Technical · Course T4Lesson 2 of 3
Bulk installers — EXE, PPKG, ZIP
8 min read- Choose between EXE, PPKG, and ZIP for a given deployment
- Apply a provisioning package during OOBE and on existing devices
- Avoid the classic PPKG-on-USB mistakes
Three downloadable installers live under Bulk Enrollment Installers on the same Code Base Enrollment tab. Same outcome — agent installed, device enrolled — different delivery mechanics:
| Format | Best for |
|---|---|
| EXE | The default — standard installer, run per device, auto-enrolls |
| PPKG | Provisioning workflows — applied during OOBE or double-clicked later |
| ZIP | Environments that block direct .exe downloads — extract and run |
One operational note: after your first URL generation, the packages take a few minutes to build — the page shows a countdown if you're too quick.
The EXE path
Distribute the .exe however the customer moves files — USB, network share, deployment
tooling — then run as administrator on each machine. The wizard installs the
WeGuard agent, the device registers itself, and it shows in Devices within minutes.
Local admin rights are the one prerequisite worth flagging to customers with
locked-down images.
The PPKG path
The provisioning package is the scale play — Windows' native provisioning format, applied two ways:
During OOBE (the near-zero-touch experience): put the .ppkg at the root of a
USB drive and insert it before the network setup screen during initial Windows
setup. Windows detects and applies it automatically — the machine arrives at the
desktop enrolled. Both details matter: root of the drive, in before the network screen.
Miss either and OOBE sails past without applying anything.
On a running device: double-click the .ppkg and confirm Yes, add it.
Enrollment follows automatically.
PPKG is also the format that slots into Autopilot-style provisioning workflows — if the customer already images or provisions machines centrally, this is the artifact their process consumes.
Choosing quickly
Five machines in an office → EXE. A hundred laptops staged by IT before handout → PPKG during OOBE. A security-conscious org that strips executables from downloads → ZIP. Remote self-service worker → previous lesson's URL. Every Windows scoping call resolves to one of those four sentences.