Intune installs Win32 apps as SYSTEM with no desktop. Anything the installer tries to ask (a licence prompt, a "create a shortcut?" checkbox, a reboot dialog) is shown to nobody, and the install sits there until Intune gives up after its timeout and reports a failure. The silent switch is what stops the installer asking. Most installers are built with one of a handful of toolkits, and each toolkit has its own switches; recognising the toolkit is most of the job.
The switches, by toolkit
| Toolkit | How to recognise it | Silent install | Silent uninstall |
|---|---|---|---|
| Windows Installer (MSI) | The file is an .msi, or an .exe that extracts one. | msiexec /i "app.msi" /qn /norestart | msiexec /x {ProductCode} /qn /norestart |
| Inno Setup | Setup.exe with an "Inno Setup" string in its properties; writes an {AppId}_is1 uninstall key. | /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- | unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART |
| NSIS (Nullsoft) | "Nullsoft Install System" in the file properties; uninstall.exe beside the app. | /S | uninstall.exe /S |
| WiX Burn bundle | A single .exe carrying several MSIs; shows a WiX-style bootstrapper UI. | /quiet /norestart | bundle.exe /uninstall /quiet /norestart |
| InstallShield | setup.exe with an InstallShield banner; often an MSI inside. | /s /v"/qn /norestart" | /s /x /v"/qn" (MSI-based) or /s /f1uninst.iss (legacy) |
| Squirrel (many Electron apps) | Installs per user into %LocalAppData%; a Setup.exe with no options at all. | --silent | Update.exe --uninstall -s |
| Chromium-style installers | Chrome, Brave, Edge and friends: an online or standalone .exe. | /silent /install | setup.exe --uninstall --system-level --force-uninstall |
Case matters for some of these: NSIS wants a capital /S, and its optional install directory switch /D=C:\Path must come last and must not be quoted, even when the path has spaces. MSI switches are not case-sensitive.
MSI, a little more carefully
msiexec /i "app.msi" /qn /norestart ALLUSERS=1 REBOOT=ReallySuppress /l*v "%TEMP%\app-install.log"
/qnis fully silent;/qb!shows a progress bar with no cancel button, which is pointless under SYSTEM but useful when testing interactively./norestartstops the installer rebooting. The install then returns3010when a reboot is pending, which Intune treats as success with a soft reboot by default. Leave 3010 in the return codes.- Public properties (
ALLUSERS=1,ADDLOCAL=..., vendor-specific ones likeDESKTOP_SHORTCUT=0) go after the switches. A property with a space in its value needs the whole thing quoted:INSTALLDIR="C:\My App". - A verbose log (
/l*v) costs nothing and is the only way to read a 1603 after the fact. Write it somewhere SYSTEM can write to.
Finding switches a vendor did not document
- Ask the installer.
setup.exe /?or/helpoften prints the toolkit's own usage text, which tells you the toolkit if nothing else. - Read the file properties. The Details tab names Inno Setup, Nullsoft or InstallShield more often than not.
- Check the winget manifest. The community repository records an
InstallerSwitches.Silententry for thousands of packages, maintained by people who had to get the same installer silent. It is the largest public collection of working switches there is. - Look for an enterprise download. Many vendors ship a consumer EXE and a quiet MSI for administrators (Chrome, Zoom, Slack, 7-Zip, Notepad++ all do). The MSI is nearly always the better Intune package.
Why a silent install still hangs
- Wrong context. A per-user installer (Squirrel, many Chromium-style setups without
--system-level) run as SYSTEM installs into the SYSTEM profile, where no user will ever see it. Set the install behaviour to User for those, or use the per-machine installer. - The installer returns before it finishes. Some setups spawn a child process and exit; Intune then runs detection against a half-installed app. Wrap them in a script that waits for the child, or in
Start-Process -Wait. - A prerequisite prompts. The app is silent, the runtime it bundles is not. Deploy the runtime as its own app and make it a dependency.
- Exit codes. 1641 and 3010 mean reboot, 1618 means another install is running (retry later), 1603 means read the log. Map the ones the vendor documents in the return codes table rather than letting them all read as failures.
- Test as SYSTEM, not as yourself.
psexec -s -i cmd.exegives you a SYSTEM shell that behaves like the Intune Management Extension. An install that works from your admin account and fails from Intune almost always fails here too.