Back to Help Index

Managed Windows Endpoints And Intune

VersionGopher™ ships a managed Windows endpoint that runs the collector on a schedule, uploads results to your hosted instance, and appears in the fleet view. This guide is for the administrator deploying that endpoint through Microsoft Intune, or enrolling a machine directly from the configuration tray without Intune.

The endpoint scans and uploads software evidence. It does not install patches, remove software, quarantine devices, or change Windows settings. VersionGopher observes; it does not remediate.

What Gets Deployed

A release is an immutable, signed triple built together and verified as a set: the MSI installer, the Intune .intunewin package wrapped around it, and a release manifest recording the exact product, agent, and protocol versions plus the package SHA-256.

The endpoint service

A Windows service (LocalSystem) that runs the collector on a schedule, keeps a manifest-last outbox of results, and uploads them to your VersionGopher server with a verifying receipt.

The configuration tray

A status and configuration app for administrators. After an interactive install it lets an operator enroll the endpoint, review the managed server settings, and confirm the service is healthy.

The bootstrap token

A one-use vgb_ enrollment token, scoped to one organization and endpoint group, that ties a machine to your fleet. It is consumed at enrollment and should be revoked when onboarding is complete.

The release manifest

The record of exactly which signed bytes are approved for this release. Endpoints upgrade only through a newer signed MSI; changed bytes always require a version bump.

Deploying Through Intune

Generate the deployment in the admin fleet view, then create one Intune Win32 app and assign it to the device group that should run the endpoint.

In VersionGopher, open Admin → Fleet and create a deployment for the target organization and endpoint group. This produces the release .intunewin, the deployment JSON, and a bounded install command containing a one-use bootstrap token.
Download the release .intunewin and the deployment JSON from that screen. The generic package stays tenant-neutral; the install command carries the enrollment scope.
In the Microsoft Intune admin center, create a new Windows app (Win32) and upload the .intunewin.
Paste the exact install command from VersionGopher as the app's install command. Use the detection and requirement rules from the deployment JSON so Intune installs and reports status correctly.
Assign the app to the intended device group. Silent Intune installs are non-interactive; the endpoint registers to run at the next sign-in.
After onboarding is confirmed, revoke the bootstrap token in the fleet view. A one-use token that has enrolled its device no longer needs to exist.

Every changed release is a new signed package with a higher version. You cannot re-push modified bytes under the same version; build and sign a new release, then upgrade through it.

Enrolling Without Intune

A non-Intune administrator can enroll a machine directly from the elevated configuration tray, with no PowerShell required.

Install the MSI interactively; the tray launches after a successful install.
In the tray, enter your VersionGopher server URL and the one-use vgb_ bootstrap token. Pasted tokens are normalized, so surrounding whitespace or quotes from a copy are tolerated.
Choose Enroll. The tray stages the same machine registry values the MSI would, runs enrollment as LocalSystem, and starts the service under its normal identity.
On success the server settings display read-only. On failure the tray reports the reason and restores the previous state without leaving the machine half-enrolled.

Verifying The Endpoint And Fleet

On the device: the tray shows the managed server, the effective configuration, and a healthy service state. The endpoint service also reports its version.
In the fleet view: the endpoint appears with its hostname, last-seen time, reported state, and most recent scan. A machine that has scanned and uploaded moves to a current state.
In analytics: once two or more managed machines report, the Fleet Cohesion panel shows how aligned the fleet is, on a green-to-red gradient, and flags the machines that have drifted from the rest. See Software Genomics, Groups, And Drift for how cohesion and drift are measured.

Drift detection only applies to managed host-tracking endpoints. Uploaded or co-mingled offline scans are excluded, because a machine's software has to be compared with its own fleet, not with unrelated hosts.

Good Operating Practice

Treat bootstrap tokens as one-use secrets: assign, enroll, then revoke.
Keep every deployed release traceable to its signed manifest and SHA-256.
Roll out to a small pilot group first, confirm scans and uploads, then widen.
Deploy only newer signed versions; never re-use a version for changed bytes.