Application packaging for Microsoft Intune and ConfigMgr
Send me the installer nobody else could package.
I've packaged Windows applications for enterprises since 2002, across energy, government, broadcasting, finance and the NHS. Every package is curated by hand, built to your scripting standard, tested end to end through Intune on a locked-down Microsoft baseline device, and covered by a 12‑month warranty. Your first one is free.
No commitment and nothing up front. Every package is guaranteed to work in your UAT, or you don't pay.
Please wait while Windows configures LegacyCAD 2019
Vendor installer: no silent switch, per-user licence, bundled updater.
Where packaging gets stuck
Catalogue tools handle the popular apps well. What's usually left is line-of-business and legacy software, and vendor installers that won't install quietly. That's the work I do.
In Recast's State of Intune 2026 survey of 890 IT professionals, 37% named packaging and deployment as their biggest Intune challenge, and 49% still package Win32 apps by hand.
How I work
I don't automate packages. I curate them.
Automated tools convert an installer as the vendor shipped it. I read what each installer does, set it up the way your business needs, and write down what I changed and why.
Read and understood first
Every package is read, understood and shaped by hand. I find out what the installer does, then decide what stays, what goes and what gets configured, and I write down why.
Built for the person who opens it
I package with the end user in mind. When they open the app it should just work, without first-run wizards, licence prompts, surprise reboots or update messages they can't act on.
Priced like an accountant would
I hold a four-year degree in cost and management accounting. A package is worth what it saves in tickets, lost hours and failed rollouts, so I quote fixed prices and show you the return.
Planned for the next version
Applications have a lifecycle. Each package ships with notes on how to upgrade, supersede and retire it, so version two takes hours rather than another week of discovery.
Installers that are hard to package
These come up all the time, and they're most of my work.
No silent switch
Identify the framework, extract the real payload, capture or rebuild the install where the vendor never supported unattended mode.
Per-user installs
Convert to per-machine where it's safe, or deliver the user parts through Active Setup or user-context rules so every profile gets it.
Auto-updaters
Switch off the updater, the scheduled task and the service, so versions change when you decide and not when the vendor does.
Licensing and activation
Licence files, keys, servers and environment variables applied at install, so nobody is asked to activate anything.
Prerequisite chains
VC++ runtimes, .NET, drivers and database clients handled as proper Intune dependencies, in the right order.
Legacy apps on Windows 11
Compatibility fixes, permissions, shims and ARM64 checks for software that was written for a Windows that no longer exists.
Misleading return codes
Installers that report success while failing, or failure while working. Mapped properly, so Intune tells you the truth.
Missing source media
Recreating install components when the original media is gone, as I did on a 1,200-application migration.
What you get with every package
- A tested .intunewinOr a ConfigMgr, App-V or MSIX package if that's what your estate runs.
- Built the way your team worksA plain command line, a PowerShell script or PSADT v4, curated to your template and conventions. Silent, logged, no forced reboot.
- Detection and requirement rulesPrecise enough that Intune knows when it's installed and when it isn't.
- Dependencies and supersedencePrerequisites mapped, and what this version replaces.
- Customisations, and whyEvery change to vendor defaults, written down with the reason.
- Test evidenceInstall, repair, upgrade and uninstall logs with screenshots from the locked-down test device.
- Next-version notesHow to update it next time without starting from zero.
Delivered in the format your team supports
# Install section, Invoke-AppDeployToolkit.ps1 Start-ADTMsiProcess -Action Install -FilePath 'App.msi' -Transforms 'App.mst' # Uninstall section Uninstall-ADTApplication -Name 'Vendor App' -ApplicationType 'MSI' # Intune install command Invoke-AppDeployToolkit.exe -DeploymentType Install -DeployMode Silent
# Install.ps1 $log = "C:\Windows\Logs\Vendor_App_4.2.1_x64_R01.log" $p = Start-Process msiexec.exe -Wait -PassThru -ArgumentList ( '/i "App.msi" TRANSFORMS="App.mst" /qn /norestart /l*v "{0}"' -f $log) exit $p.ExitCode
:: Install msiexec /i "App.msi" TRANSFORMS="App.mst" /qn /norestart /l*v "C:\Windows\Logs\Vendor_App_4.2.1_x64_R01.log" :: Uninstall msiexec /x {6B2F8C1E-4D3A-4F7B-9E21-0C5D8A7B3F42} /qn /norestart
Built to your own template and naming if you have one. Detection: MSI product code, version 4.2.1 or later.
