> ## Documentation Index > Fetch the complete documentation index at: https://docs.screenpipe.com/llms.txt > Use this file to discover all available pages before exploring further. # Deploy Screenpipe via Microsoft Intune > Fleet-deploy Screenpipe enterprise to Windows devices via Microsoft Intune by assigning a Microsoft Entra group for automatic installation. Deploy Screenpipe enterprise to every Windows machine in a Microsoft Entra (Azure AD) security group via Intune. No per-laptop install, no IT touching individual devices. end-to-end takes \~10 minutes once you have the enterprise license. > [!NOTE] > > This guide is for IT admins on **Screenpipe enterprise**. Consumer / team plans don't ship the .intunewin package. If you don't have a license yet, email [sales@screenpi.pe](mailto:sales@screenpi.pe). ## Prerequisites * Screenpipe enterprise license (your admin email is on the license's `admin_emails`) * Microsoft Intune subscription (included in Microsoft 365 E3/E5, EMS E3/E5, or Intune standalone) * A Microsoft Entra security group containing the users that should receive Screenpipe * Access to the [Intune admin center](https://intune.microsoft.com) ## Step 1 — download the .intunewin Sign in to [screenpi.pe/enterprise](https://screenpi.pe/enterprise) with the admin email on your license, open the **builds** tab, and download the latest **Windows x64** `intunewin` file. The `.intunewin` is a Microsoft Win32 Content Prep wrapper around a code-signed NSIS installer (`screenpipe__x64-setup.exe`). Screenpipe builds this for every enterprise release. ## Step 2 — create the Win32 app in Intune In the [Intune admin center](https://intune.microsoft.com): **1. Navigate to apps** **Apps → Windows → Add**. For app type pick **Windows app (Win32)**. **2. Upload the package** **App package file** → upload the `.intunewin` from step 1. Intune reads the installer metadata automatically. **3. Fill in app information** Name, publisher, description as you'd like them to appear to end users in the Company Portal. Logo: download from [screenpi.pe/icon.png](https://screenpi.pe/icon.png). ## Step 3 — program (install & uninstall commands) ```bash install command theme={"system"} powershell.exe -ExecutionPolicy Bypass -File install-screenpipe-enterprise.ps1 ``` ```bash uninstall command theme={"system"} "%ProgramFiles%\screenpipe\uninstall.exe" /S ``` The `.intunewin` contains the signed NSIS installer plus `install-screenpipe-enterprise.ps1`. The wrapper runs the installer silently and writes `HKLM\SOFTWARE\screenpipe\InstallSource=Intune`, `UpdateManager=mdm`, and `Version=` so the app and enterprise dashboard can report that updates are Intune-managed. | Field | Value | | - | - | | Install behavior | **System** (machine-wide install — Screenpipe enterprise is built `perMachine`) | | Device restart behavior | **No specific action** (no reboot required) | | Return codes | Leave Intune's defaults (`0` success, `1707` success, `3010` soft reboot, `1641` hard reboot, `1618` retry) | ## Step 4 — requirements | Field | Value | | - | - | | Operating system architecture | X64 | | Minimum operating system | Windows 10 1809 | ## Step 5 — detection rules Pick **Manually configure detection rules**. For first-time installs, a file-exists rule is enough: | Field | Value | | - | - | | Rule type | File | | Path | `%ProgramFiles%\screenpipe` | | File or folder | `screenpipe-app.exe` | | Detection method | File or folder exists | | Associated with a 32-bit app on 64-bit clients | No | Intune uses this to decide whether the install succeeded and whether the app is already present on subsequent check-ins. For versioned upgrades, prefer a registry detection rule: | Field | Value | | - | - | | Rule type | Registry | | Key path | `HKEY_LOCAL_MACHINE\SOFTWARE\screenpipe` | | Value name | `Version` | | Detection method | String comparison | | Operator | Equals | | Value | The version you uploaded, for example `2.4.208` | | Associated with a 32-bit app on 64-bit clients | No | Without version-aware detection, Intune can tell that Screenpipe exists but cannot tell whether a device is still on an older release. ## Step 6 — dependencies & supersedence Screenpipe ships everything it needs (WebView2, ONNX Runtime, ffmpeg) bundled inside the NSIS installer. **leave dependencies empty.