Intune-App-Sandbox is a testing utility for PowerShell-based installers packaged with the Win32 Content Prep Tool for Intune deployments. It creates a sandbox workspace (C:\SandboxEnvironment), and adds context-menu options to pack with IntunewinUtil or run tests in a Safe sandbox. It also supports a detection-based test flow and a reusable template script to accelerate building and validating packaging for Win32 apps in Intune.
Swipe to see more
10 files scanned on Sep 20, 2026
Overall assessment: The Intune-App-Sandbox tooling appears to be a packaging/testing harness for Windows Sandbox/Intune Win32 apps. While many patterns are legitimate for isolated testing (decoding installers, running in a sandbox, and exporting installation data), there are notable security concerns: apparent obfuscation in the module manifest, deliberate execution policy bypass, and scheduled-task-based SYSTEM execution to run decoded payloads. These patterns warrant strict input validation (trust boundaries for decoded packages), least-privilege usage, and thorough signing/auditing of all inputs to prevent abuse. No explicit hardcoded secrets or external credential handling were detected, but the payload decoding/execution flow represents a potential risk if untrusted packages are supplied.
WinTuner is a tool that lets you take any WinGet app and upload it to Intune in minutes. It automates downloading the installer and logo, generates the intunewin package, creates the required deployment script details, and publishes the app to Intune. It also ships a PowerShell module for automation and includes documentation to guide you through the process.
IntuneWinAppUtil GUI is a PowerShell-based WPF wrapper for Microsoft's IntuneWinAppUtil.exe. It streamlines packaging Win32 apps for Intune with auto-download of the latest tool, input validation, path-length checks, and configuration persistence across launches. It also detects PSAppDeployToolkit usage to suggest names and sanitizes invalid filename characters.
A PowerShell module for managing the complete lifecycle of Win32 applications in Microsoft Intune. Features 40+ functions for packaging, publishing, detection rules, requirement rules, assignments, dependencies, and supersedence with support for x64, x86, and ARM64 architectures.
win32-toolkit delivers end-to-end Intune Win32 packaging: point at a winget package or any installer, scaffold a PSAppDeployToolkit v4 project, and capture real installs in a disposable Windows Sandbox or Hyper-V VM. It derives detection and uninstall logic, validates install/update paths, packages a .intunewin, and publishes to Intune with dependencies, branding, and requirements.