartScreen or your security tools block the download, allow that publisher rather than an unsigned copy.
In the Intune install command, use the exact file name inside the package (for example MobileLocker-stable-Setup.exe --silent). If you use the beta wrap, change the file name to MobileLocker-beta-Setup.exe.
How the app installs
The Setup installs per user. It does not need elevation. It does not install a separate .NET Desktop Runtime. The app is self-contained.
| Item | Location |
|---|---|
| App binaries | %LocalAppData%\MobileLocker\current\ |
| Main executable | %LocalAppData%\MobileLocker\current\MobileLocker.exe |
| Update program | %LocalAppData%\MobileLocker\Update.exe |
| App data (database, settings, logs) | %LocalAppData%\MobileLocker\ |
App data sits next to the current folder, not inside it.
Do not install this app in system context or under Program Files. Detection and upgrades assume the logged-on user profile. A system-context install will fail or land in the wrong place.
Add the app in Intune
Treat Mobile Locker as a Win32 app, not a Microsoft Store app and not a line-of-business MSI (unless you use the MSI path below). The Intune wizard steps are App information, Program, Requirements, Detection rules, Dependencies, then Supersedence.
Upload the Intune package
- Download MobileLocker-stable-Setup.intunewin from the table above (or the beta file for a pilot).
- In Microsoft Intune, go to Apps > Windows > Add > Windows app (Win32).
- Upload the
.intunewinfile. - Work through the wizard pages below, in order.
App information
| Field | Value |
|---|---|
| Name | Mobile Locker for the stable package. Use Mobile Locker BETA for the beta package. Names in Company Portal must be unique. |
| Description | Short description for Company Portal. Do not leave the auto-filled Setup file name. |
| Publisher | Mobile Locker |
| App version | Keep the value Intune fills from the package. On stable it matches the current version in Windows app release notes. On beta it has a BETA suffix. |
| Category | Productivity (optional) |
| Show this as a featured app | No, unless you want it on the Company Portal home page. |
| Information URL | Optional. You can use this article. |
| Privacy URL, Developer, Owner, Notes | Leave blank unless your IT process requires them. |
| Logo | Use our app icon (square PNG), not the wordmark with tagline. Save mobilelocker_icon.png, then upload it in Intune. If the browser opens the image, right-click and choose Save as. |
Program
| Field | Value |
|---|---|
| Installer type | Command line. Do not switch to a PowerShell script. |
| Install command | MobileLocker-stable-Setup.exe --silent |
| Uninstaller type | Command line |
| Uninstall command | uninstall.cmd |
| Installation time required (mins) | 60 (Intune default). The Setup finishes much sooner. Intune only marks the job failed if it still runs after this timeout. |
| Allow available uninstall | Yes for a pilot, so you can test uninstall from Company Portal. Set No if users must not remove the app from Company Portal. |
| Install behavior | User |
| Device restart behavior | No specific action. Setup does not restart Windows. Do not choose Intune will force a mandatory device restart. |
| Return codes | Keep Intune's default rows. Success for this Setup is 0. |
If you package the beta Setup, change the install command to MobileLocker-beta-Setup.exe --silent.
Microsoft Intune does not expand environment variables in the Uninstall command. That is why the wrap includes uninstall.cmd. You do not copy an Uninstall string from a pilot PC when you use our package.
If you still have an older wrap that does not include uninstall.cmd, you can copy the Uninstall string from a pilot PC as a fallback. On the pilot PC, look under:
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\
Optional support log:
MobileLocker-stable-Setup.exe --silent --log %TEMP%\MobileLocker-setup.log
Entra registered devices. Microsoft says Entra registered (workplace-joined) devices should use Win32 install behavior System. Mobile Locker is a per-user app and must stay User. Do not switch to System on those PCs.
Requirements
Do not leave Check operating system architecture on No. Allow this app to be installed on all systems. The app is 64-bit (x64) only.
| Field | Value |
|---|---|
| Check operating system architecture | Yes. Specify the systems the app can be installed on. Then select 64-bit. Do not select 32-bit. There is no ARM64 build. On ARM PCs, Windows can run the x64 build under emulation. |
| Minimum operating system | Windows 10 2004 (this also allows later Windows 10 and Windows 11) |
| Disk space required (MB) | 200 (optional). This is for the app only. Presentations the user downloads later need extra space. |
| Physical memory required (MB) | Leave blank |
| Minimum number of logical processors required | Leave blank |
| Minimum CPU speed required (MHz) | Leave blank |
| Configure additional requirement rules | None. Do not add file, registry, or script rules here. |
Detection rules
The first field is Rules format. Intune shows two options. Choose Manually configure detection rules. Do not choose Use a custom detection script unless file detection fails in your tenant.
| Field | Value |
|---|---|
| Rules format | Manually configure detection rules |
| Rule type | File. Do not use an MSI rule. |
| Path | %LocalAppData%\MobileLocker\current |
| File or folder | MobileLocker.exe |
| Detection method | File or folder exists |
| Associated with a 32-bit app on 64-bit clients | No |
Optional second rule: the same path, file MobileLocker.exe, detection method String (version) or file version greater than or equal to the version you shipped. Do not use an exact version. Exact detection fights in-app updates.