- Clean install
- Uninstall leaves nothing
- Upgrade from 4.1
- Standard user launch
- No first-run prompts
- Updater disabled
- Passes baseline ASR rules
- Allowed by App Control
Tested on a locked-down device
A package that works on a clean machine can still fail once security policies apply. So every package is tested through Intune on a device built to Microsoft's enterprise security baselines, as a standard user.
- Microsoft's enterprise baseline as standard. Every test device runs Microsoft's security baselines, attack surface reduction rules, application control, BitLocker and a standard user. Included in every price.
- Deployed the real way. Assigned and installed through Intune, in system or user context, exactly as your devices will receive it.
- Conflicts written down. Anything the baseline blocks is fixed in the package or documented as a policy exception you can decide on.
- Want your own policies instead? I can run a dedicated VM for your organisation with your baseline applied from an export. It's a paid option, quoted up front, and the VM and your configuration are removed when the engagement ends.
- Security baselineWindows and Defender baselines
- Attack surface reductionBlock mode rules
- App Control / AppLockerVendor updater blocked: removed from package
- BitLocker and LAPSEncrypted, no local admin
- Compliance and configurationEnterprise profiles and device restrictions
- Standard userLaunches, saves and prints without elevation
Pricing
Fixed prices, and you only pay when it works.
Lower than the published UK framework rates, with a warranty as long as the best of them, from someone with 24 years of enterprise packaging behind every package.
Your first app is free.
Send me the one that's been stuck the longest. If the package works, I'd ask for a short testimonial. If it doesn't, you've lost nothing.
- One free app per organisation
- Same testing, documentation and warranty as paid work
- A limited number of free slots each month
Standard
MSI or well-behaved EXE installers that need proper configuration, testing and documentation.
Complex
No silent switch, per-user installs, licensing, drivers, prerequisite chains, legacy software or capture and rebuild. Confirmed as Complex at the free feasibility check, before you commit.
Rescue
Something that's already failed in production, or that nobody else could package. I look at it first and quote a fixed price. No fix, no fee.
How this compares
The usual ways to get applications packaged, side by side.
| Option | GE App Solutions | Framework suppliers | Catalogue subscriptions | Gig marketplaces |
|---|---|---|---|---|
| Price per app | £229 or £320, fixed | From £325 to £575 published | Monthly fee, popular apps only | Often under £50 |
| Line-of-business and legacy apps | The main focus | Yes | Rarely in the catalogue | Varies widely |
| Who does the work | A named packager with 24 years' experience | Varies by supplier | Automation | Unknown |
| Warranty | 12 months | Typically 6 to 12 months | Not applicable | Rarely offered |
| When you pay | After 30 days of UAT, only if it works | Varies, often on delivery | Up front, every month | Up front |
| Tested on a locked-down baseline | Yes, through Intune. Your own baseline as an option | Varies | No | Rarely |
| Script format | Command line, PowerShell or PSADT, to your template | Usually their own standard | Fixed by the vendor | Varies |
| Documentation and test evidence | With every package | Usually | Minimal | Rarely |
| First app | Free | Paid | Often a free trial | Paid |
Based on published UK framework listings and public marketplace offers, October 2026. Individual suppliers vary.
My prices exclude VAT where applicable.
For IT and for finance
If you run the platform
- Your backlog moves without hiring.
- Packages follow one standard, so they're easy to support.
- Detection rules you can trust, so reporting is honest.
- Documentation good enough to hand to someone else.
If you sign off the spend
- A fixed price, agreed before any work starts.
- Nothing to pay until it passes your UAT, and nothing at all if it can't.
- Twelve months of warranty included in the price.
- Fewer failed installs means fewer tickets and less lost time.
What a bad package costs you
Example figures. Change them to match your estate.
A Standard package costs £229, 17% of what one rollout of failures costs you.
How it works
- Send the installerPlus anything you know: licence, settings, what's gone wrong.
- Free feasibility checkI confirm what it needs and give you a fixed price.
- CurateStrip, configure and shape it for your users.
- Test locked downThrough Intune, on a UK Azure VM with Microsoft's enterprise baseline.
- Document and deliverPackage, rules, evidence and notes, ready to import.
- Your UAT, then pay30 days to test in your environment. No work, no charge.
- Warranty and next version12 months of cover, then a faster upgrade.
Experience
24 years of enterprise packaging
I'm Grant Longworth. I've packaged applications on contract since 2002, from SMS 2003 and Wise through Altiris, SCCM, App-V and MSIX to Intune and PSADT. I see past the individual package to the people using the software, the return on the spend, and the version that comes after this one.
