App Control for Business Managed Installer Toolkit

Manage Managed Installers for App Control for Business through Microsoft Intune. The toolkit provides detection and remediation scripts with two configuration modes: ADMX-backed policy settings or an embedded JSON configuration for deployments that don't use a custom ADMX.

Managed Installer is a powerful but underused Windows trust mechanism. Intune's built-in controls currently expose only the Intune Management Extension as a Managed Installer. This toolkit makes additional, deliberately selected installer and update services centrally configurable while keeping every trust decision explicit.

The initiative is intended to help organizations develop a more practical trust model and adopt App Control for Business more broadly. App Control for Business provides an important barrier against unknown and malicious software, while Managed Installer can reduce the operational burden of authorizing legitimate software delivery paths.

The toolkit manages the Managed Installer component used by App Control for Business. It does not create, modify, convert, or deploy the App Control for Business policies themselves.

Release status

The current stable toolkit version is 1.1.1. The toolkit supports both ADMX-backed Policy mode and ADMX-free Embedded mode. See CHANGELOG.md for release notes or download the v1.1.1 distribution ZIP.

The toolkit deliberately contains no built-in product presets. The ADMX provides twenty reusable Managed Installer rule slots; administrators copy verified values from the Managed Installer library, or collect values from their own signed installer.

Why this design

• The ADMX remains stable when vendors change versions, product names, or signing details.
• Detection and remediation contain no vendor catalog and have no internet dependency.
• Every tenant explicitly controls the exact publisher rule it trusts.
• Library entries can evolve independently and are examples, not remotely applied configuration.

Policy layout

Managed Installers
├── Managed Installer 01
├── ...
└── Managed Installer 20

Each slot contains Display name, Publisher name, Product name, Binary name, and Minimum version. Slots use stable generated rule IDs, so changing a field updates the existing slot instead of accumulating rules.

Quick start

Choose one configuration mode and use the same mode in both scripts.

Policy mode (default)

1. Import admx/ManagedInstallers.admx and admx/en-US/ManagedInstallers.adml into Intune.
2. Create a device configuration profile from the imported administrative template.
3. Enable at least one Managed Installer 01–20 setting and enter all five fields. You can copy an example from the library.
4. Deploy scripts/Detect-ManagedInstallers.ps1 and scripts/Remediate-ManagedInstallers.ps1 as an Intune Remediation, running as SYSTEM in 64-bit PowerShell.
5. Start with a test group and verify the effective AppLocker policy before broad deployment.

Embedded mode (without ADMX)

1. Open both PowerShell scripts.
2. Set $configurationMode = 'Embedded' in both scripts.
3. Replace $embeddedManagedInstallersJson with the same desired rules in both scripts.
4. Give $embeddedConfigurationVersion the same value in both scripts.
5. Deploy both scripts as an Intune Remediation, running as SYSTEM in 64-bit PowerShell.
6. Confirm that detection and remediation report the same configuration fingerprint.

See Embedded configuration for the complete procedure and safety behavior.

Each rule is three-state. Enabled creates or updates that rule. Disabled and Not configured both cause a previously managed rule in that slot to be removed during remediation. Use Disabled when you want the configuration profile to express an explicit off-state; use Not configured when the slot no longer needs to be represented in the profile.

The ADMX configuration is authoritative for the complete Managed Installer collection. Detection reports every additional Managed Installer rule as noncompliant, and remediation removes all existing local Managed Installer rules before applying the enabled slots. Unrelated rules in the EXE, DLL, MSI, Script, and packaged-app collections are preserved.

Safety boundaries

The scripts accept signed publisher rules only. They reject wildcards, paths, and a configurable blocklist of high-risk generic executables. A Managed Installer is a trust boundary: software launched by it can receive Managed Installer origin, so use the narrowest practical publisher, product, executable, and minimum version.

Documentation

• Managed Installer library
• FAQ
• Architecture
• Intune deployment
• Detection and remediation
• Embedded configuration without ADMX
• Creating Managed Installer rules
• Retrieving publisher information
• Troubleshooting
• Related resources and acknowledgements

Versioning and contributions

This project follows Semantic Versioning. Library-only corrections can be released without changing the ADMX or scripts. Issues and pull requests are welcome; see CONTRIBUTING.md.

License

MIT