What Intune Detection Rule Generator helps you do
The Haivix Intune Detection Workbench is where you go when a Win32 app needs to be understood, validated, fixed, or reviewed. Analyze an installer, capture before/after install evidence, test a rule on a device, troubleshoot 0x87D1041C, and audit Graph JSON — with explainable recommendations. MSI packages are analyzed in the browser; EXE packages use a local EXE analyzer plus optional PowerShell collectors. Everything stays on your device unless you choose a read-only Microsoft sign-in for tenant Detection Health.
Check the tool page and Privacy Policy for how this workflow handles your input.
How to use Intune Detection Rule Generator
- Upload an MSI or EXE for browser-local analysis. For EXE installed-state evidence (ranked ARP Identity), run the optional local PowerShell analyzer after install and import haivix-analysis.json.
- Review the recommended strategy (MSI ProductCode, ARP Identity, registry, or file), Observed/Declared/Inferred evidence, heuristic confidence, and Intune Ready score.
- Export portal settings, an ARP Identity custom detection script, PowerShell, or Graph v1.0/Beta JSON, then verify with the test collector on a representative device.
What you can do with Intune Detection Rule Generator
- Analyze an installer, troubleshoot a detection failure, or audit an existing Graph rule from three workbench entry cards.
- Analyze MSI installers locally and extract ProductCode, UpgradeCode, version, publisher, and architecture — including predicted (declared) ARP identity.
- Capture Before/After install snapshots (ARP, Program Files, services, tasks) and rank observed detection markers.
- Diagnose 0x87D1041C (and related Win32 HRESULTs) from a built-in code picker with ranked hypotheses (32/64-bit view, HKCU vs System, exact version, AND logic, script STDOUT).
- Rank detection strategies including ARP Identity with What we found / Why / Why not / What could change this.
- Test detection with a first-class PASS/FAIL workflow and scenario matrix after importing collector JSON.
- Remember recent apps in a local IndexedDB workspace and compare a newer installer to the previous rule.
- Show Detection reliability and “what could break this rule?” scenarios after generate or audit.
- Audit existing Graph detection JSON, compare v1.0 and Beta under Audit, or optionally scan tenant apps (sample or read-only Microsoft sign-in).
- Export portal steps, defensive PowerShell, ARP Identity scripts, Graph v1.0 or Beta JSON, plus a read-only detection test collector.
Example: understand, recommend, test, then fix
Open Analyze an Installer (or import Before/After snapshots after a clean install). Review the recommended strategy, provenance, Intune Ready score, Detection reliability, and linter.
Generate artifacts, run the test collector, then import haivix-detection-test.json for PASS/FAIL evidence. If Intune reports 0x87D1041C later, open Troubleshoot a Failure, pick the code (optional Graph JSON pins the cause), instead of starting from scratch.
What to know before you start
- Recommendation confidence is a Haivix heuristic for packaging guidance — it is not a statistical prediction that the rule will succeed in every tenant.
- Predicted ARP from installer metadata is declared evidence, not proof the app is installed — verify with the local analyzer after a clean install.
- UpgradeCode influences ARP ranking and explanations only; Haivix does not invent an Intune UpgradeCode detection rule type. MSI ProductCode stays preferred when stable.
- PE-only EXE scans do not invent Program Files detection paths or ARP Identity rules from product name alone; import haivix-analysis.json after install or enter markers manually.
- Likely silent switches must be tested on a representative device; Unknown means Haivix will not guess a command.
- Compare v1.0 and Beta (under Audit) normalizes both pastes to HaivixDetectionRule before diffing — raw JSON shape noise is listed under Shape notes, not as failures.
- All manually configured detection rules are combined with AND logic in Intune, so every rule must match for the app to be detected. ARP Identity uses a single custom detection script instead.
- A custom detection script must exit 0 and write to STDOUT; any STDERR output makes the result not installed.
- HKCU and user-profile markers are unreliable for system-context apps because the Intune Management Extension evaluates them outside the interactive user's profile.
- Self-updating applications can outgrow an exact version rule; the recommendation engine prefers greater-than-or-equal when self-update risk is elevated.
- This workbench is detection guidance — not packaging, .intunewin, or deployment-lifecycle automation.
