Installation & first launch

Overview

Every TontonTools product is a single-file WPF application that runs on the administrator workstation. No agent runs on managed endpoints, no server component is installed in your environment, no Internet exposure is required beyond the standard Microsoft and licensing endpoints. This page covers the full lifecycle: installing a tool, completing the first-launch configuration, verifying connectivity, updating to newer versions, and uninstalling cleanly.

Because credentials and license state are stored in a per-user folder shared across the suite, installing one tool typically pays off for all subsequent tools the same operator uses. The first launch of the first tool does the heavy lifting; every subsequent tool inherits the credentials and may only ask for license activation.

System requirements

Installation methods

TontonTools products are delivered as single self-contained .exe files. There is no MSI installer, no companion runtime to install, no Windows service to register. The right deployment method depends on how many operators will use the suite and how your organization governs administrator tooling.

Method 1 — Manual download (single operator)

The simplest approach for evaluators, single-operator scenarios, and lab environments. Download the .exe from the post-purchase link delivered by Lemon Squeezy (or from the trial download link on the product page), place it anywhere the operator can run it from — typically C:\Tools\TontonTools\ or the operator's desktop — and double-click to launch. No installer wizard, no UAC prompt unless the destination folder requires elevation.

When updating to a new version, replace the .exe with the new one. Credentials and license state persist in %AppData%\TontonTools\ regardless of where the executable lives.

Method 2 — SCCM packaging (recommended for multi-operator teams)

For IT teams who want to deploy the suite to all operator workstations in a controlled manner — typical of mid-size and enterprise environments. Wrap each .exe in a standard SCCM Application or Package, target a User Collection or Device Collection covering the operator workstations, and let SCCM handle the deployment and updates.

A minimal SCCM Application can use this install command (assuming the .exe is named DeleteDeviceEverywhere.exe and lives at the content source root): cmd /c xcopy /Y "DeleteDeviceEverywhere.exe" "%ProgramFiles%\TontonTools\". Detection rule: file %ProgramFiles%\TontonTools\DeleteDeviceEverywhere.exe exists. No reboot required, no return code checks beyond standard MSI defaults.

Method 3 — Group Policy software installation

For environments without SCCM but with Active Directory, a Group Policy software installation can deploy the .exe to a curated set of operator workstations. The same caveat as SCCM applies: the .exe is the entire deliverable, no MSI wrapper is provided by TontonTools. If your organization mandates MSI for GPO deployment, repackage the .exe into an MSI with a tool like Advanced Installer or PSAppDeployToolkit.

Method 4 — Intune Win32 LOB deployment

For organizations that have migrated their endpoint management to Intune, the TontonTools .exe files can be packaged as Win32 LOB apps using the official IntuneWinAppUtil.exe and deployed to operator devices. The same TontonTools product SIM can be used internally to perform this packaging if SCCM is part of the migration — a pleasant self-referential use case.

First launch — configuration flow

On first launch of any TontonTools product, the application runs through a deliberate sequence of bootstrap steps. The order matters: license is resolved before credentials are requested (no point asking for sensitive credentials from a user who is not licensed to use the tool), and credentials are auto-detected before prompting (no point asking the operator for values the workstation already knows).

1. 1

   1. License check

   The license bootstrap runs first. If a valid license already exists in %AppData%\TontonTools\ from a previous run or a sibling tool, it is silently re-validated and the tool proceeds. If no license is found, a license dialog appears offering three options: start a 14-day trial (no credit card, no email required), activate with an order email and license key, or cancel. Trial mechanics, machine and tenant binding, and reactivation flows are documented in the Licensing reference.

2. 2

   2. License tier banner (Migrator only)

   For the SCCM to Intune App Migrator (SIM), once the license is resolved, a permanent banner at the top of the window shows the current tier with a distinctive colour code (Trial copper, Small/Medium green, Large premium violet). For the other nine products, no banner is displayed because there is only one tier of access per subscription.

3. 3

   3. Credentials auto-detection

   Before opening the credentials dialog, the tool attempts to silently auto-detect what it can. For SCCM-touching tools, a 4-method cascade tries the SCCM cache file %AppData%\TontonTools\sccm-cache.json (validated against WMI), then the local registry for an SCCM client install, then a direct WMI namespace probe at root\sms, then a check for an SCCM console install. If any method succeeds, the SCCM Server FQDN and Site Code are pre-filled in the credentials dialog. Auto-detection is best-effort — failure is silent and falls through to manual entry.

4. 4

   4. Credentials dialog

   The unified TontonTools credentials dialog appears, showing only the sections the tool actually needs (Graph, SCCM, AD). Fields are pre-filled from any previously-saved credentials and from auto-detection results. For Graph, three authentication modes are offered: Client Secret (fastest setup), Certificate (production-grade, JWT Client Assertion), or Interactive (uses the operator's own Entra ID identity, no app registration required for delegated permissions).

5. 5

   5. Tenant resolution + token cache

   On Save, Graph credentials are validated by acquiring a token against the tenant. The tenant display name and primary domain are fetched and shown in the header. The token is cached in the running session and reused by every tab and operation until the operator clicks the Credentials button to re-prompt.

6. 6

   6. Ready

   The status bar shows "Ready", the main window is enabled, and the operator can proceed with the tool's primary workflow. The exact next steps depend on the tool: SIM opens its 5-tab UI, DDE opens its 4-system deletion form, AUC opens its user-to-collection picker, and so on.

