Deploying Blackoutly with Microsoft Intune

Deployment guide for organisation administrators · Blackoutly 0.0.10

Contents: What you need · 1. Network · 2. Add the app · 3. Import the ADMX template · 4. Configuration profile · 5. Licenses and activation · 6. Updating · 7. Checking a computer · 8. Application control · 9. Troubleshooting · 10. Uninstalling

What you need

Windows app (Win32) is the Intune app type (a classic Windows program), not its bitness. Blackoutly is a 64-bit program.

The package installs two programs: Blackoutly (redaction; Free, Pro or Enterprise depending on the license) and Blackoutly PDF Reader (free, view only). Both are installed by default (see NOREADER / NOBLACKOUTLY below).

Overview: (1) allow the network address, (2) add the app, (3) import the ADMX template once, (4) create a configuration profile with the license key and settings, and assign the app and the profile to the same group of computers. Each computer then activates itself once at its first start.

1. Network

A paid license is activated once per computer and then checks in once a week. Both are plain HTTPS calls from the program:

Allow console.blackoutly.com:443 in the firewall for the computers. If a computer has no direct internet access, activate it without internet — see 5.4.

The documents are processed only on the computer. No other network connections are made (no telemetry, no updates from the internet).

2. Add the app

Intune admin center → Apps → Windows → Create → App type: Windows app (Win32) → Select

2.1 App information

1. Select app package file: Blackoutly-<version>-x64.intunewin.
2. Fill in:

2.2 Program

Replace 0.0.10 with the version of your package. Installation properties (all optional):

NOREADER / NOBLACKOUTLY apply to a first installation; an upgrade keeps what is installed.

2.3 Requirements

2.4 Detection rules

Rules format: Manually configure detection rules → Add → Rule type: MSI. The MSI product code is filled in from the package. Leave MSI product version check at No.

Every Blackoutly version has its own product code (the upgrade code stays the same), so this rule detects exactly the version of this app entry.

2.5 Dependencies, supersedence, assignments

• Dependencies: none.
• Supersedence: none for the first version — see 6. Updating.
• Assignments:
  • Required — installed automatically, nothing for the user to do (recommended);
  • Available for enrolled devices — users install it themselves from Company Portal.

Assign it to the same device group as the configuration profile (section 4). Review + create.

The program is installed to C:\Program Files\Blackoutly with Blackoutly and Blackoutly PDF Reader in the Start menu. Both appear under Open with for .pdf, .jpg, .jpeg, .tif, .tiff but do not become the default program. Users do not need administrator rights to run it.

3. Import the ADMX template

Once per tenant (and again when a new template version brings new settings).

Devices → Manage devices → Configuration → Import ADMX → Import

1. ADMX file: Blackoutly.admx.
2. ADML file: en-US\Blackoutly.adml (the settings appear in English in Intune; lt-LT is for Group Policy).
3. Wait until the status is Available (a few minutes).

The template has no dependencies on other ADMX files.

To bring in a newer template, delete the profiles that use the old import, delete the import, and import the new files.

4. Configuration profile: license and settings

Devices → Manage devices → Configuration → Create → New policy → Platform: Windows 10 and later → Profile type: Templates → Imported Administrative templates (Preview) → Create

1. Name: e.g. Blackoutly — license and settings.

2. The settings are under Computer Configuration → Blackoutly (recommended: the whole computer) and also under User Configuration → Blackoutly. Computer settings win over user settings.

3. Required: General → License key → Enabled, and paste the key BLK1.… (the whole key, on one line). Without a valid, activated key the program runs as Blackoutly Free, and the other settings are ignored.

4. Optional settings:

5. Assignments: the same device group as the app.
6. Review + create.

The values are written to HKLM\Software\Policies\Blackoutly (user settings: HKCU\Software\Policies\Blackoutly). The program reads them when it starts; in its settings they are shown greyed out with a lock.

5. Licenses and activation

5.1 One key for the organisation

Blackoutly issues one key per edition for your organisation, with a number of computers (e.g. 50) and an end date. The same key goes into one configuration profile; Intune delivers it to every assigned computer. If you have both Pro and Enterprise, put each key into its own profile and assign the profiles to different device groups — a computer gets one key.

A key bought later (more computers, renewal) is a new key containing all your running purchases: replace the value of License key in the profile — nothing else changes.

5.2 Activation — automatic

Every computer activates itself once, at the first start of Blackoutly with the key (the program waits a few seconds for console.blackoutly.com). Afterwards it works offline for as long as the license runs.

• At most as many computers as the key is for. A computer already activated is not counted again — reinstalling Windows on it does not use another activation (the computer ID comes from the BIOS serial number). Each Windows user of the computer gets the activation at their own first start; the computer still counts once.

• Not activated (no connection, no free activation) → the program runs as Blackoutly Free and says why in Settings → License; it tries again at the next start, or the user presses Activate there.

