Keeping your Intune base applications Evergreen

Hello there (Obi-Wan voice), keeping your Intune base applications up to date can be a challenge, today I want to show you how you keep your base applications up to date without 3^rd party toolsets so when delivered to endpoints the latest versions are always installed to your end-users, thus ensuring that users are productive and that your endpoints are secure from any 3rd party vulnerabilities from the bat. We’ll use a combination of the Evergreen PowerShell module created by Aaron Parker and the PowerShell App Deployment Toolkit (PSADT).

It is important to note that there are products that can integrate into Intune that not only keep your base applications up to date, but also keep those same applications up to date on existing endpoints via patching, for example, a couple of these solutions are PatchMyPC and Scappman, both fantastic products. This article will only detail how you can keep base applications up to date for up to date software installations, it does not cover updating existing endpoint software versions.

Introducing the Evergreen PowerShell Module

The Evergreen PowerShell module keeps various vendor download URL’s up to date, for which we can utilise to download the very latest software binaries directly from vendor’s repositories, this means that there is no need to keep a private or community repository of installers, which can be a pain to manage at times. The module can be used for Azure Virtual Desktop, Configuration Manager, Intune, etc. In this case, we’ll utilise Intune via the Win32 app process to query Evergreen for various software URL’s, download the software and then trigger an installation based on that freshly downloaded software, hence keeping your base applications up to date at the time of deployment. Make sure you check out the various documentation on their website for more information.

Getting Started with Evergreen

Now that you know that Evergreen is, let’s install their PowerShell module, view some of the available software URLs, tailor these URL criteria and then finally download \ install the software in question.

Installing the Evergreen Module

On a device used to author and test software packages, open PowerShell (as administrator), type in the following to install and import the Evergreen module:

Install-Module -Name Evergreen
Import-Module -Name Evergreen

More info on installing the Evergreen module can be found here.

Viewing available Evergreen packages

Now that the Evergreen module has been installed and imported, run Find-EvergreenApp, this will return a list of supported applications for which we can use to download the installers:

Here’s a full list of supported apps at the time of writing:

