Deploy the Desktop Agent via Microsoft Intune (Windows)

Microsoft Intune can install the ZeusLock desktop agent on managed Windows devices and hand it the configuration it needs to bind to your organization. The installer you download is generic — it carries no credentials. An endpoint only becomes an org-bound ZeusLock agent once you deliver its configuration (ServerUrl and LicenseKey) separately, which is the second half of this guide.

Before you begin

• Windows devices enrolled in Intune (Microsoft Entra joined or hybrid joined).
• The Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) to build the .intunewin package.
• The generic agent installer, downloaded from the ZeusLock dashboard under Agents → Deployment. Rename it ZeusLock.msi.
• Your tenant API URL for ServerUrl (e.g. https://api.zeuslock.ai) and your org API key for LicenseKey (a zl_... value from Settings → API Keys).

What blocks versus what only alerts is your policy, which lives in the dashboard and is fetched using the LicenseKey. You never configure policy on the endpoint. Note also that the agent runs in the signed-in user's interactive desktop session — a tray app plus a local inspection proxy on 127.0.0.1:9876 — so it cannot protect a machine with nobody logged in.

Step 1 — Wrap the MSI as a Win32 app

Place ZeusLock.msi in an otherwise empty source folder and run the content prep tool to produce the .intunewin package.

IntuneWinAppUtil.exe -c C:\ZeusLock\source -s ZeusLock.msi -o C:\ZeusLock\output

Step 2 — Create the Win32 app in Intune

In the Intune admin center go to Apps → Windows → Add and choose Windows app (Win32). Upload the ZeusLock.intunewin file, then set the commands. The MSI is a per-user package, so force a per-machine install:

• Install command: msiexec /i ZeusLock.msi /qn ALLUSERS=1 MSIINSTALLPERUSER=""
• Uninstall command: msiexec /x ZeusLock.msi /qn
• Install behavior: System

For the detection rule, use the MSI product code (Intune usually pre-fills it from the package) or a registry/file check on the installed agent.

Step 3 — Assign to a device group

On the Assignments tab, add your Windows device group to Required. Because the agent needs an interactive session to run, target devices whose users actually sign in. Intune installs the app on the next check-in.

Step 4 — Deliver the configuration

Installing the MSI does not bind the endpoint. Deliver the configuration with one of the two options below.

Option A — Registry policy (recommended). Write the values under HKLM\SOFTWARE\Policies\ZeusLock. You can create these with an Intune Settings-catalog / custom OMA-URI policy, or with a PowerShell platform script (Devices → Scripts and remediations) run in the system context:

$key = 'HKLM:\SOFTWARE\Policies\ZeusLock'
New-Item -Path $key -Force | Out-Null
New-ItemProperty -Path $key -Name ServerUrl  -Value 'https://api.zeuslock.ai' -PropertyType String -Force | Out-Null
New-ItemProperty -Path $key -Name LicenseKey -Value 'zl_xxxxxxxxxxxxxxxx'     -PropertyType String -Force | Out-Null
# Optional toggles
New-ItemProperty -Path $key -Name AgentEnabled    -Value 1 -PropertyType DWord -Force | Out-Null
New-ItemProperty -Path $key -Name BlockingEnabled -Value 1 -PropertyType DWord -Force | Out-Null

ServerUrl and LicenseKey are REG_SZ; AgentEnabled and BlockingEnabled are REG_DWORD set to 1.

Option B — ProgramData JSON. Deploy a JSON file to C:\ProgramData\ZeusLockDLP\config.json with a PowerShell platform script. It must be UTF-8 with no BOM:

$dir = 'C:\ProgramData\ZeusLockDLP'
New-Item -Path $dir -ItemType Directory -Force | Out-Null
$cfg = '{"ServerUrl":"https://api.zeuslock.ai","LicenseKey":"zl_xxxxxxxxxxxxxxxx"}'
$utf8NoBom = New-Object System.Text.UTF8Encoding($false)
[System.IO.File]::WriteAllText("$dir\config.json", $cfg, $utf8NoBom)

{
  "ServerUrl": "https://api.zeuslock.ai",
  "LicenseKey": "zl_xxxxxxxxxxxxxxxx"
}

Use the keys ServerUrl and LicenseKey exactly. In JSON files apiUrl and apiKey are accepted as legacy aliases, but prefer ServerUrl and LicenseKey. Never use api_url, api_key, or any monitor_* key — the agent ignores them.

Step 5 — Verify

On a target device, confirm the configuration and the install, then run a live test:

reg query "HKLM\SOFTWARE\Policies\ZeusLock"
Get-Package *Zeus*

1. Confirm ServerUrl and LicenseKey appear (or that config.json exists).
2. Confirm the ZeusLock tray app is running in the signed-in user's session.
3. Paste a test credit-card number into chatgpt.com and confirm an incident appears in the dashboard.

For the full step-by-step walkthrough with ready-made scripts and templates, see https://github.com/Zeuslock-ORG/zeuslock-agent-deployment.