• Weekly check-in: an activated computer reports once a week. Without a connection it simply tries again later — it never stops working because it is offline.

5.3 Freeing an activation (a replaced computer)

Your organisation's administrator signs in to Blackoutly Console (https://console.blackoutly.com/my, an invitation from Blackoutly) and presses Remove activation next to the computer. The activation is free for another computer at once. The removed computer learns it at its next weekly check-in and runs as Blackoutly Free from its next start; it does not activate itself again — a user must press Activate.

Computers are listed by computer ID (e.g. A1B2-C3D4-E5F6), never by name. The program shows it in Settings → License; "C:\Program Files\Blackoutly\BlackoutlyCli.exe" computer-id prints the full ID (it needs the license key on the computer).

Blackoutly Enterprise can also remove activations automatically from your own systems (for example when Intune retires a device) with the organisation API (https://api.blackoutly.com, see the API description).

5.4 Activating without internet

For computers that cannot reach console.blackoutly.com:

1. Intune → Devices → Windows → Export (or each device's Hardware page): the serial numbers of the computers.

2. Blackoutly Console → /my → Activate without internet: paste the serial numbers (or full computer IDs), one per line → download the activations file.

3. Deliver the file to every computer as C:\ProgramData\Blackoutly\activations.txt — each computer finds its own line. For example an Intune platform script (Devices → Scripts and remediations → Platform scripts → Add → Windows 10 and later; Run this script using the logged on credentials: No; Run script in 64 bit PowerShell Host: Yes):

       # Blackoutly: activations without internet (from Blackoutly Console → /my)
       $dir = Join-Path $env:ProgramData "Blackoutly"
       New-Item -ItemType Directory -Force -Path $dir | Out-Null
       @'
       PASTE THE CONTENT OF THE DOWNLOADED FILE HERE
       '@ | Set-Content -Path (Join-Path $dir "activations.txt") -Encoding ascii
   

   The lines are signed by Blackoutly and are useless on any other computer, so the file is not secret. The users can also import it themselves: Settings → License → Import activation….

Activations without internet count the same as online ones.

5.5 Renewal and reminders

Renewing = replacing License key in the profile with the new key (5.1). The computers get it at the next Intune sync (usually within hours; faster: Devices → the computer → Sync); the program reads it at its next start. No reinstallation and no new activation are needed. The program reminds users 30, 14, 7 and 2 days before the end; when a license ends, the program runs as Blackoutly Free — it never locks up. Security (real removal, cleaning, checking, audit) is the same in every edition.

6. Updating to a new version

1. Add the new .intunewin as a new Win32 app (section 2), e.g. Blackoutly 0.0.11, with the new file name in the install command.

2. Supersedence → Add → the previous Blackoutly app. Uninstall previous version: No — the MSI removes the older version itself.

3. Assign it to the same group.

Kept on update: the license and settings (they are in the policy), activation, the users' settings, the audit log and the program's language. An older version cannot be installed over a newer one.

7. Checking a computer

• The Start menu has Blackoutly and Blackoutly PDF Reader; the window title shows the edition and version (e.g. Blackoutly Pro 0.0.10).

• Settings → License: the organisation, the number of computers, the end date, the computer ID and the activation.

• The policy has arrived: reg query HKLM\Software\Policies\Blackoutly

• Self-test (PowerShell):

      $p = Start-Process "C:\Program Files\Blackoutly\Blackoutly.exe" -ArgumentList "--self-test" -Wait -PassThru
      "Exit code: $($p.ExitCode)"; Get-Content "$env:TEMP\Blackoutly-selftest.txt"
  

  The last line must be RESULT: OK (exit code 0).

8. Application control

The Blackoutly package is not signed with a public code-signing certificate.

• Smart App Control (Windows 11) turns itself off within 48 hours on Intune-managed computers, unless a user turned it on before. Check: reg query HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState (0 — off, 1 — enforcing, 2 — evaluation). An organisation's internal certificate does not help with Smart App Control.

• App Control for Business (WDAC): allow Blackoutly with Managed Installer — Endpoint security → App Control for Business → Managed installer: apps installed by the Intune Management Extension are trusted. Alternatives: hash rules (to be updated for each version) or signing with your internal code-signing certificate and a signer rule.

• AppLocker: a path rule for C:\Program Files\Blackoutly\* (only administrators can write there).

Signs that application control blocks the program: nothing happens when it is started, or a "blocked" message; events 3077, 3033 or 3118 in Microsoft-Windows-CodeIntegrity/Operational.

9. Troubleshooting

10. Uninstalling

Change the app's assignment to Uninstall (or msiexec /x {ProductCode} /qn). Free the computers' activations in Blackoutly Console if they will not be used again. Kept on the computer: the users' settings (%APPDATA%\Blackoutly), the audit log (%LOCALAPPDATA%\Blackoutly\logs) and C:\ProgramData\Blackoutly.

Blackoutly · © 2026 Valentinas Šarėjus · support: info@blackoutly.com