Force Application Reinstall in Microsoft Intune (Win32 Apps)

During our Microsoft Intune trainings this year, one of the most frequently asked questions has been on how to force a reinstall / rerun / redeploy – whatever you like to call it – of an application deployed to Windows 10 or Windows 11 PCs. Well first of all, the correct Intune term is not deployed, it is assigned, since apparently using the same terminology across different systems management platforms developed by the same vendor is not on the table. Shorthand: Deployments in ConfigMgr are called Assignments in Intune.

Update January 1, 2026: Made same changes in the GRS logic due to changes in IME.

Scenario

The reasons for wanting to force an application reinstall, or rerunning a script can be many, but it is indeed quite useful during testing, especially larger scale testing of required assignments, or when trying out different detection rules for an app in Intune (the equivalent of detection methods in ConfigMgr).

Win32 Apps – Background Info

Most organizations I've worked with are configuring their Win32 apps install behavior to system, since it doesn't require the user to be an administrator during the installation of the application. In this example you will learn how to force the reinstall of a required application assignment to a device.

When a Win32 app is installed via Intune, it's installed via the Microsoft Intune Management Extension (IME) agent. IME keeps track of deployments in the following registry key:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IntuneManagementExtension\Win32Apps

Under the Win32Apps key, you find one sub key for each user, where the key name is the same as the user object id in Azure Ad. If you want to force a reinstall of all apps deployed, you can simply delete the user id key. But if you want to force a reinstall of a single app, you need to delete the app id as well as it's corresponding GRS (Global Retry Schedule key). Both located under the user key. Here is an example:

In the preceding images, the red rectangle is the user key, and the blue rectangle is one of the deployed apps. Based on this info, if I wanted to reinstall every single apps, I could run this PowerShell script which deletes all app IDs as well as the GRS keys:

# Delete all apps for a user
$Path = "HKLM:SOFTWARE\Microsoft\IntuneManagementExtension\Win32Apps"
$UserObjectID = "18ba2977-ea61-4547-8e8b-e9cbbced8719"
Get-Item -Path $Path\$UserObjectID | Remove-Item -Recurse -Force

More likely though, if I wanted to reinstall a single app, I would first delete the single application id instead, and then I would have to locate the right GRS key and delete that one. Previously the GRS key had to located by parsing the IME log file, but now the application is part of the GRS key which makes it easier. Below is sample script to do all of this:

# Sample to delete a single app
#
# Update January 1, 2026: Made more changes in the GRS logic. 
# Credit to David Bolding: https://therandomadmin.com/2025/01/01/force-intune-apps-to-redeploy/
$Path = "HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension\Win32Apps"
$AppID = "<Intune Application ID>"
 
# Purposely not skipping the 00000000-0000-0000-0000-000000000000 entry
# This is used when an app is device-assigned, or runs in system context
$Users = (Get-ChildItem -Path "$Path").name | Where-Object {($_ -like "*-*-*-*-*")}
 
foreach ($user in $Users) {
    $Name = $User -replace "HKEY_LOCAL_MACHINE","HKLM:"
    $UserID = $user.split("\")[-1]
    $Applications = Get-ChildItem -Path $Name | Where-Object {$_.name -like "*$($AppID)*"}
    foreach ($App in $Applications) {
        $AppName = $App -replace "HKEY_LOCAL_MACHINE","HKLM:"
        Write-Host "App found"
        remove-item -Path $AppName -Recurse -Verbose -force
    }
    $GRSPath = "HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension\Win32Apps\$UserID\GRS"
    $GRSes = Get-childitem -path $GRSPath
    foreach ($GRS in $GRSes) {
        $GRSProps = $GRS | Get-ItemProperty
        $Count = $GRSProps.psobject.Properties.count 
        if ($Count.count -gt 5) {
            $TotalKey = $GRSProps.psobject.Properties.name | where-object {$_ -like "*-*-*-*-*"}
            if ($TotalKey -like "*$($AppID)*") {
                Write-Host "GRS Entry found, path to remove $PathToRemove"
                $PathToRemove = $GRS.name -replace "HKEY_LOCAL_MACHINE","HKLM:"
                Remove-Item -Path $PathToRemove -Recurse -Force -Verbose
            }
        }
    }
}
Get-Service -DisplayName "Microsoft Intune Management Extension" | Restart-Service -Verbose

Note #1: Make sure you also uninstall the existing application or remove whatever the application detection rule is configured to look for. Sometimes an Intune policy sync is also required.

Note #2: When deleting a single application, you have to use a wildcard match, since the registry key actually contains the revision of the app as well.

As for finding the application id, you can see it in the browser address bar when viewing the application in Intune, or you can use the below PowerShell script. Just remove the trailing _1 from the app registry key when searching for a matching guid:

# Connect to Microsoft Graph 
# Requires the Microsoft.Graph.Intune module to be installed
Connect-MSGraph -ForceInteractive

# Get all Apps and their id
$Apps = Get-DeviceAppManagement_MobileApps 
$Apps | select displayName, id

# Get Apps, their size in MB, and their id. Filter on App Name
$Apps = Get-DeviceAppManagement_MobileApps -Filter "contains(displayName, '100 MB Single File')"
$Apps | select displayName, @{Label="Size in MB";Expression={[math]::Round(($_.size/1MB),2)}}, id