How to Install and Configure Chocolatey Package Manager with Microsoft Intune

First, you need to download the Microsoft Win32 Content Prep Tool and create your working directory structure.

Create a new folder on your local machine for this project:

New-Item -ItemType Directory -Path "C:\IntuneApps\Chocolatey" -Force
Set-Location "C:\IntuneApps\Chocolatey"

Download the IntuneWinAppUtil.exe from the Microsoft Download Center and place it in your working directory. You can also download it directly using PowerShell:

Invoke-WebRequest -Uri "https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool/raw/master/IntuneWinAppUtil.exe" -OutFile "IntuneWinAppUtil.exe"

Create the PowerShell script that will install Chocolatey on target devices. This script handles the complete installation process including security protocols and execution policies.

Create a new file called install.ps1 in your Chocolatey folder:

# Chocolatey Installation Script for Intune Deployment
# Set execution policy for this process
Set-ExecutionPolicy Bypass -Scope Process -Force

# Enable TLS 1.2 for secure downloads
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072

# Download and execute Chocolatey installation script
try {
    Write-Output "Starting Chocolatey installation..."
    iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
    Write-Output "Chocolatey installation completed successfully"
    
    # Verify installation
    $chocoPath = "$env:ProgramData\chocolatey\choco.exe"
    if (Test-Path $chocoPath) {
        Write-Output "Chocolatey installed at: $chocoPath"
        & $chocoPath --version
    } else {
        throw "Chocolatey installation failed - executable not found"
    }
} catch {
    Write-Error "Chocolatey installation failed: $($_.Exception.Message)"
    exit 1
}

Create an uninstall script called uninstall.ps1:

# Chocolatey Uninstallation Script
try {
    if (Test-Path "$env:ProgramData\chocolatey") {
        Write-Output "Removing Chocolatey..."
        Remove-Item "$env:ProgramData\chocolatey" -Recurse -Force
        Write-Output "Chocolatey removed successfully"
    } else {
        Write-Output "Chocolatey not found - nothing to uninstall"
    }
} catch {
    Write-Error "Uninstallation failed: $($_.Exception.Message)"
    exit 1
}

Now you'll convert your PowerShell scripts into an Intune-compatible .intunewin package using the Microsoft Win32 Content Prep Tool.

Run the IntuneWinAppUtil command to create the package:

IntuneWinAppUtil.exe -c "C:\IntuneApps\Chocolatey" -s "install.ps1" -o "C:\IntuneApps\Output" -q

The parameters explained:

• -c: Source folder containing your installation files
• -s: Setup file (your install.ps1 script)
• -o: Output directory for the .intunewin file
• -q: Quiet mode (suppresses prompts)

The tool will create a file called install.intunewin in your output directory. This contains your PowerShell script and metadata needed by Intune.

Get-ChildItem "C:\IntuneApps\Output" -Filter "*.intunewin"

Access the Microsoft Intune admin center and create a new Win32 app entry for your Chocolatey package.

Navigate to Apps > All apps > Add and select Windows app (Win32) from the dropdown.

In the App package file section, click Select app package file and upload your install.intunewin file. Intune will automatically extract metadata from the package.

Configure the app information:

• Name: Chocolatey Package Manager
• Description: Chocolatey is a package manager for Windows that simplifies software installation and management
• Publisher: Chocolatey Software
• Category: Developer tools
• Information URL: https://chocolatey.org
• Privacy URL: https://chocolatey.org/privacy

For the app icon, you can download the official Chocolatey logo from their website or use this PowerShell command to download it:

Invoke-WebRequest -Uri "https://chocolatey.org/content/images/logo_square.svg" -OutFile "chocolatey-icon.svg"

Set up the commands that Intune will use to install and uninstall Chocolatey on target devices.

In the Program section of your app configuration:

Install command:

powershell.exe -executionpolicy bypass -windowstyle hidden -file install.ps1

Uninstall command:

powershell.exe -executionpolicy bypass -windowstyle hidden -file uninstall.ps1

Configure the installation behavior:

• Device restart behavior: No specific action
• Install behavior: System
• Return codes: Keep the default success (0) and reboot (3010) codes

Set the requirements:

• Operating system architecture: x64
• Minimum operating system: Windows 10 1607
• Disk space required: 100 MB
• Physical memory required: 1 GB

Configure detection rules that tell Intune how to verify whether Chocolatey is successfully installed on a device.

