Windows Desktop App: Enterprise Settings via Intune

Matt Sanz

Updated October 13, 2026 16:25

The Enterprise Settings file configures the Scribe desktop app on each Windows device. It controls how much of the app users see, whether the app stays running, and whether updates are managed by IT.

The file is also where silent authentication is enabled. For setup instructions, see Windows Desktop App - Silent Authentication with Microsoft Entra. If you use silent authentication, add its setting to the file described below and deliver the file once.

This guide assumes that the Scribe app is already deployed. See Windows Desktop App - Install via Intune.

The app reads the Enterprise Settings file when it launches. On a test device, relaunch the app after changing the file. For a broader rollout, deliver the file before the app so each user’s first launch uses the correct configuration.

The file

Deploy a file to this exact path on every device:

C:\ProgramData\Scribe\Enterprise Settings

The file must have no extension. A file named Enterprise Settings.txt is ignored without an error.

Windows Explorer may hide known file extensions. To verify the filename, run this command from Command Prompt:

dir "C:\ProgramData\Scribe"

Save the file as UTF-8 without a byte order mark (BOM). PowerShell’s Out-File command adds a BOM by default, so use the scripts below to create the file correctly.

A common Intune configuration for IT-managed updates, an always-running app, and a reduced interface is:

Is Central DeploymentYesKeep AliveYesVisibility ModeminimalPause Hours1, 24, 0

Available settings

Key	Values	Effect
`is_central_deployment`	Boolean	Tells the app that IT manages its version. The in-app update notice is not shown. Use this with Intune-managed updates, as described in Windows desktop app: Install via Intune.
`keep_alive`	Boolean	Registers a Windows scheduled task that relaunches Scribe if it is closed or crashes. Use this for always-on deployments.
`visibility_mode`	`normal`, `minimal`	`normal` displays the full app. `minimal` reduces the app to its tray icon and essential controls. The main window and manual capture remain available, but are less visible.
`pause_hours`	Array of hours, default `[1, 24, 0]`	Controls the pause options available from the tray icon menu. Each positive number adds a pause option for that number of hours. `0` adds a “turn off” option. An empty array removes the pause options.
`authentication_provider`	`entra`	Enables silent authentication with Microsoft Entra. See Windows Desktop App - Silent Authentication with Microsoft Entra for the required setup.

Invalid keys or values can disable a setting or the entire file without displaying an error. Validate the JSON before deploying it.

Deliver the file

The delivery method depends on your Windows licensing.

Remediations

Remediations are recommended because they regularly check that the file is present and correct. If the file is deleted or changed, the remediation restores it during the next scheduled run.

In Intune, go to Devices → Scripts and remediations → Remediations.

Remediations require one of the following licenses:

Windows 10 or Windows 11 Enterprise E3 or E5
Microsoft 365 F3, E3, or E5
Equivalent education licenses
Windows 365
Azure Virtual Desktop

Platform scripts

Platform scripts work with any Windows license. In Intune, go to Devices → Scripts and remediations → Platform scripts.

Configure the script to run in system context. Platform scripts run once per device. If the file is later deleted or changed, Intune does not automatically restore it. Syncing the device or uploading the script again does not cause it to run a second time.

PowerShell deployment script

The following script works as either a platform script or a remediation script:

$dir = 'C:\ProgramData\Scribe'
New-Item -ItemType Directory -Path $dir -Force | Out-Null

$json = '{"is_central_deployment": true, "keep_alive": true}'
$path = Join-Path $dir 'Enterprise Settings'

# Write UTF-8 without a byte order mark.
[System.IO.File]::WriteAllText(
    $path,
    $json,
    (New-Object System.Text.UTF8Encoding($false))
)

Edit the $json line to include the settings you want to deploy. Use the same JSON content in the detection script below.

Detection script for remediations

For a remediation, pair the deployment script with this detection script. It reports the device as non-compliant when the file is missing or its contents differ from the expected value.

$path = 'C:\ProgramData\Scribe\Enterprise Settings'
$expected = '{"is_central_deployment": true, "keep_alive": true}'

if (-not (Test-Path $path)) {
    exit 1
}

$actual = [System.IO.File]::ReadAllText($path)

if ($actual.Trim() -ne $expected) {
    exit 1
}

exit 0

Keep $expected identical to $json in the remediation script.

When uploading the scripts to Intune, remove the .txt suffix if the files were downloaded with one. For example:

Detect-EnterpriseSettings.ps1
Remediate-EnterpriseSettings.ps1

Verify on one device

Confirm that the file exists without an extension:
```
dir "C:\ProgramData\Scribe"
```
Confirm that the file contains the expected content:
```
type "C:\ProgramData\Scribe\Enterprise Settings"
```
Quit Scribe completely and relaunch it.

The settings are read when the app launches. Changes to the file do not take effect until Scribe is relaunched.

Troubleshooting

Problem	Possible cause	Solution
The app opens in normal mode even though the file exists.	The file is in the wrong location, has an extension, contains invalid JSON, or uses an invalid value.	Verify the path and filename from Command Prompt. Recreate the file as UTF-8 without a BOM and validate the JSON.
The file was changed, but nothing happened.	The app reads the file only when it launches.	Quit Scribe completely and relaunch it.
The file keeps disappearing or reverting.	The deployment method is not restoring changes.	Use a remediation if your Windows license supports it. Platform scripts run only once per device.