Name	Application
1Password	1Password
7zip	7zip
7ZipZS	7-Zip ZS
AdobeAcrobat	Adobe Acrobat
AdobeAcrobatReaderDC	Adobe Acrobat Reader DC
AdobeBrackets	Adobe Brackets
AdoptiumTemurin11	Adoptium Temurin 11
AdoptiumTemurin16	Adoptium Temurin 16
AdoptiumTemurin17	Adoptium Temurin 17
AdoptiumTemurin8	Adoptium Temurin 8
AdoptOpenJDK11	AdoptOpenJDK OpenJDK Official Binaries (JDK 11u)
AdoptOpenJDK16	AdoptOpenJDK OpenJDK Official Binaries (JDK 16u)
AdoptOpenJDK8	AdoptOpenJDK OpenJDK Official Binaries (JDK 8u)
AkeoRufus	Akeo Rufus
AmazonCorretto	Amazon Corretto
Anaconda	Anaconda
Anki	Anki
ArtifexGhostscript	Artifex Ghostscript
AtlassianSourcetree	Atlassian Sourcetree
Audacity	Audacity
BeekeeperStudio	Beekeeper Studio
BISF	Base Image Script Framework
BitwardenDesktop	Bitwarden Desktop
BlenderLauncher	Blender Launcher
BlueJ	BlueJ
CendioThinLinc	Cendio ThinLinc
CitrixAppLayeringFeed	Citrix Product Release Feeds
CitrixApplicationDeliveryManagementFeed	Citrix Product Release Feeds
CitrixEndpointManagementFeed	Citrix Product Release Feeds
CitrixGatewayFeed	Citrix Product Release Feeds
CitrixHypervisorFeed	Citrix Product Release Feeds
CitrixLicensingFeed	Citrix Product Release Feeds
CitrixReceiverFeed	Citrix Product Release Feeds
CitrixSdwanFeed	Citrix Product Release Feeds
CitrixVirtualAppsDesktopsFeed	Citrix Product Release Feeds
CitrixVMTools	Citrix VM Tools
CitrixWorkspaceApp	Citrix Workspace app
CitrixWorkspaceAppFeed	Citrix Product Release Feeds
ControlUpAgent	ControlUp Agent
ControlUpConsole	ControlUp Console
Cyberduck	iterate GmbH Cyberduck
dbeaver	dbeaver
DebaucheeBarrier	Debauchee Barrier
deviceTRUST	deviceTRUST
DevToys	DevToys
diagrams.net	diagrams.net
dnGrep	dnGrep
FileZilla	FileZilla
Fork	Dan Pristupov Fork
FoxitPDFEditor	Foxit PDF Editor
FoxitReader	Foxit Reader
FreedomScientificFusion	Freedom Scientific Fusion
FreedomScientificJAWS	Freedom Scientific JAWS
FreedomScientificZoomText	Freedom Scientific ZoomText
FreeFem	FreeFem
GeekSoftwarePDF24Creator	Geek Software PDF24 Creator
Gephi	Gephi
GhislerTotalCommander	Ghisler TotalCommander
Gimp	GIMP
GitForWindows	Git for Windows
GitHubAtom	GitHub Atom
GitHubRelease	GitHub release
GoogleChrome	Google Chrome
Greenshot	Greenshot
gretl	gretl
Handbrake	Handbrake
HashicorpBoundary	Hashicorp Boundary
HashicorpConsul	Hashicorp Consul
HashicorpNomad	Hashicorp Nomad
HashicorpPacker	Hashicorp Packer
HashicorpTerraform	Hashicorp Terraform
HashicorpVault	Hashicorp Vault
HashicorpWaypoint	Hashicorp Waypoint
ImageGlass	ImageGlass
ImageMagickStudioImageMagick	ImageMagick Studio ImageMagick
JamTreeSizeFree	JAM Software TreeSize Free
JamTreeSizeProfessional	JAM Software TreeSize Professional
JASP	JASP
JetBrainsIntelliJIDEA	JetBrains IntelliJ IDEA
JetBrainsPyCharm	JetBrains PyCharm
jq	jq
jrsoftwareInnoSetup	jrsoftware InnoSetup
KarakunOpenWebStart	Karakun OpenWebStart
KeePass	KeePass
KeePassXCTeamKeePassXC	KeePassXC Team KeePassXC
LogMeInGoToMeeting	LogMeIn GoToMeeting
LogMeInGoToOpener	LogMeIn GoToOpener
MasterPackager	Master Packager
MattermostDesktop	Mattermost Desktop
McNeelRhino	McNeel Rhino
MendeleyDesktop	Mendeley Desktop
MestrelabMnova	Mestrelab Mnova
Microsoft.NET	Microsoft .NET Desktop Runtime
Microsoft365Apps	Microsoft 365 Apps
MicrosoftAzureDataStudio	Microsoft Azure Data Studio