12½ years on one global estate
- Senior packager for 60,000 users across 55 countries
- 1,000+ applications delivered
- Led the SCCM to Intune migration and its packaging standards
- Key packager on a $100M Windows 10 and 11 transformation
- 40% fewer deployment failures; led a 7-person packaging team
Proof of the craft: I built Packaging Console, a free desktop toolkit for packaging and QA work.
- 2025 to nowEnterprise application packagerIntune and ConfigMgr packaging on contract
- 2012 to 2025BPSenior application packager, global estate
- 2011 to 2012BBC, via AtosWindows 7 packaging standards for 30,000 desktops
- 2007 to 2011DFIDPackaging for users in 20+ countries; Change Advisory Board
- 2009 to 2010NHS BarnetOff-site application packager
- 2007Brit Insurance90+ apps for desktop and Citrix
- 2006 to 2007Prudential, via Dell1,200 applications migrated to Citrix
- 2005RM Education, and a Windows XP rolloutLocked-down education builds; 1,200+ apps for XP
- 2004The National Archives120+ apps for a standard XP build
- 2002 to 2004Transport for LondonSMS administration and packaging
Names refer to past contract roles and are listed for experience only, not as endorsements. Full history on LinkedIn.
Standards as a service
Packaging standards for your organisation
Standards only help if your team uses them, so I write yours around your platforms, tools and change process, and the people who'll look after the packages later.
- Included free with any paid engagement. Every package I deliver for you follows them, so your team can keep the standard going.
- Or on their own. If you're not ready to outsource packaging, I can write your standards as a standalone piece of work, quoted after a short call.
- Kept current. When your platform changes, from ConfigMgr to Intune or MSI to MSIX, the standards change with it.
- Naming and versioningBuilt around your CMDB, Company Portal and reporting
- Script conventionsYour PSADT template, PowerShell or command line, logging and return codes
- Detection and requirementsRules that match how your estate is targeted
- Context and per-user strategySystem, user and Active Setup, decided once
- LifecycleUpgrades, supersedence and retirement in your tooling
- Security alignmentFits your baselines, ASR and App Control policies
- Testing and acceptanceA UAT checklist your testers will actually use
- GovernanceDocumentation templates, change control and sign-off
Security and how I handle your files
Questions
Do you only package for Intune?
No. Intune is where most work is heading, but I've packaged for SMS, Altiris and ConfigMgr for two decades, plus App-V, MSIX and Citrix. Many estates are hybrid, and I'll package for whatever you deploy with.
How long does it take?
Standard applications are usually turned around within five working days, and complex ones are agreed with you after the feasibility check. If you have a deadline, tell me up front and I'll say honestly whether I can meet it.
What if it can't be packaged?
Then I tell you after the free feasibility check, with the reason and any alternatives, and you pay nothing. Some vendor installers genuinely can't run silently. I'd rather say so than sell you something fragile.
Where does the work happen?
On Azure virtual machines in a UK region, inside my own tenant, enrolled in a test Intune environment built to Microsoft's enterprise security baselines. I don't need access to your tenant. If you'd rather I test on one of your own devices as well, that's fine too.
Can you test against our own policies?
Yes, as a paid option. I set up a dedicated VM just for your organisation and apply your baseline from an export of your Intune configuration, security baselines, ASR rules and App Control or AppLocker policies. It's quoted up front, covered by NDA on request, and the VM and your configuration are deleted when the work ends. Without it, every package is still tested on Microsoft's enterprise baseline.
Can we buy packaging standards on their own?
Yes. Some teams want their standards sorted before they outsource anything. I start with a short call about your platforms, tooling and governance, then quote a fixed price. If you later engage me for packaging, the standards are already done and every package follows them.
Can you match our PSADT template?
Yes. Send your template and conventions and every package follows them. If you don't have one, I'll deliver in PSADT v4, PowerShell or a plain command line, whichever your team is most comfortable supporting.
What does the warranty cover?
Defects in the package itself for 12 months from acceptance: detection that's wrong, an uninstall that leaves files behind, a setting that doesn't apply. It doesn't cover the vendor releasing a new version, though I'll give you a fixed price for that.
Start here
Tell me about the app that's stuck.
I'll reply within one working day with what it needs and a fixed price. If it's your first app with me, it's free.
- No obligation. The feasibility check is free.
- Don't send the installer yet. I'll give you a secure upload link once we've talked.
- Prefer LinkedIn? Message me there.