Intune Windows Runbook

Use this runbook to deploy thoth.exe and thothctl.exe to Windows endpoints through Intune.

1. Prerequisites

Confirm:

• Intune admin permissions for app assignments.
• test and pilot device groups are prepared.
• release artifacts are downloaded from approved release tag.
• onboarding values are prepared (tenant_id, apex_domain).

Required artifacts:

• Thoth-x64.msi
• SHA256SUMS
• Intune-Deployment-Kit.zip

2. Validate release integrity

Before upload, validate:

Get-FileHash .\Thoth-x64.msi -Algorithm SHA256

Compare against SHA256SUMS entry for Thoth-x64.msi.

3. Create Intune Win32 app

In Intune Admin Center:

1. Package Thoth-x64.msi as Win32 app content (or use native line-of-business MSI flow if preferred by policy).
2. Configure install command:

msiexec /i Thoth-x64.msi /qn /norestart ALLUSERS=1

3. Configure uninstall command:

msiexec /x {PRODUCT-CODE} /qn /norestart

4. Configure behavior:

• install context: device
• restart behavior: suppress (/norestart)

4. Configure detection rules

Recommended detection script: detect-thoth.ps1 from Intune-Deployment-Kit.zip.

Expected detection path:

• C:\Program Files\Aten Security\Thoth\thoth.exe
• C:\Program Files\Aten Security\Thoth\thothctl.exe

5. Assign deployment rings

Deploy in order:

1. Test ring (1-5 devices)
2. Pilot ring (5-15% of managed Windows fleet)
3. Production ring

Use required assignments for managed corporate devices.

6. Post-install validation

On pilot endpoint:

thoth --version
thothctl --version
thoth health --json
thoth status

Validate config placement:

Test-Path "C:\ProgramData\Thoth\thoth-config.json"

7. Upgrade strategy

For each new release:

1. upload new MSI package
2. keep assignments ring-based
3. validate test and pilot rings before global rollout

MSI major-upgrade behavior handles in-place upgrade for existing installations.

8. Rollback strategy

If regression occurs:

1. pause new assignments
2. reassign previous known-good MSI package
3. execute uninstall/install remediation where required

Use phased rollback by assignment ring.

9. Troubleshooting

Related docs

• Windows Enterprise Release Platform
• Deployment Validation Matrix
• Release Channels + Verification