Alternate file if you prefer: %LocalAppData%\MobileLocker\Update.exe.
If file detection does not see the user profile, go back and choose Use a custom detection script. The script must check the logged-on user’s %LocalAppData%\MobileLocker\current\MobileLocker.exe.
Dependencies
Add none. The app is self-contained. It does not need a separate .NET Desktop Runtime or another Win32 app.
Supersedence
Add none on the first package. When you later upload a new .intunewin, you can supersede this app so Intune replaces the old package. A new file on S3 does not update apps already in your tenant.
Assignments
Choose Required or Available, as your IT policy prefers.
Pilot first. Assign the app to one user and confirm Intune reports Installed before you assign it as Required to a large group.
Advanced: wrap it yourself
Use this path only if your IT process already wraps Win32 apps, or you need extra files in the package. For a normal Intune deploy, use our .intunewin instead.
- Download the Setup EXE into an empty folder.
- Add an
uninstall.cmdfile in the same folder:
@echo off "%LOCALAPPDATA%\MobileLocker\Update.exe" uninstall -s
- Use the Microsoft Win32 Content Prep Tool to wrap that folder into a
.intunewinfile. See Microsoft’s Prepare Win32 app content for upload. - In Microsoft Intune, go to Apps > Windows > Add > Windows app (Win32).
- Upload the
.intunewinfile and fill the wizard pages above. The Uninstall command is stilluninstall.cmd.
Turn off public auto-update
Public auto-update is on by default, including after an Intune install. If Intune is only for first install, leave the feed on. The app then takes later versions from our public feed, the same way a website install does.
Set the value below only when Intune must own the version. Then you control upgrades by uploading a new .intunewin. Do not set this for every Intune tenant.
If you do lock the version, set this value before or with the app (Intune configuration profile, remediation script, or a prerequisite Win32 app):
HKLM\SOFTWARE\Mobile Locker\Updates\DisablePublicAutoUpdate = 1
Use a REG_DWORD of 1. A non-zero value turns public auto-update off. The app also stops manual Check for updates when this value is set.
For a lab or a single pilot account you can set the same name under HKCU\SOFTWARE\Mobile Locker\Updates\. Prefer HKLM for the fleet.
Do not leave public auto-update on if Intune also locks the app version. Devices will update outside your cycle.
Upgrades and uninstall
Upgrades
When we publish a new package, download the new .intunewin and update the Win32 app in Intune (replace the content, or use supersedence). A new file on S3 does not update apps already in your tenant.
If you turned public auto-update off so Intune owns the version, do not rely on the public feed.
In-app updates replace files under current\ and keep app data. An Intune uninstall followed by a new install does the same for data, as long as you do not purge the profile.
Uninstall
A normal uninstall removes the binaries (current\ and Update.exe). It keeps the user’s database, settings, and logs under %LocalAppData%\MobileLocker\. That is intentional, so a reinstall does not wipe offline work.
If you must erase a user’s Mobile Locker data, contact Mobile Locker support. Do not delete another user’s profile from a system-context script.
Use the MSI instead
Prefer the published .intunewin for Intune. Use the MSI only when AppLocker or a similar control blocks a user-launched EXE. Do not wrap the MSI as a second Intune package. Upload the raw .msi.
The MSI installs to the same per-user folder. Detection is still %LocalAppData%\MobileLocker\current\MobileLocker.exe.
Silent install:
msiexec /i MobileLocker-stable.msi /qn
The MSI sits next to the matching Setup:
- Stable: MobileLocker-stable.msi
- Beta: MobileLocker-beta.msi
Other MDM products
The same Setup EXE works in ConfigMgr and other MDMs that can run a per-user EXE. Those products do not use the .intunewin file.
- Install as the logged-on user, not SYSTEM.
- Command:
MobileLocker-stable-Setup.exe --silent(orMobileLocker-beta-Setup.exe --silentfor a pilot). - Detect
%LocalAppData%\MobileLocker\current\MobileLocker.exe. - Set
DisablePublicAutoUpdate=1only when the MDM owns versions.