** If you're updating from an older deployed version, set **supersedence** to the previous Intune app entry so Intune uninstalls the old version cleanly. ## Step 7 — automatic updates Screenpipe enterprise supports two update managers: * **Intune/MDM-managed**: the recommended default for centrally managed fleets. Upload each new `.intunewin`, use the registry `Version` detection rule above, and supersede the previous app entry. * **Screenpipe-managed automatic updates**: the app can self-update from signed enterprise releases when enabled in the enterprise dashboard. In the enterprise dashboard, leave app updates on **auto-detect** unless you explicitly want the app to self-update. Devices installed through this Intune package stamp `UpdateManager=mdm`, so auto-detect keeps in-app updates disabled and lets Intune remain the source of truth. ## Step 8 — assignments Assign as **Required** to the Microsoft Entra security group containing your Screenpipe users (e.g. `screenpipe-users`). Intune will install Screenpipe on every device a group member signs into — typically within \~1 hour of next Intune check-in, or immediately if the user clicks **Sync** in Company Portal. > [!TIP] > > Also assign **Uninstall** to a "screenpipe-revoke" group if you want a kill switch — moving a user there triggers an automatic uninstall at next check-in. ## Step 9 — activate the enterprise license Screenpipe needs the license key to enable enterprise mode (centralized telemetry, policy enforcement, dashboard access). > [tab] Users paste it once > > After Intune installs Screenpipe, users open the app, choose **use enterprise key**, and paste the license key. The key is saved in the device's local Screenpipe configuration. If your organization requires account login, users choose **sign in with enterprise account** instead; the key-only route is disabled by that policy. > [tab] pre-stage via registry (zero-touch) > > Add a **PowerShell script** to your Intune device-configuration profile, assigned to the same group, that writes the key before Screenpipe first launches: > > ```powershell theme={"system"} > $key = "ENT-XXXX-XXXX-XXXX-XXXX" # your license key > New-Item -Path "HKLM:\SOFTWARE\screenpipe" -Force | Out-Null > Set-ItemProperty -Path "HKLM:\SOFTWARE\screenpipe" -Name "EnterpriseLicenseKey" -Value $key -Type String > ``` > > Screenpipe reads `HKLM\SOFTWARE\screenpipe\EnterpriseLicenseKey` on launch and self-activates without user interaction. The 64-bit registry view is preferred; the 32-bit view is also read for compatibility with older deployment scripts. ## Manual Windows update 1. Download the supplied Screenpipe Enterprise installer. 2. Open PowerShell in its folder as the employee's Windows user, without administrator elevation. 3. Run `.\installer.exe /UPDATE`, replacing `installer.exe` with the downloaded filename. 4. Open Screenpipe when installation finishes. Check **Settings → General → Version** to confirm the installed version. ## Verifying the deployment * In the Intune admin center: **Apps → Screenpipe → Device install status** shows per-device install state * On the device: `C:\Program Files\screenpipe\screenpipe-app.exe` exists, Screenpipe icon appears in the system tray after first user sign-in * In the [enterprise dashboard](https://screenpi.pe/enterprise) → **devices** tab: each installed device starts heartbeating within minutes of launch, scoped to your license ## Troubleshooting > [accordion] Installation succeeds in Intune but Screenpipe doesn't open > > NSIS perMachine installs to `%ProgramFiles%\screenpipe` but doesn't add a Start Menu autostart by default. Users either launch from Start Menu, or you can enable autostart via the enterprise policy: in the [enterprise dashboard](https://screenpi.pe/enterprise) → **policy** → toggle `autostart_on_login: true`. > [accordion] Device shows install failure with exit code 2 or 1603 > > Almost always insufficient privileges — confirm install behavior is **System**, not **User**. user-context installs can't write to `%ProgramFiles%`. > [accordion] Screenpipe shows 'license invalid' after install > > Either the registry pre-stage didn't run before first launch (check Intune script assignment / order) or the license key has expired. Check expiry in the [enterprise dashboard](https://screenpi.pe/enterprise) → **policy** → license info. > [accordion] Audio recording doesn't start > > On Windows, microphone access is permission-gated. Either deploy a Windows privacy-settings profile that grants Screenpipe microphone access, or have users approve once at first launch. policy-based grant is cleaner for fleet deployments — contact us if you need the AppX-style manifest mapping. ## Also see * macOS Jamf / Kandji / Mosyle deployment: contact us — `.pkg` distribution flow is identical in shape to the above but with macOS MDM tooling * Enterprise dashboard reference: [screenpi.pe/enterprise](https://screenpi.pe/enterprise) (members, devices, scheduled tasks, policy, builds) * Questions or stuck: [support@screenpi.pe](mailto:support@screenpi.pe) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.