Detection guide
ARP Identity for Intune Win32 detection
Observed vs declared evidence, UpgradeCode ranking, and custom detection script export — without packaging lifecycle scope.
Frequently Asked Questions
The workbench supports MSI product code, file or folder, registry DisplayVersion, and ARP Identity (DisplayName + optional Publisher + version via a custom detection script). It can compare versions, strings, integers, or file size where the selected rule type supports it.
ARP Identity matches Add/Remove Programs fields (DisplayName, and optionally Publisher and DisplayVersion) across uninstall registry hives instead of requiring one fixed uninstall subkey. Haivix can recommend it from declared MSI identity (predicted until verified) or from observed uninstall entries after local installed-state analysis, then export an Intune custom detection script. Predicted ARP from MSI metadata is declared evidence until you verify it with the local analyzer. When multiple uninstall entries compete, Haivix ranks candidates (including ProductCode key and UpgradeCode family boosts), warns on close scores, and lets you select a runner-up. UpgradeCode is for ranking and explanation only — not a separate Intune detection rule type.
Observed means Haivix found the marker on an installed Windows machine (local analyzer or Before/After snapshot). Declared means the value came from installer metadata such as the MSI Property table. Inferred means a Haivix heuristic. Recommendation confidence stays a packaging heuristic — provenance explains where each conclusion came from.
v1.0 (default, recommended) exports win32LobApp*Rule objects for the rules collection. Beta Preview exports win32LobApp*Detection objects for detectionRules. Haivix uses separate serializers — not just a different endpoint.
Yes. Open Audit a Detection Rule, paste Graph JSON from an exported win32LobApp rule or detectionRules entry, and Haivix scores Detection Health with a visible Detection Rule Linter. Compare v1.0 and Beta is a second control on the same card. Scan tenant apps (optional) can preview sample apps or connect Microsoft read-only. No installer upload is required.
Open Troubleshoot a Failure and pick the HRESULT from the built-in Win32 list (0x87D1041C is selected by default), or paste hex/decimal. Optional Graph JSON, detection script, or IME log pins the cause. Haivix ranks likely mismatches such as 32-bit registry view, HKCU with System context, exact version, AND logic, and script STDOUT/STDERR — then offers a test command and recommended fix. Non-detection codes open the Win32 App Troubleshooter.
A read-only PowerShell snapshot captures ARP, Program Files, services, and tasks before and after you install the app. Haivix diffs the two files locally and ranks observed detection markers. Nothing is uploaded.
After Generate, download the read-only PowerShell collector, run it on a test PC to write haivix-detection-test.json, then import that JSON to simulate PASS/FAIL and a scenario matrix locally. Nothing is uploaded.
No. MSI analysis, EXE light scans, snapshots, validation, audit pastes, and generation run in your browser. Optional Microsoft sign-in for a read-only tenant Detection Health scan uses DeviceManagementApps.Read.All; tokens stay in the tab.
Drop an .msi file and Haivix reads ProductCode, UpgradeCode, version, publisher, and architecture from the package in the browser, then ranks detection strategies with an explainable heuristic confidence score and Intune Ready checklist.
Open Audit a Detection Rule, choose Compare v1.0 and Beta, and paste two Graph detection payloads (v1.0 *Rule and/or Beta *Detection). Haivix normalizes both to the same internal model and reports Equivalent when only API shape differs — for example operationType vs detectionType. Real marker changes, added rules, or removed rules are called out separately. Pastes never leave your browser.
A reusable browser EXE analyzer identifies common bootstrapper engines (Inno Setup, NSIS, WiX Burn, InstallShield, Squirrel) with Confirmed/Likely/Unknown status, recommends curated silent install or uninstall switches only when Confirmed or Likely, and never invents Unknown commands. Detection markers still require ProductCode, ARP, or a real install path — Haivix will not invent Program Files paths from PE metadata alone.
It is a Haivix heuristic that scores packaging factors such as machine-wide identity, architecture, and self-update risk. It is not a measured probability that the rule will succeed in every environment. Always test on a representative device.
For a Win32 app custom detection script, Intune treats the app as detected only when the script exits with code 0 and writes data to standard output. Any STDERR output makes the result not installed. The workbench surfaces that contract and lints generated scripts.
No. Use the generated test collector or probe and paste-back validator, then still confirm installer and detection behavior in the same user or system context and architecture used by Intune.