Ever seen a black screen flash briefly before your eyes with the text “FATAL ERROR HAS OCCURRED” in bright red? Well, I have… Usually, the creation of a Win32 App (an .intunewin file) goes quite smoothly for me using the IntuneWinAppUtil.exe tool provided by Microsoft.

The process is straightforward: I open a command prompt, call the .exe, specify the source folder, setup file, and output folder, and then confirm that I don’t need a catalog folder. The IntuneWinAppUtil.exe does its magic and generates an .intunewin file in the output directory.

This week, however, I was creating files on a new system, and instead of providing me with a file, the tool started throwing errors:

File ‘C:\Intune\output\setup.intunewin’ has failed to be generated
FATAL ERROR HAS OCCURRED
Unexpected error occurred while creating package.

While the errors clearly stated that the app couldn’t generate the file, they didn’t specify why. Luckily, I still know a few tricks. Instead of going through the manual prompts, you can call the IntuneWinAppUtil with parameters and capture the output in a log file.

IntuneWinAppUtil.exe -c C:\Intune\source -s setup.exe -o C:\Intune\output -q > IntuneWinAppUtil.log

IntuneWinAppUtil.exe -c C:\Intune\source -s setup.exe -o C:\Intune\output -q > IntuneWinAppUtil.log

Once I hit “Enter,” the process still failed, but the output was captured in IntuneWinAppUtil.log.

Top-level exception details:
System.IO.IOException: The requested operation cannot be performed on a file with a user-mapped section open.

   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
   at Microsoft.Management.Service.IntuneWinAppUtil.EncryptUtil.CopyFileWithProgress(String sourceFile, String targetFile, AppContext context)
   at Microsoft.Management.Service.IntuneWinAppUtil.EncryptUtil.EncryptFile(String file, AppContext context)
   at Microsoft.Management.Service.IntuneWinAppUtil.PackageUtil.CreatePackage(String folder, String setupFile, String outputFolder, String catalogFolder)
   at Microsoft.Management.Service.IntuneWinAppUtil.Program.Main(String[] args)

Top-level exception details:
System.IO.IOException: The requested operation cannot be performed on a file with a user-mapped section open.

   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
   at Microsoft.Management.Service.IntuneWinAppUtil.EncryptUtil.CopyFileWithProgress(String sourceFile, String targetFile, AppContext context)
   at Microsoft.Management.Service.IntuneWinAppUtil.EncryptUtil.EncryptFile(String file, AppContext context)
   at Microsoft.Management.Service.IntuneWinAppUtil.PackageUtil.CreatePackage(String folder, String setupFile, String outputFolder, String catalogFolder)
   at Microsoft.Management.Service.IntuneWinAppUtil.Program.Main(String[] args)

The error in the log file made much more sense than the red text flashing before my eyes moments earlier:

System.IO.IOException: The requested operation cannot be performed on a file with a user-mapped section open.

This indicates that another process is using the file. Since I was using a new system, it quickly dawned on me who the likely culprit was: the Anti-Virus or EDR/XDR software. Typically, every file opened on a system is scanned for threats. If any are found, an incident is raised, and the file is quarantined or blocked. The files being processed by IntuneWinAppUtil.exe were being scanned as well; although no threats were found, the files were briefly locked. This lock prevented the utility from accessing them, resulting in the fatal error.

After adding the SHA256 hash of IntuneWinAppUtil.exe to the EDR software’s exceptions list, I was once again able to create .intunewin files without issue!