Skip to main content

AQUILA EDR Mass Deployment Via Microsoft Intune

Deploying Endpoint Detection & Response (EDR) via Microsoft Intune

Overview

This guide explains how to install an Endpoint Detection & Response (EDR) solution on all devices managed through Microsoft Intune. The process ensures consistent protection across your organization’s endpoints by using Intune’s Endpoint security policies and app deployment features.

Prerequisites

Before beginning, confirm the following:

  • You have Global Administrator or Intune Administrator rights in Microsoft 365.

  • Devices are already enrolled and compliant in Microsoft Intune.

  • You have the installer package ( IntuneWin format) for your chosen EDR solution.

Step 1: Prepare the EDR Installer

  1. Obtain the official EDR installation package (MSI) from AQUILA

  2. If the installer is not in .intunewin format, convert it using the Microsoft Win32 Content Prep Tool.

Download tool: GitHub - microsoft/Microsoft-Win32-Content-Prep-Tool: A tool to wrap Win32 App and then it can be uploaded to Intune

Steps for preparing an Installer for Intune (.intunewin format)
Download the Packaging Tool

      1. Go to Microsoft’s official download page: Win32 Content Prep Tool (GitHub)

      2. Download the ZIP file to your computer.

        Screenshot 2025-08-22 071813.png

      3. Right-click the ZIP → Extract All…

        image.png

      4. Choose a location (for example: C:\IntuneWinAppUtil).

        image.png

Prepare Your Installer Files

      1. Create a folder for your installer, for example:

        • C:\2. Source\EDR

      2. Place your EDR installer inside that folder. Place also here the script files.

        • Aquila Agent(Namespace).msi
        • Master-Installer.ps1
        • Install-ElasticAgent_(Namespace)-Force.ps1

        image.png



         

      3. Create another empty folder where the packaged file will be saved, for example:

        • C:\3. Output

Run the Packaging Tool

      1. Go to the folder where you extracted the tool and run it

        image.png
      2. The tool will ask you a few questions. Enter the following:

        • Source folder: type the path to your installer folder (e.g., C:\Source\EDR).

        • Setup file: type the name of the Master-Installer (e.g., Master-Installer.msi).

        • Output folder: type the path to your empty folder (e.g., C:\Output).

        • Catalog folder: just press Enter to skip.

          image.png


Check the Result

      • Open your output folder (C:\Output).

      • You should now see a file ending in .intunewin, for example:

      • This is the file you’ll upload into Microsoft Intune.
    •  

      image.png

Step 2: Add the EDR App to Intune

Sign in to the Microsoft Intune admin center → https://intune.microsoft.com

  • Go to Apps.

image.png

  • Windows App

image.png

  • Add

image.png

  1. Select the app type:

    • Windows app (Win32) for most EDR installers.

      image.png

  2. Upload the prepared installer package. 

    • Find and upload the .intune file on the Output folder from earlier.

    image.png

  3. Configure App Information: name, description, publisher.

    image.png

  4. Set Program Install/Uninstall Commands.image.png

    • Install Command:

      • powershell.exe -ExecutionPolicy Bypass -File .\Master-Installer.ps1}

    • Uninstall command:
      • Get the Product Code of Aquila Agent by running this command on PowerShell.
      • $msiPath = "C:\Path\To\Aquila Agent.msi" (Paste here the File Path of the Aquila Agent MSI)
        $installer = New-Object -ComObject WindowsInstaller.Installer
        $database = $installer.OpenDatabase($msiPath, 0)
        $view = $database.OpenView("SELECT Value FROM Property WHERE Property='ProductCode'")
        $view.Execute()
        $record = $view.Fetch()
        $record.StringData(1)image.png
      • For Example, this is now your Uninstall Command:
      • msiexec /x {49F416F0-D969-4B1F-B501-DC67A39FE035} /quiet /norestart

  5. Under Requirements, select OS architecture and minimum version.

    image.png

  6. Add Detection Rules to confirm successful installation. image.png

    image.png

     

     

    Option A: MSI Product Code (recommended if you know it)

    • Rule type: MSI

    • MSI product code: {Aquila Agent Product code} (Please refer to 4. on how to get the Aquila Agent Product Code:)

    Option B: File exists

    • Rule type: File

    • Path: C:\Program Files\Aquila Agent

    • File or folder: Aquila Agent.exe

    • Detection method: File or folder exists

    Option C: Registry key

    • Rule type: Registry

    • Path: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\"{Aquila Product Code}"

      • This is how to get the Aquila Product Code. For Example: {49F416F0-D969-4B1F-B[91-DC67A39FE035}.
      • This is now the path to input: "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\"{49F416F0-D969-4B1F-B[91-DC67A39FE035}" image.png

    • Value: DisplayName → check exists or equals “Aquila Agent”


     

     

  7. Set Dependencies

    image.png

  8. Supersedence

    image.png

  9. Assignments

    • Required

      • Intune automatically installs the app on targeted devices.

      • Perfect for your Elastic/Aquila Agent deployment.

    • Available for enrolled devices

      • Users can see the app in Company Portal and install it manually.

      • Good for optional apps or testing.

    • Uninstall

      • Used if you want to remove the app from certain groups.

     

    image.png
  10. Review + Create

    image.png

Step 3: Monitor Deployment

  1. In the Intune admin center, go to Apps → select your EDR app.

  2. Check Device install status to confirm successful installations.

    image.png

  If you need further assistance, kindly contact our technical support at support@cytechint.com for prompt assistance and guidance.

No Comments
Back to top