Deploy WatchTower via Intune / Group Policy

Deploy the WatchTower MSI through Microsoft Intune (Windows LOB app) or Group Policy Startup Script. Tested on Windows 11, domain-joined and Entra-joined devices.

Prerequisites

  1. Generate an enrolment token from Settings → Enrolment tokens.
  2. Download the WatchTower MSI from the downloads page (the EXE wrapper also works but MSI is cleaner for Intune).
  3. Windows 10 22H2+ or Windows 11. Entra-joined, hybrid-joined or domain-joined.

1. Intune deployment (LOB app)

In Microsoft Intune Admin Centre → Apps → Windows → Add → Line-of-business app:

  • App package file: Upload wt-agent.msi
  • Install command: msiexec /i "wt-agent.msi" /qn TOKEN="your-enrolment-token"
  • Uninstall command: msiexec /x {WT-AGENT-PRODUCT-CODE} /qn (use the GUID from the MSI properties)
  • Detection rule: Registry key HKLM\SOFTWARE\WatchTower\Agent with value Version exists and version ≥ 1.0
  • Assignment: Required → All devices or a device group
# Intune detection script (PowerShell, if using script-based detection)
$path = "HKLM:\SOFTWARE\WatchTower\Agent"
$key = Get-ItemProperty -Path $path -ErrorAction SilentlyContinue
if ($key -and $key.Version) {
    Write-Output "WatchTower agent detected: v$($key.Version)"
    exit 0
}
Write-Output "Agent not found"
exit 1

2. Group Policy Startup Script

For domain-joined devices. Place the MSI on a network share readable by Domain Computers, then add a startup script.

# GPO Startup Script: watchtower-install.ps1
# Place the MSI on a network share: \\fileserver\deploy\wt-agent.msi
$msi = "\\fileserver\deploy\wt-agent.msi"
$token = "your-enrolment-token"

# Check if already installed
$key = Get-ItemProperty "HKLM:\SOFTWARE\WatchTower\Agent" -ErrorAction SilentlyContinue
if ($key -and $key.Version) {
    Write-EventLog -LogName Application -Source "WatchTower" -EventId 1 -Message "Already installed v$($key.Version)"
    exit 0
}

# Install
Start-Process msiexec.exe -ArgumentList "/i `"$msi`" /qn TOKEN=`"$token`"" -Wait

# Verify
$svc = Get-Service -Name "WatchTowerAgent" -ErrorAction SilentlyContinue
if ($svc) {
    Write-EventLog -LogName Application -Source "WatchTower" -EventId 0 -Message "Installed and running"
} else {
    Write-EventLog -LogName Application -Source "WatchTower" -EventId 2 -Message "Install failed"
}
exit 0

Configure the GPO: Computer Configuration → Policies → Windows Settings → Scripts → Startup → Add → PowerShell. Set the script to run regardless of network speed (the MSI download happens in the script, not at GPO processing time).

Acceptance criteria

  • Intune assignment installs agent on next sync (or within 8 hours).
  • Device appears in WatchTower console within two minutes of agent start.
  • GPO startup script installs at next reboot.
  • Uninstall removes agent cleanly.

← Back to all RMM guides