Managing Keys via InTune after Installation
After performing a cloud-based deployment via InTune, it may be necessary to mange the licenses separately from an installation. As in conventional Active Directory environments, a script can be pushed to call the XCVault.exe Licensing Utility that installs by default with all PDF-XChange products to C:\Program Files\Tracker Software\Vault
The XCVault.exe options are detailed here.
In this example the software was deployed with a key, after which a second key was added, after installation and via InTune, then "auto-activated" via a Group Policy.
To do this you need to run a script on the target machine. There are multiple ways to run scripts via InTune, but the simplest approach is to make a single-line PowerShell script:
& "c:\Program Files\Tracker Software\Vault\XCVault.exe" /AddKeyData "PEP90-OZTGG5oVnEA/Bro5Pin...The_Full_StringKey_Without_Any_White_Space...YOAlBncZTmOO8l3No2pZE8CFHqMPh3rHM=" /M
The & at the beginning is important as it tells Powershell to interpret what comes next as a command. It is also very important that there is no white space present in the key. Please take care when copying and pasting, as pasting the formatted version as copied from our website may result in the addition of line feed and carriage return characters. The entire string must display as a single line in Notepad when word wrapping is turned off, otherwise the key will fail.
/AddKeyData tells XCVault.exe to accept a string as an argument for the key, as opposed to a key file. It is possible to use /KeyFile instead, but then it would be necessary to make the KeyFile available, and that means either a Share or additional work in the script will be necessary to upload the key file to use. It is much simpler to use the full key string - but again, please be sure that no white space is present.
/M forces XCVault.exe to try and put the key in the HKLM registry in order to make the license available to all users on the device, which is a "per machine" license setup. In order for that to succeed the script must be allowed to run as a system account. This is the InTune default, which means that additional configuration should not be necessary.
Add the script it in the EndPoint Manager Admin Center in order to push it. Once it has been added it will be visible in Apps->Windows devices->Powershell scripts:
Follow the "Wizard":
The defaults work for a per machine license. If you instead want to do a per user license, then remove the /M from the script and change "Run this script using the logged on credentials" to "Yes" and the key will go into HKCU and be only for that user:
Select the appropriate users or groups to deploy to:
Then review and add the policy:
The process is then complete:
