Deploying Notepad++ to Intune

Information

Notepad++ infrastructure was recently compromised by state sponsored hackers which lead to some endpoints being compromised. The Notepad++ creators recommended everyone to update their Notepad++ to the latest version 8.91 which comes with improved security controls for updates. In this article, I’ll go through creating an Notepad++ application profile in Microsoft Intune.

Intunewin

The Notepad++ installer comes in .exe format which means we will need to generate an .intunewin file using Microsoft Content Prep Tool since that will allow us to setup the application profile in Microsoft Intune.

1. Download Notepad++

2. Download Microsoft Content Prep Tool

3. Start IntuneWinAppUtil and enter the following details.

4. IntuneWinAppUtil will generate an .intunewin file inside of the output folder.

Deployment

1. Go to Microsoft Intune.

2. Go to Apps → Windows → Windows Apps.

   

3. Select Windows App (Win32).

   

4. Upload notepad.intunewin file.

   

5. Enter Name, Description, Publisher, App Version, and etc…

   

6. Use the following configuration on Program section.

   • Install Command: notepad.exe /S
   • Uninstall Command: "C:\Program Files\Notepad++\uninstall.exe" /S

   

7. Use the following configuration for Requirements section.

   • Check operating system architecture: Yes
   • Options: Install on x64 system

   

8. Select Use a custom detection script and use the following detection script.

   $notepad = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++" -ErrorAction SilentlyContinue
    
   if ($notepad.DisplayVersion -eq "8.91") {
       exit 0
   }
   else {
       exit 1
   }

   

9. Select Groups or All Devices that should have Notepad++ installed.

   

10. Create the application profile.

Conclusion

The Notepad++ installer comes with .exe format installer instead of .msi and that forces us to use Microsoft Content Prep Tool to create an .intunewin file. However, after the .intunewin file is generated all that needs to be done is setting up the profile using the custom PowerShell detection script.