---
title: "Microsoft Intune Detection Rule for the Certero Windows Client"
canonical: "https://ai-docs.certero.com/space/CUP/335806507/Microsoft%20Intune%20Detection%20Rule%20for%20the%20Certero%20Windows%20Client"
format: markdown
---
---

**Applies to:** Certero Unified Platform v8.6 and later, for the Windows Client agent deployed as an Intune Win32 app.

## Overview

When deploying the Certero Windows Client via Microsoft Intune, Intune requires a **Detection Rule** against the Win32 app definition. The Detection Rule tells Intune how to check whether the Certero Client is already installed on a target endpoint, so it can decide whether to install, skip, or re-install on each device.

This article gives three supported rule configurations: two simple built-in rule types (Registry and File), and one custom PowerShell script for organisations that prefer a scripted approach. **Any one of them on its own is sufficient**; you do not need to combine them.

## Getting the Installer

Before configuring the Intune Win32 app you need the `ClientSetup.exe` installer file. There are two supported ways to obtain it, and these are the **only** two places the file is available. Pick whichever suits your packaging workflow.

### Option 1: Download from the CUP Platform UI

Sign in to the CUP web interface, then open the **User** menu at the bottom-left of the screen and select **Downloads**. The Downloads dialog lists every installer the tenant offers, organised by platform. For an Intune deployment on 64-bit Windows endpoints, select:

- **Client Agent Setup for Windows (x64)**, which downloads as `ClientSetup.exe`.

The Downloads dialog also shows the tenant's **Tenant ID** with a copy button, which is useful if your Intune install command line will use it.

### Option 2: Direct Download from the Endpoint Server

The Endpoint Server hosts the installer files at a fixed URL structure. Browse directly to:

- 64-bit: `https://<your-endpoint-server>/CerteroEndpointServer/Client/x64/ClientSetup.exe`
- 32-bit: `https://<your-endpoint-server>/CerteroEndpointServer/Client/Win32/ClientSetup.exe`

Replace `<your-endpoint-server>` with the hostname of your organisation's Endpoint Server (the same host the Certero agent communicates with). This is the method to use when you want to script the retrieval, for example inside a build pipeline that repackages the installer into `.intunewin` on a schedule.

> ℹ️ Both sources always host the current version the Endpoint Server has itself received. You will not get an older build from one source than from the other, and there are no other supported locations for the installer.

## Before You Start

- The Certero Windows Client installer is a file named `ClientSetup.exe`, built with **NSIS** (Nullsoft Scriptable Install System) rather than Windows Installer / MSI. Intune's *"MSI product code"* detection rule type therefore cannot be used. Please use one of the options below instead.
- The x64 and Win32 variants of the installer are both named `ClientSetup.exe`. They are distinguished by the download folder (for example `x64\ClientSetup.exe` versus `Win32\ClientSetup.exe`), not by the filename itself.
- The built-in Registry and File rules use a **string (version) comparison**, so the same rule works across releases. You set the deployed version as the threshold, and the rule reports "installed" once an endpoint has that version or higher.
- Neither built-in rule should be set to *"Associated with a 32-bit app on 64-bit clients"*. The Certero Windows Client installs into the 64-bit registry and Program Files on modern endpoints.

## Option A: Registry Rule (Recommended)

Detect the Certero Client by the `DisplayVersion` value that its installer writes to the standard Windows Uninstall registry hive.

| Field | Value |
| --- | --- |
| Rule type | **Registry** |
| Key path | `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CSSVC` |
| Value name | `DisplayVersion` |
| Detection method | **String (version) comparison** |
| Operator | **Greater than or equal to** |
| Value | The version you are deploying (for example `8.8.0.1234`) |
| Associated with a 32-bit app on 64-bit clients | **No** |

The subkey name is the literal string `CSSVC`. It is not a GUID.

## Option B: File Rule

Detect the Certero Client by the file version of its main service executable.

| Field | Value |
| --- | --- |
| Rule type | **File** |
| Path | `%ProgramFiles%\Certero\Client` |
| File or folder | `cssvc.exe` |
| Detection method | **String (version) comparison** |
| Operator | **Greater than or equal to** |
| Value | The version you are deploying (for example `8.8.0.1234`) |
| Associated with a 32-bit app on 64-bit clients | **No** |

## Alternative: Certero-Owned Registry Key

If site policy prefers detection against a vendor-owned key rather than the shared Windows Uninstall hive, the installer also writes a version marker to a dedicated Certero key. Use the same string-version comparison shown in Option A, but with these values:

- Key path: `HKEY_LOCAL_MACHINE\SOFTWARE\Certero\Client`
- Value name: `Version`

This key is written on every install and removed on every uninstall, so it is a reliable marker.

