Windows Endpoints, Standalone MSI, And Intune

What Gets Deployed

A release is an immutable, signed triple built together and verified as a set: the MSI installer, the Intune .intunewin package wrapped around it, and a release manifest recording the exact product, agent, and protocol versions plus the package SHA-256.

Current 0.7.19 release files

The Downloads page and the generated Intune specification are authoritative. For the current release, verify these exact names and hashes before installing or uploading anything:

Run this from the folder containing the downloaded file:

Get-FileHash -Algorithm SHA256 .\VersionGopherEndpoint-0.7.19-windows-x64.msi
Get-FileHash -Algorithm SHA256 .\VersionGopherEndpoint-0.7.19-windows-x64.intunewin

Deploying Through Intune

Use the VersionGopher-generated deployment specification as the source of truth. It contains every value in Microsoft Intune screen order and marks each value as FIXED, GENERATED, TENANT SELECTION, LEAVE DEFAULT, LEAVE BLANK, or NOT APPLICABLE. Do not guess or retype generated commands, product codes, versions, or hashes.

1. Decide which VersionGopher group these machines belong in before you start. Every machine enrolled through one deployment lands in the same group, and Software Genomics measures drift within a group — so a deployment deserves its own group (for example Workstations - Finance) rather than a catch-all. You can create the group ahead of time under Admin → Projects / Groups → + New Group, or create it inline in the next step. Whoever creates the group becomes its owner and can add members later through group management.
2. In VersionGopher, open Admin → Fleet, select the organization, and choose Configure Intune deployment. Enter a deployment profile name and pick the endpoint group — the group choice is required, and the dropdown includes + Create a new group if the right one does not exist yet. Leave the machine-service URL set to https://endpoint.versiongopher.com/api/endpoint/v1 for the hosted service.
3. Set Bootstrap lifetime (hours) and Maximum new devices to the approved rollout window and device count. Confirm the initial scan scope and schedule, then choose Generate exact Intune settings. Protect the result: its install command contains the bounded bootstrap token.
4. Choose Download release .intunewin and Download deployment JSON. Verify the downloaded .intunewin SHA-256 against both the on-screen value and the JSON. The package is generic and tenant-neutral; organization, group, policy, and bootstrap values exist only in the generated deployment settings.
5. In the Microsoft Intune admin center, go to Apps → All apps → Create. Select platform Windows, app type Windows app (Win32), choose Select, and upload the exact downloaded .intunewin.
6. Complete App information by copying every generated field exactly. For 0.7.19 the name is VersionGopher Enterprise Endpoint 0.7.19, Publisher and Developer are AstroSec LLC, and Show this as a featured app is No. Leave Owner blank unless tenant policy requires it. Use the supplied information URL, privacy URL, notes, and logo.
7. Complete Program with the exact generated install and uninstall commands. Set Install behavior to System, Device restart behavior to Determine behavior based on return codes, installation time to 15 minutes, and Allow available uninstall to No. Use these return codes: 0=Success, 1707=Success, 3010=Soft reboot, 1641=Hard reboot, 1618=Retry, and 1603=Failed.
8. Complete Requirements: architecture 64-bit, minimum Windows version exactly as shown in the release specification, disk space 512 MB, and no additional requirement rules.
9. Complete Detection rules: choose Manually configure detection rules, add one MSI rule, paste the generated product code, enable the MSI product version check, set Operator to Equals, enter 0.7.19, and set Ignore app version to No.
10. Add no Dependencies. Under Supersedence, select the exact predecessor named by the generated specification and set Uninstall previous version to No; the MSI performs the supported in-place upgrade. Remove the predecessor's competing Required assignment from the same target group. Keep the tenant-default scope tag unless your Intune RBAC design requires another one.
11. Under Assignments, add Required for a dedicated Microsoft Entra device group containing only the intended pilot machines. Use no filter unless it has been reviewed, choose Hide all toast notifications, set availability and deadline to As soon as possible, and leave restart grace period at the Intune default. Do not initially assign All users or All devices.
12. On Review + create, confirm the exact package filename, SHA-256, app name, and Required pilot-device assignment, then choose Create. Wait for content publication to complete and verify that Intune shows the exact uploaded filename before syncing the pilot devices.
13. Confirm Intune reports Installed, the Windows service VersionGopherEndpoint is running as LocalSystem, and each device appears under the intended VersionGopher organization and group with an applied policy. After every intended machine has enrolled, revoke the deployment bootstrap in Admin → Fleet.

What the generated commands look like

Copy the actual commands from VersionGopher. These redacted examples show the required shape only; do not paste the placeholder:

msiexec.exe /i "VersionGopherEndpoint-0.7.19-windows-x64.msi" /qn /norestart VG_ENDPOINT_SERVER_URL="https://endpoint.versiongopher.com/api/endpoint/v1" VG_ENDPOINT_BOOTSTRAP="<BOOTSTRAP_TOKEN_FROM_FLEET>"
msiexec.exe /x {71D48FA2-DD8C-493A-B1A3-5DB5A056AC2D} /qn /norestart

Microsoft documents the same portal sequence in Add, assign, and monitor a Win32 app in Microsoft Intune.

Configure What The Windows Collector Scans

The same bounded scan profile is available in Admin → Fleet, in the Intune deployment builder, and in the elevated configuration tray installed by the standalone MSI. The safe defaults are populated for you: all local drives, scheduled scans enabled, metadata probes enabled, a 1,440-minute interval, 120 minutes of jitter, a 600-second startup delay, a 14,400-second runtime limit, and a 60-second upload retry.

