Microsoft Intune Detection Rule for the Certero Windows Client

Applies to: Certero Unified Platform v8.6 and later, for the Windows Client agent deployed as an Intune Win32 app.

Overview

When deploying the Certero Windows Client via Microsoft Intune, Intune requires a Detection Rule against the Win32 app definition. The Detection Rule tells Intune how to check whether the Certero Client is already installed on a target endpoint, so it can decide whether to install, skip, or re-install on each device.

This article gives three supported rule configurations: two simple built-in rule types (Registry and File), and one custom PowerShell script for organisations that prefer a scripted approach. Any one of them on its own is sufficient; you do not need to combine them.

Getting the Installer

Before configuring the Intune Win32 app you need the ClientSetup.exe installer file. There are two supported ways to obtain it, and these are the only two places the file is available. Pick whichever suits your packaging workflow.

Option 1: Download from the CUP Platform UI

Sign in to the CUP web interface, then open the User menu at the bottom-left of the screen and select Downloads. The Downloads dialog lists every installer the tenant offers, organised by platform. For an Intune deployment on 64-bit Windows endpoints, select:

• Client Agent Setup for Windows (x64), which downloads as ClientSetup.exe.

The Downloads dialog also shows the tenant's Tenant ID with a copy button, which is useful if your Intune install command line will use it.

Option 2: Direct Download from the Endpoint Server

The Endpoint Server hosts the installer files at a fixed URL structure. Browse directly to:

• 64-bit: https://<your-endpoint-server>/CerteroEndpointServer/Client/x64/ClientSetup.exe

• 32-bit: https://<your-endpoint-server>/CerteroEndpointServer/Client/Win32/ClientSetup.exe

Replace <your-endpoint-server> with the hostname of your organisation's Endpoint Server (the same host the Certero agent communicates with). This is the method to use when you want to script the retrieval, for example inside a build pipeline that repackages the installer into .intunewin on a schedule.

Before You Start

• The Certero Windows Client installer is a file named ClientSetup.exe, built with NSIS (Nullsoft Scriptable Install System) rather than Windows Installer / MSI. Intune's "MSI product code" detection rule type therefore cannot be used. Please use one of the options below instead.

• The x64 and Win32 variants of the installer are both named ClientSetup.exe. They are distinguished by the download folder (for example x64\ClientSetup.exe versus Win32\ClientSetup.exe), not by the filename itself.

• The built-in Registry and File rules use a string (version) comparison, so the same rule works across releases. You set the deployed version as the threshold, and the rule reports "installed" once an endpoint has that version or higher.

• Neither built-in rule should be set to "Associated with a 32-bit app on 64-bit clients". The Certero Windows Client installs into the 64-bit registry and Program Files on modern endpoints.

Option A: Registry Rule (Recommended)

Detect the Certero Client by the DisplayVersion value that its installer writes to the standard Windows Uninstall registry hive.

The subkey name is the literal string CSSVC. It is not a GUID.

Option B: File Rule

Detect the Certero Client by the file version of its main service executable.

Alternative: Certero-Owned Registry Key

If site policy prefers detection against a vendor-owned key rather than the shared Windows Uninstall hive, the installer also writes a version marker to a dedicated Certero key. Use the same string-version comparison shown in Option A, but with these values:

• Key path: HKEY_LOCAL_MACHINE\SOFTWARE\Certero\Client

• Value name: Version

This key is written on every install and removed on every uninstall, so it is a reliable marker.

Advanced: Custom PowerShell Detection Script

Some organisations prefer a scripted detection rule for consistency with the rest of their Intune Win32 app catalogue, or because they want to layer additional checks (service state, path integrity, and so on) into a single rule. The script below checks for the Certero Client service first, then falls back to checking the install directory. Save it as a .ps1 file and upload it as the detection script for the Win32 app.

<#.SYNOPSIS    Detection script for the Certero Windows Client in Intune..DESCRIPTION    Checks for the Certero Client Windows service, and falls back to checking    the standard install directory. Writes a status line to STDOUT and exits 0    when the agent is detected, or exits 1 when it is not.#># Check for the Certero Client service (installed name: cssvc)$service = Get-Service -Name "cssvc" -ErrorAction SilentlyContinue# Fallback to DisplayName lookup for future-proofingif (-not $service) {    $service = Get-Service -DisplayName "Certero Client" -ErrorAction SilentlyContinue}if ($service) {    Write-Host "Certero Client service detected: $($service.Name) ($($service.Status))"    exit 0}# Fallback: check for the standard install path$installPaths = @(    "$env:ProgramFiles\Certero\Client",    "${env:ProgramFiles(x86)}\Certero\Client")foreach ($path in $installPaths) {    if (Test-Path (Join-Path $path "cssvc.exe")) {        Write-Host "Certero Client detected at: $path"        exit 0    }}# Not foundexit 1

In the Intune Win32 app definition, configure the detection rule as follows:

Important: Use Intune for First Install Only

For details of how the Certero agent decides when to self-update, see When Will a Certero Windows Agent Self-Update?.

Verifying the Rule

Once the Win32 app is assigned in Intune, you can confirm detection on a target endpoint two ways:

• Endpoint side: confirm the presence of the values above using reg query, or by inspecting the file version of cssvc.exe in %ProgramFiles%\Certero\Client\. For the PowerShell option, run the script directly on the endpoint and check the exit code with $LASTEXITCODE.

• Intune side: the Win32 app's install status for the device will report Installed once the detection rule matches. If Intune keeps re-attempting install, the rule is not matching. Check that the deployed version is not lower than the threshold configured in the rule (for the built-in rules), or that the script returns exit code 0 with STDOUT output (for the PowerShell option).

Related

• When Will a Certero Windows Agent Self-Update?. Explains why the platform, not Intune, manages agent upgrades after first install.

• Windows Agent Updates & Versioning | 8.1 onwards. Covers how to control auto-update behaviour at global and Configuration Group level.