In the Detection rules section, click Add and select File as the rule type.

Configure the file detection rule:

• Path: C:\ProgramData\chocolatey
• File or folder: choco.exe
• Detection method: File or folder exists
• Associated with a 32-bit app on 64-bit clients: No

For more robust detection, you can add a second rule using PowerShell script detection. Create a detection script:

# Chocolatey Detection Script
$chocoPath = "$env:ProgramData\chocolatey\choco.exe"

if (Test-Path $chocoPath) {
    try {
        $version = & $chocoPath --version --limit-output
        if ($version -match "^\d+\.\d+\.\d+") {
            Write-Output "Chocolatey version $version detected"
            exit 0
        }
    } catch {
        Write-Output "Chocolatey executable found but not functional"
        exit 1
    }
} else {
    Write-Output "Chocolatey not detected"
    exit 1
}

If using the PowerShell detection method:

• Script type: PowerShell
• Run script as 32-bit process: No
• Run this script using the logged on credentials: No

Set up any dependencies that Chocolatey requires and configure supersedence relationships if you're updating from a previous version.

For Chocolatey, the main dependency is ensuring PowerShell 5.1 or higher is installed. Since this is included in Windows 10/11 by default, you typically don't need additional dependencies.

If you have an existing Chocolatey deployment, configure supersedence:

• Click Add in the Supersedence section
• Select your previous Chocolatey app
• Choose Uninstall to remove the old version before installing the new one

For organizations that want to ensure specific PowerShell modules are available, you can create a dependency script:

# PowerShell Prerequisites Check
$psVersion = $PSVersionTable.PSVersion.Major
if ($psVersion -lt 5) {
    Write-Error "PowerShell 5.1 or higher required. Current version: $psVersion"
    exit 1
}

# Check if execution policy allows script execution
$executionPolicy = Get-ExecutionPolicy
if ($executionPolicy -eq "Restricted") {
    Write-Output "Execution policy is Restricted - will be bypassed during installation"
}

Write-Output "Prerequisites check passed"
exit 0

Configure which devices or users will receive the Chocolatey installation by setting up assignments.

In the Assignments section, click Add group to create assignment rules.

Configure assignment settings:

• Assignment type: Required (for automatic installation) or Available (for self-service)
• Included groups: Select your target device groups or user groups
• Excluded groups: Optionally exclude specific groups (like test devices)

Set the assignment schedule:

{
  "startDateTime": "2026-03-26T09:00:00Z",
  "useLocalTime": true,
  "deadlineDateTime": "2026-03-27T17:00:00Z",
  "restartSettings": {
    "restartNotificationSnoozeDurationInMinutes": 60,
    "restartCountDownDisplayDurationInMinutes": 15
  }
}

For pilot deployments, start with a small test group:

1. Create a test group with 5-10 devices
2. Assign the app as "Required" to this group
3. Monitor deployment success before expanding

Configure notification settings if you want users to be informed about the installation:

• Show all toast notifications: Yes
• Show restart dialog: Yes (if restart required)
• Allow user to restart: Yes

Monitor the deployment progress and resolve any installation issues that arise during the rollout.

Navigate to Apps > All apps > Chocolatey Package Manager > Device install status to view real-time deployment status.

Common status indicators:

• Installed: Successful deployment
• Failed: Installation encountered an error
• Pending: Waiting for device check-in or user action
• Not applicable: Device doesn't meet requirements

For failed installations, check the device logs. On the target device, run:

# Check Intune Management Extension logs
Get-WinEvent -LogName "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational" | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-2)} | Format-Table TimeCreated, LevelDisplayName, Message -Wrap

Common troubleshooting steps:

1. Execution Policy Issues: Ensure the install command includes -executionpolicy bypass
2. Network Connectivity: Verify devices can reach chocolatey.org
3. Permissions: Confirm the app is set to install in System context
4. Detection Rule Failures: Test detection logic manually on affected devices

Create a troubleshooting script for quick diagnosis:

