Getting started

Applies to client 2.0.x and later. For tenant admins, partner admins.

AdminExplorer gives standard users administrator rights for one specific program at a time, without ever making them local administrators. This guide takes you from a new tenant to the first enrolled device.

1. Your tenant and license

A tenant is created in one of two ways:

• Trial: a trial ordered on the website is reviewed by your provider after you confirm your email address. Once it is approved, the tenant, a trial license, a default policy and the first download bundle are created, and you get a welcome mail with the portal link.
• Through your partner or provider: a partner administrator uses Onboard a tenant (tenant, license, download bundle) and adds you as a tenant administrator under Users.

You sign in with your work account (Microsoft, Google or Okta, when offered on the sign-in page) or with a one-time sign-in link sent by email. Your email address must belong to a portal user with a role:

Role	Can do
Tenant admin	Everything in the tenant: settings, policy, devices, download, users
Approver	Decide approval requests (Manual approval)
Auditor	Read the audit log and licenses

The tier (Standard or Enterprise) comes from the license. See Licenses for the current license, its tier, seats and expiry.

2. Download the configured client

Open Download and choose Build a new bundle. The bundle is one zip with:

• AdminExplorer.msi, the installer (the same for every customer, never changed);
• AdminExplorer-<tenant>.mst, a transform with your license, your portal address, your tenant id and a new enrollment key;
• Install.cmd, a silent install with the transform;
• Intune.md, the Intune settings for this bundle.

Treat the bundle like a credential: it contains your license and an enrollment key. The key works for at most twice the licensed number of devices and stops working when you build a new bundle, so build a new one after the rollout to retire the old download. The download link is valid for 15 minutes; open the page again for a new link.

3. Deploy with Intune

1. Put the three files in one folder and wrap it with the Microsoft Win32 Content Prep Tool: IntuneWinAppUtil.exe -c <folder> -s Install.cmd -o <out>.
2. Add a Windows app (Win32) in Intune with the .intunewin file.
3. Install command: msiexec /i AdminExplorer.msi TRANSFORMS=AdminExplorer-<tenant>.mst /qn /norestart (the exact file names are on the Download page with a Copy button).
4. Uninstall command: msiexec /x <product code> /qn /norestart.
5. Install behaviour: System. Device restart behaviour: determine behaviour based on return codes. Exit code 3010 means a file was in use; treat it as success (soft reboot).
6. Detection rule: MSI, the product code shown on the Download page.
7. Requirements: Windows 10 22H2 or Windows 11, x64 only.
8. Assign the app to a device group.

The client never needs to be rebuilt per customer: policy, license renewals, audit and approvals all flow through the portal after enrollment.

4. First sign-in on the device

After the installation the AdminExplorer tray icon starts at the next sign-in of each user. Its tooltip shows the tier, for example “AdminExplorer - Enterprise”. Right-click the icon and open Status to see the license, the approval mode, whether the device is enrolled, and Sync now.

On Windows 11 the Run with AdminExplorer entry is under Show more options in the right-click menu. A later signed release adds it to the compact (top-level) menu.

5. Verify that the device appears

1. Open Devices. The device is listed with its hostname, last seen time, agent version and whether its policy is current.
2. Open the device for its details: reported license id, reported policy etag, pending requests and recent elevations.
3. If a machine that was enrolled before installs the client again (a reimage or a new disk), it waits under Re-enrollments waiting for approval until you approve it. Approving revokes the old device record.
4. On the device, Status shows “Enrolled”, and Sync now pulls the policy at once instead of waiting for the next pull (every 15 minutes).

Nothing on the Devices page after an hour? See Troubleshooting.

Next steps

• Read How AdminExplorer elevates to choose your approval mode and reason settings.
• Build your approved list with the Policy guide, which includes starter policies.
• Give approvers and auditors their roles under Users.

Related guides

• How AdminExplorer elevates
• Policy guide with example configurations
• Troubleshooting