The command preview is the actual argument order the service constructs. In Fleet it updates before deployment or policy save; in the tray it updates while the administrator changes scope, roots, metadata, or protected paths. The service owns the signed collector path, protected data directory, output prefix, and required -e -j -o arguments. Operators cannot inject arbitrary collector arguments or scripts. The displayed <run-id> placeholder is replaced by the service for each scan.

• Directory mode requires at least one target and supports at most 64 existing fixed-drive roots.
• UNC shares, device paths, wildcards, environment expansion, dot segments, and the VersionGopher data tree are rejected.
• Jitter must be shorter than the interval; startup delay and maximum runtime cannot exceed it.
• If a saved target becomes unavailable, scans are suppressed with scan_profile_unavailable while authenticated status check-ins continue, so an administrator can deliver a repaired policy.
• Saved deployment settings travel in the bounded bootstrap policy. Later all-or-selected changes show Pending until the endpoint reports the same revision as Applied.

Installing And Configuring Without Intune

A non-Intune administrator can install and configure the Windows service directly from the signed MSI and elevated tray. Editing files under C:\ProgramData is not required.

1. Decide which group these machines belong in first — enrolled machines land in the group tied to the bootstrap token, and drift is measured within that group. Create it ahead of time under Admin → Projects / Groups → + New Group, or inline from the group dropdown in the next step. The creator becomes the group owner and can add members later through group management.
2. In VersionGopher, open Admin → Fleet, choose the organization, and select Create MSI bootstrap token. Enter a profile name, pick the endpoint group (required — the dropdown includes + Create a new group), and use the hosted machine-service URL shown above. The default is one device for 24 hours; for an approved campaign, set the lifetime and maximum new devices to the actual rollout bounds. Confirm the initial scan policy and choose Create bootstrap token.
3. Copy the bootstrap immediately. VersionGopher stores only its digest and cannot display the secret again. Also copy the generated server URL and, if using Group Policy or RMM, the generated silent MSI command. Store all three only in an approved secret-management or deployment system.
4. Open Downloads, use the Signed MSI for non-Intune environments option, verify the exact 0.7.19 filename and SHA-256 listed above, and confirm the signer is AstroSec LLC. Stop if any check differs.
5. For an interactive install, sign in as a local administrator and run VersionGopherEndpoint-0.7.19-windows-x64.msi. Complete the installer normally. The configuration tray launches after a successful full-UI install; if it is closed, start VersionGopher Endpoint Configuration from the Start menu or tray shortcut.
6. Open Configure (Administrator). Keep Entire system, or choose Selected directories and enter one existing fixed-drive root per line.
7. Confirm the schedule and metadata choice, then read the Actual collector command. The tray blocks an empty directory profile, unavailable roots, unsafe paths, data-directory recursion, or timing values that cannot fit the interval.
8. Choose Save. The tray writes the base configuration atomically and asks the running service to reload it. For local-only collection, stop here and leave hosted enrollment disabled.
9. To connect the endpoint to hosted Fleet without Intune, use https://endpoint.versiongopher.com/api/endpoint/v1 and the copied vgb_ bootstrap token, then choose Enroll. Pasted tokens tolerate surrounding whitespace or matching quotes.
10. On enrollment success the managed server settings become read-only. Fleet desired policy can then supersede the local base scan profile. On failure the tray reports the reason and restores the previous state.

Silent MSI install for Group Policy or RMM

Place the verified MSI in the current directory and run the exact command generated by Create MSI bootstrap token from an elevated System or administrator context. Its redacted shape is:

msiexec.exe /i "VersionGopherEndpoint-0.7.19-windows-x64.msi" /qn /norestart VG_ENDPOINT_SERVER_URL="https://endpoint.versiongopher.com/api/endpoint/v1" VG_ENDPOINT_BOOTSTRAP="<BOOTSTRAP_TOKEN_FROM_FLEET>"

Do not type the angle-bracket placeholder. Paste the complete generated command, and protect the deployment job because the real command contains the bootstrap. A property-free silent MSI install only installs an unconfigured local service; it does not enroll the device in Fleet.

Verifying The Endpoint And Fleet

• On the device: the tray shows the managed server, the effective configuration, and a healthy service state. From an elevated PowerShell prompt, run the command below. Expected values are Running, Auto, and LocalSystem.
• After a policy or configuration change: confirm the service remains healthy and reports the new effective configuration. A rejected replacement must leave the prior trusted configuration in service rather than taking the endpoint offline.
• In the fleet view: the endpoint appears with its hostname, last-seen time, reported state, and most recent scan. A machine that has scanned and uploaded moves to a current state.
• In analytics: once two or more managed machines report, the Fleet Cohesion panel shows how aligned the fleet is, on a green-to-red gradient, and flags the machines that have drifted from the rest. See Software Genomics, Groups, And Drift for how cohesion and drift are measured.

Get-CimInstance Win32_Service -Filter "Name='VersionGopherEndpoint'" | Select-Object Name, State, StartMode, StartName

Enrollment and the first Fleet check-in should appear before the first scheduled scan. Allow up to 15 minutes after Intune begins installation for install, service start, enrollment, and the first Fleet check-in. The first scan can occur later because the configured startup delay and random jitter are intentional.

Good Operating Practice

• Treat bootstrap tokens as bounded secrets: limit lifetime and activations, enroll the approved machines, then revoke.
• Keep every deployed release traceable to its signed manifest and SHA-256.
• Roll out to a small pilot group first, confirm scans and uploads, then widen.
• Deploy only newer signed versions; never re-use a version for changed bytes.
• Use the dedicated endpoint.versiongopher.com origin for hosted enrollment, check-in, and upload; do not substitute the public website origin.