From setup file to finished package. Without switching tools.
PSADT-Package Forge covers the entire chain: analyse the setup, build the package, edit the script, import into Intune, evaluate the log.
For Intune, ConfigMgr and Altiris. Import into Intune happens directly from the application.
One package. Five programs.
Orca for the MSI table, VS Code for the script, IntuneWinAppUtil on the command line, the Intune portal for detection rules and return codes, CMTrace for the log. In between: file paths, clipboard, window switching and retyped values. The mistake rarely happens inside a tool — it happens when switching between them.
- 1
Analyse
Software inventory, file and MSI information: vendor, version, product code and uninstall command are read out instead of retyped.
- 2
Package
Package Wizard for MSI, EXE, INF drivers, registry and fonts — with detection rules, return codes and minimum requirements.
- 3
Edit
MSI editor with transform support, PowerShell editor with IntelliSense for PSADT cmdlets, jump marks and wizards.
- 4
Deploy
Create the .intunewin file directly in the application and import it into Intune via the Graph API. ConfigMgr, Altiris and Matrix42 point directly to the package's "source" folder.
- 5
Verify
LogViewer in CMTrace format: phases in colour, errors and warnings counted, live monitoring during installation.
From package to Intune without opening the portal
The .intunewin package is created inside the application — without IntuneWinAppUtil on the command line. The same dialog defines display name, publisher, icon, install and uninstall command, return codes, operating system and hardware requirements, and the detection rules. PSADT-Package Forge then transfers the application to Intune via the Microsoft Graph API, including scope tags if required. The five common return codes are already preset. An MSI package of around 100 MB with default parameters is created as an Intune application in about two minutes and is ready for assignment in the Intune portal — provided the connection uploads the 100 MB in a good 30 seconds.
Edit MSI files without opening Orca
The MSI editor opens the database of an installation package and shows all tables — Property, Registry, Component, Feature, Directory, Shortcut, CustomAction and more. Records can be filtered, edited, added, removed, exported and imported; a quick validation checks for formal errors. Changes are highlighted in colour and counted. Instead of modifying the vendor package, an MST transform file is created. Existing MST files can also be loaded and applied to the open database.
An editor that knows PSADT
The editor opens Invoke-AppDeployToolkit.ps1 with syntax highlighting, code folding, minimap and IntelliSense for PSADT cmdlets. Jump marks lead straight to Pre-Installation, Installation, Post-Installation, Uninstallation and Repair. Wizards generate ready-to-use Start-ADTProcess and Start-ADTMsiProcess calls; Reg2Psadt converts .reg files into Set-ADTRegistryKey commands. Command and variable browsers look up PSADT functions, and the built-in comparison puts two script versions side by side.
The standard outlives the person who built it
Software packaging rarely fails because of individual packages — it fails because of a lack of consistency. The Definitive Media Library defines once how repositories are structured: %VENDOR%\%NAME%\%VERSION%\%ARCHITECTURE%\%LANGUAGE%\%REVISION%. Every new package automatically lands in the right place — the package sits in the "source" folder, which ConfigMgr, Altiris and Matrix42 point to directly; for Intune, the .intunewin package is created in addition. Default directories for applications, drivers, images, operating systems, patches, scripts, services and tools are created. In addition, the DBLAN Software Management Framework defines consistent names for packages, groups and roles. A package from last year therefore remains findable, traceable and easy to hand over.
€449 per year — per environment, not per seat.
Whether one person works with it or eight makes no difference to the price. Users, workstations and package repositories are unlimited. Other vendors charge per packager.
In use at
PSADT-Package Forge is in use in environments with high demands on auditability and traceability.
What the tool is allowed to do in your tenant — and who is behind it
PSADT-Package Forge is made by DBLAN, Damian Jan Brausch, Rheinfelden (Baden), Germany — reachable by phone and email. Address and phone number are listed in the legal notice.
For the Intune import, the app registration receives one Microsoft Graph permission: DeviceManagementApps.ReadWrite.All, as an application permission with admin consent. It is used exclusively for the import — creating the Win32 app and uploading the package content. Existing applications are neither changed nor deleted; assignment is done in the Intune portal. If you use scope tags, they are read via a separate user sign-in, read-only. The app registration is single-tenant and lives in your own tenant.
System requirements: Windows 11, x64, 8 GB RAM, 2 GB free disk space, .NET 10 Desktop Runtime. Licence and update services require access to https://*.psadt-packageforge.com — this one address belongs in your firewall allow list.
What has changed in which version is documented in full in the changelog.
Frequently asked questions
Is the price per user?
No. The licence applies per environment, i.e. per Intune tenant, ConfigMgr hierarchy or company. How many people in the company use it for packaging is irrelevant to the price. A team of four packagers pays the same as a single person: €449 per year. If you manage several environments of your own, you need a corresponding number of licences.
What can the free version do?
The Free version is permanently free with no time limit: create MSI packages, edit packages, create .intunewin files, open logs via the Log Explorer, take software inventory, one central package repository. Pro is required for EXE, drivers, registry and fonts, and for direct import into Intune. Every free order includes 30 days of Pro.
Does it work without Intune?
Yes. Every package sits in the package repository in a folder called "source". Configuration Manager, Altiris or Matrix42 point directly to this folder — an additional package, as with Intune, is not needed. The software package information provides all the values required for integration: commands, detection rules, return codes. Automatic import is currently available for Intune only, via the Graph API. For the other systems, integration is done manually.
Which rights does the tool get in the Intune tenant?
The app registration receives exactly one permission: DeviceManagementApps.ReadWrite.All as an application permission, granted by admin consent. Microsoft bundles reading, creating, changing and deleting Intune applications under this permission; PSADT-Package Forge uses only the import part — creating the application and uploading the package content. Nothing is changed, deleted or assigned; assignment to groups is done in the Intune portal. The app registration is created in your own tenant and is single-tenant. If you use scope tags, they are read via a separate user sign-in — delegated and read-only (DeviceManagementRBAC.Read.All).
Does the software run on Windows 10?
Windows 11, x64, with at least 8 GB RAM, 2 GB free disk space and the .NET 10 Desktop Runtime is supported and tested. The application usually runs on Windows 10 as well, provided the .NET 10 Desktop Runtime is installed — this is not guaranteed, and support cases are verified on Windows 11.
Where are the packages stored?
Wherever you specify — on a network drive, a share or locally. There is no cloud storage and no obligation to use a particular location. The Definitive Media Library lets you define a fixed folder structure so that every new package is automatically stored in the right place.
How does the tool sign in to Intune?
Via the Microsoft Authentication Library (MSAL) and the Microsoft identity platform. The app registration in your own tenant currently uses a client secret so that several systems can use the same registration. A switch to certificate-based authentication is planned. Only the optional reading of scope tags is delegated — via a user sign-in in the browser, read-only.
Does PSADT-Package Forge replace the PSAppDeployToolkit?
No, it builds on it. It produces regular PSADT packages with Invoke-AppDeployToolkit.ps1 — readable, versionable and editable even without this tool. There is no proprietary format and no dependency that would render an existing package archive unusable. PSAppDeployToolkit version 4 is supported.
The fastest way to form an opinion: package something yourself.
A free order is all it takes — it provides the download and a key that unlocks the full feature set for 30 days. After that, the Free version continues to run permanently at no cost — no payment details, no cancellation.