Deploy a Network Printer with Intune as a Win32 App

What this guide covers

A direct-IP printer deployment with full detection

This example was derived from a deployment used in production, with organisation names, locations and internal addressing removed. It installs a printer for the device rather than an individual user, so the Win32 app should run as SYSTEM.

The tested package used the TOSHIBA Universal Printer 2 driver. The driver INF supplied these identifiers:

Prepare the source

Keep the package input separate from its output

Create a clean source folder containing the scripts and the extracted 64-bit driver files. Keep the Microsoft Win32 Content Prep Tool and its output outside that source folder; the tool packages every file and subfolder under the source path.

Printer-Source\
├── 64bit\
│   ├── eSf6u.inf
│   ├── esf6u.cat
│   └── [other vendor driver files]
├── Install.ps1
└── Uninstall.ps1

Printer-Output\
├── Detection.ps1
└── Install.intunewin

Redacted examples

Set the four values consistently

The downloadable examples use the reserved documentation address 192.0.2.25. Before packaging, replace the printer name, IP address and port name in all three scripts, and replace the driver name and INF filename where required.

$PrinterName = "Example Office Colour Printer"
$PrinterIP   = "192.0.2.25"
$PortName    = "IP_192.0.2.25"
$DriverName  = "TOSHIBA Universal Printer 2"
$InfName     = "eSf6u.inf"

Create the package

Convert the source folder to .intunewin

Download Microsoft's Win32 Content Prep Tool and run it outside the source directory. The setup file identifies the entry point; the complete source directory is packaged.

IntuneWinAppUtil.exe `
    -c "C:\Packages\Printer-Source" `
    -s "Install.ps1" `
    -o "C:\Packages\Printer-Output" `
    -q

Inspect the output folder and confirm that Install.intunewin was created. Do not put a previous .intunewin file inside the source folder.

Configure Microsoft Intune

Create the Windows app and use device context

In the Intune admin centre, create a Windows app (Win32) and upload the package. A representative configuration is:

The example uses ExecutionPolicy Bypass only for that PowerShell process. Organisations that require signed scripts should sign the files with their trusted code-signing certificate and configure the commands and detection settings accordingly.

Validate before broad assignment

Prove installation, printing and removal

Common failure points

Use the evidence produced by each layer

Security and governance

Treat the driver as privileged software

The package runs as SYSTEM and stages kernel-adjacent vendor software. Obtain drivers from an authoritative source, retain their version and signature evidence, restrict who can edit or assign the Intune app, and pilot replacement versions before broad deployment. Avoid publishing internal IP addresses, site names or identifiable screenshots.

This implementation supports RACF-CC Domain 2 through managed endpoint configuration, Domain 4 through controlled driver maintenance, Domain 6 through deployment and local logging, and Domain 8 through ownership, approval and retained evidence.

Authoritative references

Microsoft deployment and command guidance

• Microsoft Learn: Prepare Win32 app content for upload
• Microsoft Learn: Win32 app management in Microsoft Intune
• Microsoft Learn: PnPUtil command syntax
• Microsoft Learn: PnPUtil return values
• Microsoft Learn: Add-Printer
• Microsoft Learn: Add-PrinterDriver
• Microsoft Learn: Add-PrinterPort

Microsoft Intune screens and vendor driver versions change over time. Confirm the current documentation and driver package before deployment.