## Advanced: Custom PowerShell Detection Script

Some organisations prefer a scripted detection rule for consistency with the rest of their Intune Win32 app catalogue, or because they want to layer additional checks (service state, path integrity, and so on) into a single rule. The script below checks for the Certero Client service first, then falls back to checking the install directory. Save it as a `.ps1` file and upload it as the detection script for the Win32 app.

```powershell
<#
.SYNOPSIS
    Detection script for the Certero Windows Client in Intune.
.DESCRIPTION
    Checks for the Certero Client Windows service, and falls back to checking
    the standard install directory. Writes a status line to STDOUT and exits 0
    when the agent is detected, or exits 1 when it is not.
#>

# Check for the Certero Client service (installed name: cssvc)
$service = Get-Service -Name "cssvc" -ErrorAction SilentlyContinue

# Fallback to DisplayName lookup for future-proofing
if (-not $service) {
    $service = Get-Service -DisplayName "Certero Client" -ErrorAction SilentlyContinue
}

if ($service) {
    Write-Host "Certero Client service detected: $($service.Name) ($($service.Status))"
    exit 0
}

# Fallback: check for the standard install path
$installPaths = @(
    "$env:ProgramFiles\Certero\Client",
    "${env:ProgramFiles(x86)}\Certero\Client"
)

foreach ($path in $installPaths) {
    if (Test-Path (Join-Path $path "cssvc.exe")) {
        Write-Host "Certero Client detected at: $path"
        exit 0
    }
}

# Not found
exit 1

```

In the Intune Win32 app definition, configure the detection rule as follows:

| Field | Value |
| --- | --- |
| Rule type | **Use a custom detection script** |
| Script file | Your saved `.ps1` file |
| Run script as 32-bit process on 64-bit clients | **No** |
| Enforce script signature check and run script silently | Optional. Set to **Yes** only if your organisation signs its detection scripts. |

> ℹ️ Intune treats the app as detected when the script writes any text to STDOUT and exits with code 0. The `Write-Host` calls above satisfy the STDOUT requirement, so no additional output handling is needed.

## Important: Use Intune for First Install Only

> ⚠️ Use Intune to deploy the Certero Windows Client for the **first-time install only**. Do **not** lower the version in Intune and redeploy in an attempt to push upgrades. The Certero platform performs its own intelligent, per-module upgrades against the Endpoint Server once the agent is installed. Fighting this from Intune leads to conflicting deployments, unnecessary reinstalls, and unpredictable version state across the estate.

For details of how the Certero agent decides when to self-update, see [When Will a Certero Windows Agent Self-Update?](https://certero.atlassian.net/wiki/spaces/CUP/pages/335937537).

## Verifying the Rule

Once the Win32 app is assigned in Intune, you can confirm detection on a target endpoint two ways:

- **Endpoint side:** confirm the presence of the values above using `reg query`, or by inspecting the file version of `cssvc.exe` in `%ProgramFiles%\Certero\Client\`. For the PowerShell option, run the script directly on the endpoint and check the exit code with `$LASTEXITCODE`.
- **Intune side:** the Win32 app's install status for the device will report *Installed* once the detection rule matches. If Intune keeps re-attempting install, the rule is not matching. Check that the deployed version is not lower than the threshold configured in the rule (for the built-in rules), or that the script returns exit code 0 with STDOUT output (for the PowerShell option).

## Related

- [When Will a Certero Windows Agent Self-Update?](https://certero.atlassian.net/wiki/spaces/CUP/pages/335937537). Explains why the platform, not Intune, manages agent upgrades after first install.
- [Windows Agent Updates & Versioning | 8.1 onwards](https://docs.certero.com/space/CUP/118918337/Windows+Agent+Updates+%26+Versioning+%7C+8.1+onwards). Covers how to control auto-update behaviour at global and Configuration Group level.