Installer properties and Intune deployment

Applies to client 2.0.x and later. For tenant admins and partner admins.

One x64 MSI installs and removes the whole client: the kernel driver, the AdminExplorer service (LocalSystem), the tray app and the right-click menu entries. The MSI is the same for every customer and is never changed. Your tenant’s settings come from a transform (.mst) in the download bundle. The step-by-step rollout is in Getting started.

The download bundle

Download in the portal builds one zip:

File	Content
AdminExplorer.msi	The installer, the same for every customer
AdminExplorer-<tenant>.mst	Your license, portal address, tenant id and a new enrollment key
Install.cmd	A silent install with the transform
Intune.md	The Intune settings for this bundle

Treat the bundle like a credential. The enrollment key works for at most twice the licensed number of devices, and a new bundle revokes the previous key: build a new bundle after the rollout to retire the old download.

Requirements

• Windows 10 22H2 or Windows 11, x64 only.
• Installed per machine, as SYSTEM (Intune install behaviour System).
• The install folder is fixed: C:\Program Files\AdminExplorer. A machine whose Program Files folder is elsewhere is refused.
• AEMS cannot be installed on the same machine; uninstall it first.
• No downgrade: an older MSI refuses to install over a newer one.

What is installed

Item	Where
Service AdminExplorerSvc (LocalSystem, automatic start)	C:\Program Files\AdminExplorer\AdminExplorerSvc.exe
Kernel driver AdminExplorerDriver (Microsoft-attested)	C:\Program Files\AdminExplorer\Driver\, added to the Windows driver store
Secure-desktop confirmation prompt, started only by the service	AdminExplorerConsent.exe
Tray app, started at every sign-in	AdminExplorer.exe (Run key AdminExplorer)
Right-click menu: Run with AdminExplorer (and Run in sandbox when allowed)	AdminExplorerShellExt.dll (x64 and x86)
Windows 11 menu	Run with AdminExplorer is under Show more options; a later signed release adds the compact (top-level) entry
Settings	HKLM\SOFTWARE\Circle Of Bytes\AdminExplorer
Run in sandbox folder	%ProgramData%\Circle Of Bytes\AdminExplorer\Sandbox, protected permissions

Properties

Property	Default	Effect
LICENSE	none	Your signed license. Hidden: never written to the MSI log or a command line.
APIBASEURL	none	The portal API address, for example https://portal.adminexplorer.circleofbytes.com/api. Without it the device never contacts a portal.
TENANTID	none	Your tenant id (a GUID).
ENROLLMENTKEY	none	The enrollment key. Hidden like the license; used once at enrollment and then deleted. Only A-Z a-z 0-9 - _ . are accepted, anything else fails the install.
TRAYAUTOSTART	1	1 starts the tray at every sign-in. 0 does not. The choice is kept for later upgrades and repairs.
KEEPCONFIG	0	Uninstall only. 1 keeps the approved list and the license; everything else is removed.

The transform from your bundle sets LICENSE, APIBASEURL, TENANTID and ENROLLMENTKEY. You normally pass nothing else.

• An empty property writes nothing; a property that is not passed keeps the value already on the device. A command line or transform always wins.
• The license and the enrollment key are written by a custom action, never as plain registry rows, so they do not appear in a verbose MSI log or in process-creation telemetry.
• A value under HKLM\SOFTWARE\Policies\Circle Of Bytes\AdminExplorer\Portal (ApiBaseUrl, TenantId, ProxyUrl) wins over the installed one.

Command lines

msiexec /i AdminExplorer.msi TRANSFORMS=AdminExplorer-<tenant>.mst /qn /norestart
msiexec /x <product code> /qn /norestart
msiexec /x <product code> /qn /norestart KEEPCONFIG=1

The exact file names and the product code are on the Download page with a Copy button.

Exit codes

Code	Meaning
0	Success
3010	Success, a file was in use (typically the right-click menu DLL held by Explorer). Treat it as success; Intune: soft reboot.

The installer never restarts the machine.

Intune (Win32 app)

Setting	Value
Package	The three files in one folder, wrapped with IntuneWinAppUtil.exe -c <folder> -s Install.cmd -o <out>
Install command	msiexec /i AdminExplorer.msi TRANSFORMS=AdminExplorer-<tenant>.mst /qn /norestart
Uninstall command	msiexec /x <product code> /qn /norestart
Install behaviour	System
Device restart behaviour	Determine behaviour based on return codes; 3010 = soft reboot
Detection rule	MSI, the product code from the Download page
Requirements	Windows 10 22H2 or Windows 11, x64 only
Assignment	A device group

After enrollment the client never needs to be rebuilt per customer: policy, license renewals, audit and approvals flow through the portal.

Upgrades

• Every MSI version is a major upgrade: the previous version is removed completely, then the new one is installed.
• Settings, the license, the portal enrollment and records not sent yet are kept.
• An older AdminExplorer product line (the earlier Admin Explorer installer) is removed too; its approved list is copied into the new settings once. Its license is not carried over.
• Changes to the approved list do not need a reinstall: they come from the portal.

Repair

A repair (msiexec /f) applies the cached transform again. An enrollment key the device has already used is recognised and ignored, so a repair never enrolls the device twice. To enroll a revoked device again, install a new key: a repair or reinstall with the transform from a new bundle.

Uninstall

• Stops and removes the service, the driver, the tray and the menu entries, and the per-user packages.
• Removes the settings unless KEEPCONFIG=1, and the local queue of records not sent yet (those records are lost; the Windows event log keeps them).
• Removes the Windows Sandbox policy values AdminExplorer wrote, and the sandbox folder when it is empty. The Windows Sandbox feature itself is left as it is.
• Never touches the Policies key (Group Policy) or the settings of the older Admin Explorer product.
• The right-click menu DLL can stay locked by Explorer until the next restart (exit code 3010).

Tools that set DISABLEROLLBACK=1 (some RMM tools, or the DisableRollback policy) skip the final clean-up steps: the settings then stay on the device whatever KEEPCONFIG says.