Deploying Team Viewer with Intune

The scenario: you have computers that are only bound to AzureAD and you need to deploy a customized version TeamViewer to those computers. Me too! Here’s what I did.

Create the Custom Module & Policies

Log into to www.teamviewer.com

On the left hand side of the screen, choose Design & Deploy

You’ll see two tabs: Custom Modules and Policies.

The Policies tab has the custom settings used by the client (such as whitelisting, auto-starting, and auto-adding to groups).

Each custom module can only use one “Policy,” but each policy can have all possible settings. If you need to create a new policy, use the “Add policy” button at the top of the screen.

To change a policy, click the edit button next to the one of the policies. (The “enforce” checkbox for each setting prevents the end-user from being able to change that setting). These policies are checked by the client during installation.

Once the policy is setup, go to the Custom Modules tab. Create a new module with the Add Custom Module button or click the edit button on a existing module.

Customize the look of the TeamViewer app however you’d like.

Make sure the TeamViewer policy selected is the correct one from the Policies tab and you’ve selected the group you would like the devices added to under the “Automatically add computers to a group in your Computers list.”


Copy the API token and the Configuration ID. You will need these when creating the app in Intune.

Click the “Download MSI” link as well. Without any options, this MSI will just do a basic TeamViewer Host installation. Only when passed your configuration ID and API token during installation will it give you the customized client and add itself to your TeamViewer groups.

Package the Installer

The MSI file will come in a zip file; unzip it. Inside you will find two more folders: Full and Host. Go into the Host folder and copy the TeamViewer_host.msi file into another folder. I named mine “teamviewer-host”. Make sure there is nothing else in that folder.

If you haven’t already, download a copy of the Microsoft Win32 Content Prep Tool from https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool

Open Windows Terminal or a command prompt and run:

IntuneWinAppUtil.exe -c <folder with the msi it in> -s TeamViewer_Host.msi -o <where you want the package file saved>

So for me, I had IntuneWinAppUtil.exe on the desktop and wanted the package file there as well, so I ran:

.\IntuneWinAppUtil.exe -c .\teamviewer-host\ -s TeamViewer_Host.msi -o .

Once you have done so, you will have a file called TeamViewer_Host.intunewin that can be uploaded to Intune.

Create & Deploy in Intune

Go to https://endpoint.microsoft.com

Choose Apps->All Apps

Click the Add Button

Choose the App Type “Windows app (Win32) then click Select at the bottom of the screen.

Choose the TeamViewer_Host.intunewin file you created (Firefox may have trouble doing the upload. If so, use another browser)

On the Program step change the install command from:

msiexec /i "TeamViewer_Host.msi" /q

To:

msiexec /i "TeamViewer_Host.msi" /qn CUSTOMCONFIGID=[configuration id] APITOKEN=[API Token] ASSIGNMENTOPTIONS="--grant-easy-access"

(Don’t include the brackets [ ])

Choose 64bit Windows 10 under the Requirements

Under Detection Rules choose “Manually configure detection rules”

Click + Add

Choose MSI for rule type. Intune will automatically enter the correct MSI Product code. Keep “MSI Product version check” as “no” so that the app won’t re-install if upgrades are done on the client side.

No Dependencies are needed.

Finally, assign it to whatever device groups you need. Devices in those groups will automatically download the TeamViewer Host app as well as place an icon called TeamViewer on the desktop.

That’s it! Your custom TeamViewer host should install on the selected devices and be ready for remote management.

18 thoughts on “Deploying Team Viewer with Intune”

  1. Hi, thank you for the good sum-up, but I have one question. Why did you turn the msi into an intunewin-package instead of installing teamviewer through the msi?

      1. Hi Holger. Like you, I was considering using the LoB Intune install with the .msi.

        You suggest that we shouldn’t do this and reference an MS article. I’ve read the article but can’t uncover the reason why I shouldn’t go that path.

        I would really appreciate if you would share your insight as to why the intunewin-package method should be used instead of the native LoB?

        1. Hi Donal! I’ve found (at least in the past) that Intune’s deployments can be a bit hit or miss when using an .msi by itself as an LOB app but extremely reliable after being packaged into an .intunewin file and deployed as a Win32 app.
          Hope that helps!
          -Adam

    1. Hi Drew! That’s an interesting question.
      I believe what you would do is include the .tvopt file in the folder with the TeamViewer MSI file. This way it’s included in the .intunewin package and copied to each computer.
      Since TeamViewer wants an absolute path to the .tvopt file I had to look up where Intune downloads intunewin files and extracts them. It should be C:\Program Files (x86)\Microsoft Intune Management Extension\Content . I haven’t been able to catch a glimpse of the folder fast enough to see exactly how the intunewin file is extracted there. Keep an eye on that folder when TeamViewer is installed by Intune (you may have to do some test installs) and see where the tvopt file is placed.
      Assuming it gets placed in the root of that folder, have your install command point to it like this:
      msiexec /i “TeamViewer_Host.msi” /q SETTINGSFILE=”C:\Program Files (x86)\Microsoft Intune Management Extension\Content\my_settingsfile.tvopt”
      I’d be interested to know if you discover the exact path. Good luck!
      -Adam

      1. Gotcha, thanks! Beginning tests now. So the Intune Content Prep tool will include the .tvopt file in the .intuenewin package as long as it is in the source folder? I don’t have to adjust or add any commands?

        1. You’re welcome! Anything else in the folder you specify with the -c option should be added to the intunewin file automatically. Let me know if that doesn’t seem to be the case.

  2. Hey great run through.
    Quick question – would we need to un-install the existing Teamviewer host before installing an updated one?
    if so, how? Our fleet has various differing versions of the host deployed.

    1. Daran,
      Glad you liked it!
      That isn’t a scenario I’ve run into before. I’d first try deploying to a test machine with an existing version. It may simply upgrade the installed version of TeamViewer to the correct one with your configuration settings.
      If that doesn’t work, you could assign a PowerShell script (Endpoint Manager->Devices->Scripts) that runs the uninstall commands for TeamViewer 14 and 15 (and whatever other versions you are running). Such as:

      msiexec /x “{39F32496-8A6D-4FCA-98E6-BEE046E8A33B}” /q
      msiexec /x “{08B0EDF5-A3C2-4B0E-BBCA-CA99C38D7B5A}” /q

      Once the script has been run on a computer (you can monitor this from the Device status tab on the script), you can add that computer to a group that TeamViewer is deployed to.
      Let me know how that works out for you.
      -Adam

  3. Hey Adam
    Great guide you have created.
    I’m currently trying to roll out Intune for a company I work for.
    I have a question though…

    How do I add the .tvopt TeamViewer config file to the .msi file?
    I’ve downloaded orca, as I needed it for deploying my antivirus software.

    I hope that you can help.

  4. I followed this step by step, but im still not seeing the device show up. Anytime i click view device install status nothing shows up. If i go into the device itself under Managed Apps it shows as “Waiting for install status”. With Application Created, Device Check and App Updated with green checkboxs. But the program isn’t on the computer. Is there a way to check where its erroring out?

  5. Really Clear and Interesting, it works for us.

    I would suggest to explain the API part, because it is not clear why it is required, and why whitout it, it just fail.

Leave a Reply to Jefferson DanielCancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.