Papercut Client deployment with Intune

Papercut have a “handy” guide on how to deploy the client using Intune on their site which I thought was going to be the end of this. However there are 2 fatal flaws with their approach.

1. It deploys in the user’s context so if they aren’t a local admin on the computer it will fail to install.
2. Post install it wont auto start.

Looking at the comments on that article there is a solution to point 1 which with a couple of minor edits could be a solution to point 2.

If you are deploying the NG client simply change MF to NG in any paths below.

install.ps1

The MSI contains a property that tells Intune that this is a user context app which means Intune wont offer the option to install it in the system context. This means the only way to run it in the system context is to wrap it in a script.

To get the suggested script to setup auto start the client as well it just needs to create a registry key in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run that points to pc-client.exe.

I’ve also added a function from Jonathan Medd to test is the property exists before creating it.

$argumentlist = "/qn /L papercut.log ALLUSERS=1"

# See https://www.jonathanmedd.net/2014/02/testing-for-the-presence-of-a-registry-key-and-value.html
function Test-RegistryValue {
    param (
        [parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]$Path,

        [parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]$Value
    )

    try {
        Get-ItemProperty -Path $Path | Select-Object -ExpandProperty $Value -ErrorAction Stop | Out-Null
        return $true
    } catch {
        return $false
    }
}

try {
    Start-Process ".\win\pc-client-admin-deploy.msi" -ArgumentList $argumentlist
    if(-Not (Test-RegistryValue -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Value "PapercutMFClient")){
        New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "PaperCutMFClient" -Value "C:\Program Files\PaperCut MF Client\pc-client.exe"
    }
} catch {
    Write-Output "$($env:COMPUTERNAME) Error: $($_.Exception.Message)"
}

uninstall.ps1

With Intune you need to make sure that it can uninstall the item as well, you never know if Papercut are going to release a new client that doesn’t update the existing one. Uninstall is pretty much the same process, run the uninstall command and delete the registry key.

$argumentlist = '/x "{A213EB00-99FE-11EC-BC52-DA2D66F1ACF7}" /qn /L papercut.log'
try {
    Start-Process "msiexec" -ArgumentList $argumentlist
    Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "PaperCutMFClient"
} catch {
    Write-Output "$($env:COMPUTERNAME) Error: $($_.Exception.Message)"
}

Packaging and Deploying

As per the guide from Papercut, copy the whole of the PCClient folder over to your source folder and then paste in install.ps1 and uninstall.ps1. Then run the Intune Packager to create your .intunewin file.

Then on Intune create a new Windows App (Win32) and upload the .intunewin you just created.

I set the name to Papercut MF Client, gave it a quick description and set the version/publisher as needed.

The install command needs to be:

powershell -executionpolicy bypass -file install.ps1

and the uninstall command needs to be:

powershell -executionpolicy bypass -file uninstall.ps1

Crucially make sure that the Install behavior is System.

The current client is 64 Bit only and runs on any Windows 10.

For detection rules I used a Rule Type of File, a Path of C:\Program Files\PaperCut MF Client, a File or folder of pc-client.exe and a Detection method of File or folder exists.

It has no requirements or supersedence (until we update it) so its just a case of selecting the group to deploy it to. I have a group for all on-site workstations which I applied it to.

That’s It!

The only weird thing is that despite the script explicitly stating HKLM:\Software\Microsoft\Windows\CurrentVersion\Run for the value it gets created in HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run. This isn’t any issue for us as both keys work but for other software you might find this article interesting.