# Intune Windows Runbook

> Deploy and operate thoth on managed Windows endpoints through Intune using signed MSI packages.

Source: https://docs.atensecurity.com/docs/deployments/intune-windows

Use this runbook to deploy `thoth.exe` and `thothctl.exe` to Windows endpoints through Intune.

**Recommended package source:**
  Use signed `Thoth-x64.msi` from an official `atensecurity/thoth` GitHub release tag.

## 1. Prerequisites

Confirm:

- Intune admin permissions for app assignments.
- test and pilot device groups are prepared.
- release artifacts are downloaded from approved release tag.
- onboarding values are prepared (`tenant_id`, `apex_domain`).

Required artifacts:

- `Thoth-x64.msi`
- `SHA256SUMS`
- `Intune-Deployment-Kit.zip`

## 2. Validate release integrity

Before upload, validate:

```powershell
Get-FileHash .\Thoth-x64.msi -Algorithm SHA256
```

Compare against `SHA256SUMS` entry for `Thoth-x64.msi`.

## 3. Create Intune Win32 app

In Intune Admin Center:

1. Package `Thoth-x64.msi` as Win32 app content (or use native line-of-business MSI flow if preferred by policy).
2. Configure install command:

```text
msiexec /i Thoth-x64.msi /qn /norestart ALLUSERS=1
```

3. Configure uninstall command:

```text
msiexec /x {PRODUCT-CODE} /qn /norestart
```

4. Configure behavior:

- install context: device
- restart behavior: suppress (`/norestart`)

## 4. Configure detection rules

Recommended detection script: `detect-thoth.ps1` from `Intune-Deployment-Kit.zip`.

Expected detection path:

- `C:\Program Files\Aten Security\Thoth\thoth.exe`
- `C:\Program Files\Aten Security\Thoth\thothctl.exe`

## 5. Assign deployment rings

Deploy in order:

1. Test ring (1-5 devices)
2. Pilot ring (5-15% of managed Windows fleet)
3. Production ring

Use required assignments for managed corporate devices.

## 6. Post-install validation

On pilot endpoint:

```powershell
thoth --version
thothctl --version
thoth health --json
thoth status
```

Validate config placement:

```powershell
Test-Path "C:\ProgramData\Thoth\thoth-config.json"
```

## 7. Upgrade strategy

For each new release:

1. upload new MSI package
2. keep assignments ring-based
3. validate test and pilot rings before global rollout

MSI major-upgrade behavior handles in-place upgrade for existing installations.

## 8. Rollback strategy

If regression occurs:

1. pause new assignments
2. reassign previous known-good MSI package
3. execute uninstall/install remediation where required

Use phased rollback by assignment ring.

## 9. Troubleshooting

| Symptom | Likely cause | What to check |
|---|---|---|
| App install fails | MSI command or context mismatch | confirm install command and device context |
| Detection fails | incorrect detection path/script | rerun `detect-thoth.ps1` locally |
| `thoth` not on PATH | endpoint environment not refreshed | restart shell/session and validate install path |
| Health check fails | onboarding config missing/invalid | validate `thoth-config.json` and endpoint egress |
| Upgrade not applied | assignment precedence or cached content | verify supersedence/assignment targeting in Intune |

## Related docs

- [Windows Enterprise Release Platform](https://docs.atensecurity.com/docs/deployments/windows-enterprise-release)
- [Deployment Validation Matrix](https://docs.atensecurity.com/docs/deployments/validation-matrix)
- [Release Channels + Verification](https://docs.atensecurity.com/docs/deployments/release-channels)