Deploy the Windows app with Intune

Use this article if you push Mobile Locker to Windows PCs with Microsoft Intune or another mobile device management (MDM) product. You do not build the app. You download the signed Setup we publish, wrap it, and assign it to users.

This article is for the new Windows desktop app. For the iOS app in an MDM catalog, see Add the iOS app to your MDM.

Production fleets: Use the stable Setup when it is available. The beta Setup is for pilots and evaluation. The stable file is not published yet. The expected URL is listed below.

On this page

Before you start
Download the installer
How the app installs
Add the app in Intune
- Wrap the Setup
- Intune app settings
Turn off public auto-update
Upgrades and uninstall
Use the MSI instead
Other MDM products

Before you start

Confirm each target PC meets these requirements:

Windows 10 version 2004 (build 19041) or later, or Windows 11
64-bit (x64) only. On ARM PCs, run the x64 build under emulation. There is no ARM64 build.
About 200 MB of free disk space for the app, plus space for presentations the user downloads later
The user can install software for their own profile. The Setup does not need administrator rights, and it does not write to Program Files.

Allow the domains in IT Considerations for the Windows App on port 443. That article also covers Windows Defender and Zscaler.

Download the installer

Use the signed Setup EXE. This is the same installer that a person would run from a website download. For MDM you wrap it and run it silently.

Channel	Who should use it	Setup EXE
Beta	Pilots and evaluation	MobileLocker-beta-Setup.exe
Stable	Production fleets	Not live yet. MobileLocker-stable-Setup.exe

The file is Authenticode-signed as Vorenus Ventures LLC. If SmartScreen or your security tools block the download, allow that publisher rather than an unsigned copy.

In the Intune install command, use the exact file name you put in the package (for example MobileLocker-beta-Setup.exe --silent). When you move to stable, change the file name in the package and in the install command.

How the app installs

The Setup installs per user. It does not need elevation. It does not install a separate .NET Desktop Runtime. The app is self-contained.

Item	Location
App binaries	`%LocalAppData%\MobileLocker\current\`
Main executable	`%LocalAppData%\MobileLocker\current\MobileLocker.exe`
Update program	`%LocalAppData%\MobileLocker\Update.exe`
App data (database, settings, logs)	`%LocalAppData%\MobileLocker\`

App data sits next to the current folder, not inside it.

Do not install this app in system context or under Program Files. Detection and upgrades assume the logged-on user profile. A system-context install will fail or land in the wrong place.

Add the app in Intune

Treat Mobile Locker as a Win32 app, not a Microsoft Store app and not a line-of-business MSI (unless you use the MSI path below).

Wrap the Setup

Download the Setup EXE into an empty folder.
Use the Microsoft Win32 Content Prep Tool to wrap that folder into a .intunewin file.
In Microsoft Intune, go to Apps > Windows > Add > Windows app (Win32).
Upload the .intunewin file.

Intune app settings

Field	Value
Install behavior	User
Install command	`MobileLocker-beta-Setup.exe --silent`
Uninstall command	Copy the Uninstall string from a pilot PC after a silent install
Detection (primary)	`%LocalAppData%\MobileLocker\current\MobileLocker.exe`
Detection (alternate)	`%LocalAppData%\MobileLocker\Update.exe`
Detection (optional)	File version of `MobileLocker.exe` is at least the version you shipped
Requirements	64-bit; Windows 10 2004 or later / Windows 11
Return codes	`0` = success
Assignments	Required or Available, as your IT policy prefers

If you package the stable Setup, change the install command to MobileLocker-stable-Setup.exe --silent.

On the pilot PC, the uninstall string is under:

HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\

Optional support log:

MobileLocker-beta-Setup.exe --silent --log %TEMP%\MobileLocker-setup.log

Pilot first. Assign the app to one user and confirm Intune reports Installed before you assign it as Required to a large group. If file detection does not see the user profile in your tenant, use a custom detection script that checks the logged-on user’s %LocalAppData%\MobileLocker\current\MobileLocker.exe.

Turn off public auto-update

PCs that are not managed can update themselves from our public feed. On a managed fleet, that fights Intune. If Intune owns the version, turn the public feed off. Then you control upgrades by redeploying a new Setup.

Set this value before or with the app (Intune configuration profile, remediation script, or a prerequisite Win32 app):

HKLM\SOFTWARE\Mobile Locker\Updates\DisablePublicAutoUpdate = 1

Use a REG_DWORD of 1. A non-zero value turns public auto-update off. The app also stops manual Check for updates when this value is set.

For a lab or a single pilot account you can set the same name under HKCU\SOFTWARE\Mobile Locker\Updates\. Prefer HKLM for the fleet.

Do not leave public auto-update on if Intune also locks the app version. Devices will update outside your cycle.

Upgrades and uninstall

Upgrades

When we publish a new Setup, wrap the new file and assign the updated Win32 app. Do not rely on the public feed on a locked fleet.

In-app updates replace files under current\ and keep app data. An Intune uninstall followed by a new install does the same for data, as long as you do not purge the profile.

Uninstall

A normal uninstall removes the binaries (current\ and Update.exe). It keeps the user’s database, settings, and logs under %LocalAppData%\MobileLocker\. That is intentional, so a reinstall does not wipe offline work.

If you must erase a user’s Mobile Locker data, contact Mobile Locker support. Do not delete another user’s profile from a system-context script.

Use the MSI instead

Prefer the Setup EXE wrapped as Intune Win32. Use the MSI only when AppLocker or a similar control blocks a user-launched EXE.

The MSI installs to the same per-user folder. Detection is still %LocalAppData%\MobileLocker\current\MobileLocker.exe.

Silent install:

msiexec /i MobileLocker-beta.msi /qn

When the stable MSI is published, it will sit next to the stable Setup:

Beta: MobileLocker-beta.msi
Stable (not live yet): MobileLocker-stable.msi

Other MDM products

The same package works in ConfigMgr and other MDMs that can run a per-user EXE.

Install as the logged-on user, not SYSTEM.
Command: MobileLocker-beta-Setup.exe --silent (or the stable file name).
Detect %LocalAppData%\MobileLocker\current\MobileLocker.exe.
Set DisablePublicAutoUpdate=1 when the MDM owns versions.