MicrosoftAzureFunctionsCoreTools	Azure Functions Core Tools
MicrosoftAzureStorageExplorer	Microsoft Azure Storage Explorer
MicrosoftBicep	Microsoft Bicep
MicrosoftBotFrameworkEmulator	Microsoft Bot Framework Emulator
MicrosoftEdge	Microsoft Edge
MicrosoftEdgeDriver	Microsoft Edge
MicrosoftEdgeWebView2Runtime	Microsoft Edge WebView2 Runtime
MicrosoftFSLogixApps	Microsoft FSLogix Apps
MicrosoftOneDrive	Microsoft OneDrive
MicrosoftPowerShell	Microsoft PowerShell
MicrosoftPowerToys	Microsoft PowerToys
MicrosoftSsms	Microsoft SQL Server Management Studio
MicrosoftTeams	Microsoft Teams
MicrosoftVisualStudio	Microsoft Visual Studio
MicrosoftVisualStudioCode	Microsoft Visual Studio Code
MicrosoftWindowsPackageManagerClient	Microsoft Windows Package Manager Client
MicrosoftWvdBootloader	Microsoft Azure Virtual Desktop Agent Bootloader
MicrosoftWvdInfraAgent	Microsoft Azure Virtual Desktop Agent
MicrosoftWvdMultimediaRedirection	Microsoft Azure Virtual Desktop Multimedia Redirection Extensions
MicrosoftWvdRemoteDesktop	Microsoft Remote Desktop
MicrosoftWvdRtcService	Microsoft Remote Desktop WebRTC Redirector Service
Miniconda	Miniconda
Minitab	Minitab
MiniZincIDE	MiniZinc IDE
MirantisLens	MirantisLens
MozillaFirefox	Mozilla Firefox
MozillaThunderbird	Mozilla Firefox
mRemoteNG	mRemoteNG
MuseScore	MuseScore
Naps2	Ben Olden-Cooligan NAPS2
NETworkManager	NETworkManager
NevcairielLAVFilters	Nevcairiel LAV Filters
Nomacs	nomacs Image Lounge
Notable	Notable
NotepadPlusPlus	Notepad++
OBSStudio	OBS Studio
OctopusDeployServer	Octopus Deploy Server
OctopusTentacle	Octopus Tentacle
OpenJDK	OpenJDK
OpenShellMenu	Open-Shell-Menu
OpenWebStart	OpenWebStart
OperaBrowser	Opera Browser
OperaGXBrowser	Opera GX Browser
OracleJava8	Oracle Java 8
OracleVirtualBox	Oracle VirtualBox
PaintDotNet	dotPDN LLC Paint.NET
PaintDotNetOfflineInstaller	dotPDN LLC Paint.NET
Pandoc	Pandoc
PDFForgePDFCreator	pdfforge PDFCreator
PeaZipPeaZip	PeaZip PeaZip
Postman	Postman
Praat	Praat
ProjectLibre	ProjectLibre
Protege	Protege
PSAppDeployToolkit	PSAppDeployToolkit
PSFPython	PSF Python
PuTTY	PuTTY
RCoreTeamRforWindows	R Core Team R for Windows
RDAnalyzer	Remote Desktop Analyzer
RingCentral	RingCentral
RStudio	RStudio
SafeExamBrowser	Safe Exam Browser
SAGAGIS	SAGA-GIS
ScooterBeyondCompare	Scooter Beyond Compare
Scratch	Scratch
ShareX	ShareX
SignalDesktop	Signal for Windows
Slack	Slack
SmartBearSoapUI	SmartBear SoapUI
StefansToolsgregpWin	Stefans Tools gregpWin
SumatraPDFReader	Sumatra PDF Reader
TableauDesktop	Tableau Desktop
TableauPrep	Tableau Prep
TableauReader	Tableau Reader
TeamViewer	TeamViewer
TechSmithCamtasia	TechSmith Camtasia
TechSmithSnagIt	TechSmith SnagIt
TelegramDesktop	Telegram Desktop
TelerikFiddlerClassic	Telerik Fiddler Classic
TelerikFiddlerEverywhere	Telerik Fiddler Everywhere
Terminals	Terminals
TeXstudio	TeXstudio
TogglDesktop	Toggl Desktop
TorProjectTorBrowser	Tor Project Tor Browser
USBPcap	USBPcap
VastLimitsUberAgent	vast limits uberAgent
VeraCrypt	VeraCrypt
VercelHyper	Vercel Hyper
VideoLanVlcPlayer	VideoLan VLC Player
VisualCppRedistAIO	VisualCppRedistAIO
VMwareHorizonClient	VMware Horizon Client
VMwareTools	VMware Tools
voidtoolsEverything	voidtools Everything
Win32OpenSSH	Win32-OpenSSH
WinMerge	WinMerge
WinSCP	WinSCP
Wireshark	Wireshark
WixToolset	WiX Toolset
Zoom	Zoom
Zotero	Zotero

