Identifying patches for Intune installations

[JamesLongGWCT]

I am deploying ArcGIS Pro using our Microsoft Intune device management platform.

I use the Microsoft Win32 Intune Prep Tool to create package to add to Intune and make the application available for users to install it. Part of adding this to Intune is that you have to specify an identifier that the application has installed to prevent it trying to install again if you have deployed it to a device. For a vanilla installation, this is easy because I just choose a file that is installed as part of the installation, so I choose the application .exe.

For patches, its proving very difficult. I thought I could choose a registry key, so went hunting in HKLM/Software/ESRI and found the keys. The build number seemed the obvious key to choose, but I've looked up build numbers FAQ: What Are the Build Numbers for Releases of ArcGIS Pro? (esri.com) and found that ESRI haven't changed the build number for the patches (why?).

Can anyone suggest a registry key or a unique file to identify each patch?

[DeniseVachon]

Hey James. Did you ever figure this out? I was about to post a similar question. We are having a hard time getting Intune to recognize that a patch has been successfully installed.

[JamesLongGWCT]

I'm afraid I didn't and frankly its a mess.

I tried a manual method of making the latest patch into a Win32 app with the Intune Prep Tool and making it install as follows -

1. Setup the patch so that the full package is a pre-requisite (ie. it has to install the full app before it installs the patch).
2. Remove the full package so its not listed in the Intune Company Portal.
3. Publish the patch into the Company Portal, but give it a name of "ArcGIS Pro". Then users see ArcGIS Pro in the company portal and install that. It will install the full package and the patch.

That fixes the problem for staff who want to install the app from scratch as it will patch them to the latest build. But it doesn't provide automatic patching for existing installations. I have published the patches into the company portal and tell staff to patch their own software. I have requested PatchmyPC to provide ArcGIS Pro patches, but they only seem to be keen on publishing non-commercial applications for patching.

Hopefully, Microsoft will implement their promised software patching module in Intune soon and it will provide patches for ESRI and the licensing for the add-on won't be too expensive.

[RikkiFulton]

Does it update the exe version of the app after it's patched?  if so you could use the version to identify if it's installed.

[JamesLongGWCT]

I thought I ought to update everyone on the status of this. Unfortunately, publishing the app on Intune was a failure. I believe the size of the application causes the installation to fail, theres probably some sort of timeout set in Intune for app installations. Users reported that the installation appeared to be installing, but then failed. Only a few managed to get it to work.

I therefore decided to consider some alternative methods and came up with an ingenious solution. I wrote a Powershell script to install the application. The script creates a log so I can check if any issues occur and shows a popup to tell users to close ArcGIS as its about to upgrade (it can prompt with a script exit if you want to give users the choice to postpone).

The issue was then how to make the installer files available to all my ArcGIS Pro users as I couldn't rely on each of them to download the installer and extract it to a specific folder and then do the same every time a patch or new version became available. As we all use OneDrive, I decided to use that. I created a folder named AppUpdates in a SharePoint library. Then I created a folder named ArcGISPro36 and uploaded the extracted installation files into the folder. I got my users to go to the SharePoint library, right click the AppUpdates folder and choose Add shortcut to OneDrive. This creates a shortcut to the location in their OneDrive which behaves like the folder is in their OneDrive. I then got them to right click the shortcut and choose Always Keep On This Device, this makes an offline copy of the installer files on their laptop.

The Powershell script can now be published in Intune, either as a Remediation script which has a detection script which detects the version number and runs or just published as a script. The script is applied to an Entra group containing all my licensed ArcGIS Pro users.

I've now successfully used this script to upgrade to ArcGIS Pro 3.5, upgraded 3.5 point versions and recently started upgrading users to 3.6. With 3.6, I had some issues until I realised that I needed to install the new ArcGIS Pro pre-requisites (latest patch release of .NET Desktop Runtime 8.0 and Edge WebView2 Runtime) to the laptops.

I can publish a more detailed set of instructions and my script if anyone wants it.