# Getting started with Windows app management

Windows app management is a critical component of IT administration that empowers administrators to secure, distribute, and control applications across a corporate fleet. Using Hexnode UEM, organizations can automate the lifecycle of applications—from silent installation to compliance monitoring—ensuring devices running Windows 10 and Windows 11 remain productive and secure.

Device Enrollment (Prerequisites) 
----------------------------------

Before initiating **Windows app management** workflows, the target endpoints must be [enrolled](https://www.hexnode.com/mobile-device-management/help/how-to-enroll-windows-laptops-in-hexnode-mdm/) with the UEM console.

- **OS Support**: Supports PCs and Tablets running Windows 10 or later.
- **Outcome**: Enrolled devices establish a communication channel allowing for remote app deployment and policy enforcement.

Application Installation and Deployment 
----------------------------------------

Hexnode UEM streamlines the distribution process, supporting both public store applications and proprietary in-house software.

### Store App Deployment 

Administrators can add applications directly from the Microsoft Store to the Hexnode App Inventory.

- **Distribution Method**: Apps can be deployed via immediate “Install Application” actions, policies or automations.
- [**Silent Installation**](https://www.hexnode.com/mobile-device-management/help/how-to-install-apps-in-windows-devices-using-hexnode-mdm/): On Windows 10 and Windows 11 devices, Store apps install **silently** in the background without requiring user intervention or administrative credentials on the device.

### Enterprise (In-House) App Deployment 

For proprietary software not hosted on public stores, Hexnode supports the [deployment of Enterprise apps](https://www.hexnode.com/mobile-device-management/help/distribute-enterprise-apps-msi-to-windows-10-devices/) (MSI, EXE, MSIX).

- **Deployment**: Upload the app package to the Hexnode inventory.
- **Silent Execution**: Like Store apps, Enterprise apps can be deployed silently, ensuring critical internal tools are available immediately upon provisioning.

App Security and Compliance (Blocklist & Allowlist) 
--------------------------------------------------------

Securing the app ecosystem involves controlling which executables are permitted to run.

- **Blocklisting**: Defines a set of prohibited applications. If a user installs a blocklisted app, the system can either [block the application](https://www.hexnode.com/mobile-device-management/help/how-to-blacklist-whitelist-apps-on-windows-devices-using-hexnode-mdm/) or [flag the device ](https://www.hexnode.com/mobile-device-management/help/configure-application-compliance-for-windows-devices/)for non-compliance.”
- **Allowlisting**: Defines a strict list of “safe” applications. 
    - **Strict Enforcement**: When Allowlisting is active, all applications not on the list are automatically treated as blocklisted.
- **Compliance Monitoring**: Hexnode UEM continuously scans devices. If a blocklisted app (or a non-allowlisted app) is detected, the device is marked as **Non-Compliant**, triggering automated alerts or remediation actions.

Automated Enforcement (Required Apps) 
--------------------------------------

To ensure baseline productivity, administrators can enforce mandatory app installations.

- [**Required Apps**](https://www.hexnode.com/mobile-device-management/help/how-to-enforce-app-installation-on-windows-devices-using-hexnode-mdm/): Automatically installs a defined set of essential applications to the device. If an app is missing, the system attempts to reinstall it, ensuring the device always meets the organizational standard.

Troubleshooting Windows App Management 
---------------------------------------

This section outlines common deployment failures and their resolutions, structured by symptom and context.

Symptom / ErrorContext & Probable CauseResolution Feature / Step**Silent Install Failed (Store App)**The device may not be connected to the internet, or the Microsoft Store service is disabled.**Check Network**: Ensure the device can reach Microsoft Store endpoints. Verify that the “Microsoft Store” service is not blocked by other policies.**Enterprise App Installation Error**The app package (MSI/EXE) is corrupted or lacks silent install arguments.**Verify Package**: Check the integrity of the uploaded file. Ensure the correct silent installation parameters (e.g., /qn, /quiet) are configured in the Hexnode portal.**Device Marked “Non-Compliant” Incorrectly**A delay in synchronization between the device and the console after an app was removed.**Force Sync**: Initiate a “Scan Device” action from the Hexnode console to update the app list and clear the non-compliance flag.**App Stuck in “Pending Install”**The device is in “Battery Saver” mode or pending a reboot.**Check Device State**: Windows often pauses background installations to save power. Connect the device to power or reboot the endpoint.