Note: You can use Find-EvergreenApp | Select-Object Name, application | Export-CSV -path C:\Evergreenapps.csv command to reproduce the above list.

Downloading the Software

Now that we know which applications are supported, let’s query these applications further to see what download options we have using the Get-EvergreenApp command, I’ll use Adobe Reader DC as an example, so based on the above list, you’ll need to gather the name of the application, which in this case is AdobeAcrobatReaderDC, add this into your Get-EvergreenApp command and you’ll see all of the options such as language, architecture, etc. Here’s the command to query Adobe Reader DC Get-EvergreenApp -Name AdobeAcrobatReaderDC, which returns various results, like so:

Some of the options change based on the software being queried, here’s Mozilla FireFox as an example:

As you can see we have new options for the software channel, file types (MSI, EXE, etc). Let’s stick to our AdobeReaderDC example, based on the results, I can see that a download URL that is relevant to the English (UK) language and architecture of x64, which is what I’m after, so let’s now be more specific with our query of Get-EvergreenApp -Name AdobeAcrobatReaderDC | Where-Object { $_.Architecture -eq “x64” -and $_.Language -eq “English (UK)”}:

The goal is to get to one URL to be listed, which we’ll use to download and install, thus keeping us Evergreen.

Downloading and Installing the software

Now that we have our URL returning what we want to install, let’s put it all together into a fairly simple script, this script will be used later in our PSADT package and then uploaded into Intune for wide distribution, the below script installs the Evergreen module, downloads the Adobe Reader DC UK English x64 edition, triggers the installation process and then finally deletes the installer:

## Installs latest version of Adobe Reader DC via Evergreen PowerShell module
# Trust PowerShell Gallery
If (Get-PSRepository | Where-Object { $_.Name -eq "PSGallery" -and $_.InstallationPolicy -ne "Trusted" }) {
    Install-PackageProvider -Name "NuGet" -MinimumVersion 2.8.5.208 -Force
    Set-PSRepository -Name "PSGallery" -InstallationPolicy "Trusted"
}
#Install or update Evergreen module
$Installed = Get-Module -Name "Evergreen" -ListAvailable | `
    Sort-Object -Property @{ Expression = { [System.Version]$_.Version }; Descending = $true } | `
    Select-Object -First 1
$Published = Find-Module -Name "Evergreen"
If ($Null -eq $Installed) {
    Install-Module -Name "Evergreen"
}
ElseIf ([System.Version]$Published.Version -gt [System.Version]$Installed.Version) {
    Update-Module -Name "Evergreen"
}
# Download Latest version of Adobe Reader DC via Evergreen
$AdobeReaderDC = Get-EvergreenApp -Name AdobeAcrobatReaderDC | Where-Object { $_.Architecture -eq "x64" -and $_.Language -eq "English (UK)"}
$AdobeReaderDCInstaller = $AdobeReaderDC | Save-EvergreenApp -Path "C:\Temp\AdobeReaderDC"
# Install Adobe Reader DC
Start-Process -FilePath "$AdobeReaderDCInstaller" -args "/sAll /msi /norestart /quiet ALLUSERS=1 EULA_ACCEPT=YES" -Wait -Verbose
# Cleanup temp directory
$AdobeReaderDCInstaller | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue

Make sure you test this on a device and verify your results. That’s it, that’s the beauty of the Evergreen module, simple, effective and if you open up the Adobe Reader DC application, you’ll see that you’re all up to date, as the software is coming directly from the vendor:

Let’s move into wrapping this up into a PSADT package.

PowerShell App Deployment Toolkit

I won’t go into how to source and package up PSADT step by step as such, but I do have some examples on my Github page, which includes the Adobe Reader DC Evergreen package, anything with Evergreen in the title is using the Evergreen download URLs as discussed previously. I’ll go over briefly what’s in my Adobe Reader DC Evergreen PSADT package on Github, so you can easily replicate this for your own packages, first download the items from my Github page, unzip, find the directory of AdobeReaderDC_Evergreen_PSADT and copy it to a safe location, the directory should look like so:

The installation script that I referenced earlier is located in the Files folder, then in the Deploy-Application-ps1 file is where the magic happens, open this up and I’ll briefly describe the important lines of code which differ from the default script contents.

Lines 64-72 detail metadata information about the actual software package:

Line 120, shows a message to the end-user asking them to close AdobeReaderDC if they already have it open with a count down of 10 minutes: Show-InstallationWelcome -CloseApps ‘Acrobat’ -CheckDiskSpace -PersistPrompt -CloseAppsCountdown 600:

Lines 139-141 this is the actual installation command, as you can see if it referencing a PowerShell script within the Files folder, which is the exact same installation script you saw earlier:

## <Perform Installation tasks here>

[string]$MyArguments = “-ExecutionPolicy Bypass -NoLogo -File `”$dirFiles\InstallAdobeReaderDC.ps1`” “

Execute-Process -Path “$PSHOME\powershell.exe” -Arguments $MyArguments

Line 149: Deletes the C:\temp directory to ensure all is clean from the installer:  Remove-Folder -Path “$env:SYSTEMDRIVE\temp” -ErrorAction SilentlyContinue

Line 150: Deletes the default Adobe Reader DC shortcut from the public desktop: Remove-File -Path “$envCommonDesktop\Adobe Acrobat DC.lnk” -ErrorAction SilentlyContinue

Line 163: Uninstallation prompt to close AdobeReader if running: Show-InstallationWelcome -CloseApps ‘Acrobat’ -CloseAppsCountdown 600

Line 191: Performs the uninstallation of AdobeReaderDC: Remove-MSIApplications -Name ‘Adobe Acrobat DC’

Also, within the AppDeployToolkit\AppDeployToolkit.xml, I’ve made three changes to the defaults, which I’ll go over.