# Chocolatey Deployment Troubleshooting Script
Write-Output "=== Chocolatey Deployment Diagnostics ==="

# Check if Chocolatey is installed
$chocoPath = "$env:ProgramData\chocolatey\choco.exe"
if (Test-Path $chocoPath) {
    Write-Output "✓ Chocolatey executable found at: $chocoPath"
    try {
        $version = & $chocoPath --version
        Write-Output "✓ Chocolatey version: $version"
    } catch {
        Write-Output "✗ Chocolatey executable not functional: $($_.Exception.Message)"
    }
} else {
    Write-Output "✗ Chocolatey not found at expected location"
}

# Check PowerShell version
Write-Output "PowerShell version: $($PSVersionTable.PSVersion)"

# Check execution policy
Write-Output "Execution policy: $(Get-ExecutionPolicy)"

# Check internet connectivity
try {
    $response = Invoke-WebRequest -Uri "https://chocolatey.org" -UseBasicParsing -TimeoutSec 10
    Write-Output "✓ Internet connectivity to chocolatey.org: OK"
} catch {
    Write-Output "✗ Internet connectivity issue: $($_.Exception.Message)"
}

Write-Output "=== End Diagnostics ==="

Set up automated maintenance tasks to keep Chocolatey updated and ensure optimal performance across your device fleet.

Create a scheduled task script for automatic Chocolatey updates:

# Chocolatey Auto-Update Script
# Save as: ChocolateyMaintenance.ps1

Start-Transcript -Path "$env:ProgramData\chocolatey\logs\maintenance.log" -Append

try {
    Write-Output "Starting Chocolatey maintenance - $(Get-Date)"
    
    # Update Chocolatey itself
    Write-Output "Updating Chocolatey..."
    & choco upgrade chocolatey -y
    
    # Update all installed packages
    Write-Output "Updating all packages..."
    & choco upgrade all -y
    
    # Clean up temporary files
    Write-Output "Cleaning temporary files..."
    & choco cache clean
    
    Write-Output "Maintenance completed successfully - $(Get-Date)"
} catch {
    Write-Error "Maintenance failed: $($_.Exception.Message)"
} finally {
    Stop-Transcript
}

Deploy this maintenance script as another Win32 app with these settings:

• Install command: powershell.exe -executionpolicy bypass -file ChocolateyMaintenance.ps1
• Detection rule: Script-based detection checking last run timestamp
• Assignment: Required, recurring every 7 days

Create a detection script for the maintenance task:

# Maintenance Detection Script
$logPath = "$env:ProgramData\chocolatey\logs\maintenance.log"
$maxAge = (Get-Date).AddDays(-7)

if (Test-Path $logPath) {
    $lastWrite = (Get-Item $logPath).LastWriteTime
    if ($lastWrite -gt $maxAge) {
        Write-Output "Maintenance completed within 7 days"
        exit 0
    }
}

Write-Output "Maintenance required"
exit 1

Configure Chocolatey global settings for enterprise use:

# Enterprise Configuration Script
choco config set cacheLocation "$env:ProgramData\chocolatey\cache"
choco config set commandExecutionTimeoutSeconds 14400
choco config set containsLegacyPackageInstalls true
choco config set maxDownloadRateBitsPerSecond 10485760
choco feature enable -n allowGlobalConfirmation
choco feature enable -n logEnvironmentValues
choco feature disable -n showNonElevatedWarnings

Set up monitoring for the maintenance tasks by creating a simple reporting script:

# Maintenance Reporting Script
$devices = Get-Content "devices.txt"  # List of device names
$report = @()

foreach ($device in $devices) {
    try {
        $logPath = "\\$device\c$\ProgramData\chocolatey\logs\maintenance.log"
        if (Test-Path $logPath) {
            $lastRun = (Get-Item $logPath).LastWriteTime
            $status = if ($lastRun -gt (Get-Date).AddDays(-7)) { "OK" } else { "Overdue" }
        } else {
            $status = "No Log"
            $lastRun = "Never"
        }
        
        $report += [PSCustomObject]@{
            Device = $device
            LastMaintenance = $lastRun
            Status = $status
        }
    } catch {
        $report += [PSCustomObject]@{
            Device = $device
            LastMaintenance = "Error"
            Status = "Unreachable"
        }
    }
}

$report | Export-Csv "ChocolateyMaintenanceReport.csv" -NoTypeInformation
$report | Format-Table -AutoSize