Credentials storage

Credentials are stored in a single DPAPI-encrypted file at %AppData%\TontonTools\credentials.dat. DPAPI (Data Protection API) is the Windows-native encryption mechanism that binds encrypted data to a specific user account on a specific machine. The file is unreadable by any other user on the same workstation — even a local administrator cannot decrypt it without impersonating the original user — and is unreadable on any other machine.

Network connectivity check

Each tool only needs the network destinations relevant to its function. The table below lists every outbound destination the suite as a whole can reach, with a note about which tool drives which connection. If your environment has a strict outbound firewall policy, use this table to whitelist what is actually required.

Three quick PowerShell checks cover the most common deployment scenarios:

Verifying the installation

A simple end-to-end smoke test that confirms the installation succeeded:

1. 1

   1. Launch the tool

   Double-click the .exe. The application window appears within 2-3 seconds. If a license dialog appears, the application has loaded successfully. If you see a Windows error about a missing .NET Framework, install .NET Framework 4.7.2 from Windows Settings → Apps → Optional Features.

2. 2

   2. Complete the license step

   Start the 14-day trial or activate with the order email and license key from the Lemon Squeezy delivery. The license dialog closes and the credentials dialog should appear (or skip directly to the main window if the credentials were already configured by a sibling tool).

3. 3

   3. Verify the credentials dialog auto-population

   For SCCM-touching tools on an SCCM-managed workstation, the SCCM Server and Site Code fields should already be pre-filled by auto-detection. If they are empty, click the "Auto-detect" button — the diagnostic log shows which detection method was tried and where it failed. Manual entry is always available as a fallback.

4. 4

   4. Complete the credentials and validate

   Fill in any missing fields, click Save. The tool validates the credentials by acquiring a Graph token (if Graph is configured) and by probing the SCCM SMS Provider (if SCCM is configured). On success, the dialog closes, the main window header shows the tenant name and SCCM site server, and the status bar reads "Ready".

5. 5

   5. Run a low-risk operation

   Before relying on the tool for production work, run one read-only operation to confirm end-to-end connectivity. For example, in DDE, open Preview Mode for a known-test device. In SIM, load the SCCM application list in the SCCM Source Browser tab. In ODM, list devices without selecting any for deletion. A successful read confirms credentials are correct and permissions are sufficient.

Updating to a new version

TontonTools does not include an auto-update mechanism. Updates are delivered as new .exe files via the Lemon Squeezy customer portal (your post-purchase email includes a permanent link). When a new version is released, the procedure is the same as the initial install — replace the existing .exe with the new one, no uninstall step required.

1. 1

   1. Download the new version

   From the Lemon Squeezy customer portal link in your post-purchase email, download the latest .exe. Subscription-based products grant unlimited updates during the active subscription window. The one-shot SIM Migrator license grants minor updates (patch + minor versions) for life; major version upgrades may require a re-purchase.

2. 2

   2. Close the running tool (if any)

   If the tool is currently running, close it. The .exe cannot be replaced while it is loaded into memory. Windows will return "File in use" if you try.

3. 3

   3. Replace the .exe

   Overwrite the existing .exe with the new one in whatever location you originally installed it (manual install: typically the operator's tools folder; SCCM: through the standard SCCM application update workflow; Intune: through the standard Intune app update workflow).

4. 4

   4. Launch and verify

   Double-click the new .exe. The license state and credentials persist in %AppData%\TontonTools\ — you should land directly on the main window without any re-prompt. Check the version number in the title bar or the "About" dialog to confirm the new version is running.

Uninstallation

Uninstalling a TontonTools product is symmetric with installing: delete the .exe. Because nothing was registered in Windows Add/Remove Programs, no entry exists to be removed there. Because nothing runs as a Windows service or scheduled task, nothing needs to be stopped first.

1. 1

   1. Delete the .exe

   Remove the .exe from wherever it was installed. For manual installs, the operator typically deletes it from their tools folder. For SCCM / Intune managed installs, use the standard uninstall workflow of the deployment platform.

2. 2

   2. (Optional) Clear shared state

   If you are uninstalling the LAST TontonTools product on this workstation for this user (no other tool from the suite remains), you can optionally delete the shared state folder %AppData%\TontonTools\ to remove credentials, the SCCM cache, the license state, and any history files (notably SIM's history.json). Skipping this step is safe — the folder is harmless and small. Deleting it ensures absolutely no remnant remains.

3. 3

   3. (Optional) Clear working directories

   Some tools use C:\TEMP\ for working files (notably SIM, which stages .intunewin packages there during migrations). These directories are normally cleaned up after each operation, but if you want to verify, inspect C:\TEMP\ and delete any TontonTools-related subfolders. Log files at C:\TEMP\<ToolName>.log can also be deleted at this stage.

For the full licensing model — trial mechanics, machine and tenant binding, moving a license between workstations, refunds — see the Licensing reference. For the SCCM permissions required by SCCM-touching tools, see the SCCM permissions reference. For the Active Directory permissions required by DDE, GPDEU, and GPUED, see the Active Directory permissions reference. For the Microsoft Graph permissions required by every cloud-touching tool, see the Microsoft Graph permissions reference. For the overall security and data-handling model, see Security & Data Handling.