Lines 23 and 59: I’ve updated the log path so it goes to the IntuneManagementExtention\Log path, this is particularly handy when capturing diagnostics from an Intune console action, this ensures that PSDAT installation logs are also captured:

<Toolkit_LogPath>$envProgramData\Microsoft\IntuneManagementExtension\Logs</Toolkit_LogPath>

<MSI_LogPath>$envProgramData\Microsoft\IntuneManagementExtension\Logs</MSI_LogPath>

Line 92: I’ve turned off balloon notifications as Intune produces it’s own:  <ShowBalloonNotifications>False</ShowBalloonNotifications>

That’s it, that’s all the PSADT configuration, to test the installation via the PSADT framework, run the following commands on your test device:

Install: Deploy-Application.exe -DeploymentType install

Uninstall: Deploy-Application.exe -DeploymentType Uninstall

Ensure all is well before proceeding with the example I’ve shown or with your own package, finally, wrap the entire contents of the directory including the serviceui.exe file into an .Intunewin file (I won’t demonstrate how to do this as I’m sure you’re familiar with the win32 wrapping process).

Creating the Intune application

Now that you have your PSADT package, based on downloading installers via Evergreen and triggering an install to make sure you always have the latest version of the software, we need to upload the .intunewin packaged in the previous section into Intune and create our application, let’s get started.

Log into MEMAC Admin centre, go to Windows > Apps, Add:

A new wizard will appear, select Win32 and then select the .Intunewin packaged previously, a new window will then appear asking for metadata, file it out to suit your needs, here’s mine:

Now onto the installation commands, they’re slightly different from our lab environment due to the utilisation of ServiceUI.exe, the reason we use serviceui.exe is to ensure prompts are produced to end-users even though the installation process is triggered using the system account, serviceui.exe is part of the Microsoft Deployment Toolkit, it is widely used as a junction between the processes running as NT Authority\System and end user sessions either to display a message or accept input from an end user whereas they wouldn’t normally be visible whilst keeping the original process in the system context, this comes in handy when end-users do not have local administrator rights but input is required when installing applications for example or this in case, display a message about running processes and then install an application in system context. The installation and uninstallation commands are as follows:

Install: .\ServiceUI.exe -Process:explorer.exe Deploy-Application.exe -DeploymentType install

Uninstall: .\ServiceUI.exe -Process:explorer.exe Deploy-Application.exe -DeploymentType uninstall

Note: I also included the commands into the cmds.txt within my GitHub repo examples too.

Requirements:

Detection methods, I tend to use a script to detect the presence of the application when using Evergreen, I don’t do any version control either for obvious reasons, this detection method will scan both the 64-bit and 32-bit registry app installation locations for a display name LIKE Adobe Reader DC, here’s the script, make sure this returns correct results on your test device before proceeding (e.g. If Adobe Reader DC is installed then the script should display “Installed”, if NOT installed, the script should display nothing):

$DisplayName = "Adobe Acrobat DC*"
$check = $false
Get-ChildItem -Path HKLM:\software\microsoft\windows\currentversion\uninstall -Recurse -ErrorAction SilentlyContinue | % {if ((Get-ItemProperty -Path $_.pspath).DisplayName -like $DisplayName) {$check = $true}}
Get-ChildItem -Path HKLM:\software\wow6432node\microsoft\windows\currentversion\uninstall -Recurse -ErrorAction SilentlyContinue | % {if ((Get-ItemProperty -Path $_.pspath).DisplayName -like $DisplayName) {$check = $true}}
if ($check) {Write-Host "Installed"}
else {}

Note: I also included the script within my GitHub repo examples too. In this example, the script was called AdobeReaderDC_DetectionScript.ps1

That’s it, attempt to run the installation against a test device via Intune first to ensure all is well.

Note: Be aware that that the download of data via this method is direct to various vendor websites, as a consequence delivery optimisation (DO) will not save you bandwidth in this scenario.

Examples and Conclusion

Don’t forget that working examples are available on my GitHub page, you can simply package any directory with Evergreen in the title to a .Intunewin file and upload it into Intune ASIS, I’ve also included the detection method scripts and installation \ uninstallation commands in each directory.

This is quite a blog post, but I hope you can see how easy it is to keep your base applications up to date using a combination of Evergreen and PSADT, if you have any questions or have something to share, please leave me a comment, or reach out to me on Twitter.