> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Install Windows Clients

> Install the Syteca Windows Client using any of seven supported methods: remote installation via the Management Tool, remote via PsExec, Group Policy MSI deployment, third-party deployment tools, local install with a custom installation package, local install without an INI file, or Amazon WorkSpaces bundle deployment.

## Choose the right installation method for your environment

Syteca supports multiple Windows Client installation methods to fit different deployment realities. Remote installation via the Management Tool is the fastest way to deploy across a domain-joined estate; local installation with an installation package covers workgroup computers and machines with heterogeneous administrator credentials; Group Policy and third-party tools cover organizations already using centralized deployment infrastructure; specialized methods cover virtual desktop infrastructure and cloud workspaces.

<Info>
  **Method selection guide:**

  1. **All target computers in a domain, same admin credentials.** Use [remote installation via the Management Tool](#remote-installation-via-the-management-tool). Fastest and simplest.
  2. **Workgroup computers, different admin credentials per machine.** Use [local installation with the installation package](#local-installation-using-the-installation-package).
  3. **Domain with existing Group Policy deployment infrastructure.** Use [Group Policy MSI deployment](#group-policy-installation-using-an-msi-file).
  4. **Existing centralized deployment tool** (System Center Configuration Manager, Active Directory scripts, etc.). Use [third-party software deployment](#third-party-software-deployment).
  5. **Ad-hoc installation on a single machine or small cluster.** Use [PsExec remote deployment](#remote-installation-using-psexec).
  6. **Amazon WorkSpaces desktop-as-a-service.** Use [the Amazon WorkSpaces bundle procedure](#amazon-workspaces-bundle-deployment).
  7. **Default settings, no INI file needed.** Use [local installation without an INI file](#local-installation-without-an-ini-file).
</Info>

<Warning>
  **SaaS constraint.** In Syteca SaaS deployments, the Windows Client can be installed locally and remotely using different third-party tools (GPO, Intune). Remote installation via the Management Tool is not available. Additionally, SaaS uses `SytecaClient.msi` instead of `SytecaClient.exe` in the procedures below.
</Warning>

## Prerequisites

Before starting a Windows Client installation:

1. Verify the target computer meets [Windows Client system requirements](/docs/get-started/system-requirements).
2. For remote installation, verify the [Windows Client Installation Prerequisites](/docs/administration/clients/windows-install-prerequisites) (Server and RPC services, shared folders, firewall).
3. Download the appropriate installation artifact from the Management Tool. The exact file depends on the method (see each method's section below).

## Remote installation via the Management Tool

Remote installation via the Management Tool is the intended method during system deployment. It scales cleanly across a domain-joined estate where all target computers share the same domain administrator credentials.

<Warning>
  **NOT AVAILABLE IN SAAS.**
</Warning>

<Note>
  The Management Tool user performing the remote installation must hold the [administrative Client Installation and Management permission](/docs/administration/users/administrative-permissions).
</Note>

### Two-step process

The remote installation happens in two stages: selecting the target computers, then defining the installation parameters. Both are done from the Management Tool.

<Steps>
  <Step title="Select target computers">
    Navigate to the **Computers without Clients** page in the Management Tool — it also lists any computers where a previous installation attempt failed.

    Choose how to find computers:

    * **Deploy via IP Range** — scan a range of IPv4 or IPv6 addresses.
    * **Deploy on Specific Computers** — enter computer names or IP addresses directly.

    <Tabs>
      <Tab title="Deploy via IP Range">
        <Steps>
          <Step title="Start a search">
            In the **Choose Search Results** pop-up, click **Start New Search** (or **Previous Search Results** to reuse an earlier scan, if available).
          </Step>

          <Step title="Enter the IP range">
            On the **IP Range Scan** page, enter the range in **From address** and **To address** — use the same address in both fields to scan a single computer. Click **Scan**.
          </Step>
        </Steps>
      </Tab>

      <Tab title="Deploy on Specific Computers">
        <Steps>
          <Step title="Enter the computer name or IP address">
            On the **Adding Computers** page, enter the full name or full IP address of the target computer in the **Name** field. Click **Scan**.
          </Step>
        </Steps>
      </Tab>
    </Tabs>

    Scanning runs automatically and the results list updates as computers are found — click **Refresh** if it stalls, or **Stop** to cancel. Once scanning finishes, select the checkboxes next to the computers to install on, then click **Next**.

    <Note>
      If a computer's hostname doesn't appear next to its IP address (common in High Availability clusters), enable the **Network Discovery (NB-Name-In)** inbound firewall rule for the Domain profile on that computer.
    </Note>

    Selected computers are added to the **Computers without Clients** list. Remove any with the **Remove from list** icon, or **Remove All** in the column header.
  </Step>

  <Step title="Start the installation">
    At the bottom of the **Computers without Clients** page, click **Install**.
  </Step>

  <Step title="Enter Client Configuration">
    On the **Client Configuration** page, enter the **Server name / IP address** of the Application Server the Windows Clients will connect to. Multiple names and IP addresses can be entered, separated by commas or semicolons. Define the [Client configuration](/docs/administration/clients/parameters/client-description) values, then click **Install**.

    <Warning>
      The Application Server IP address must be **static** for Clients to reach it. For cloud-based Application Servers, use unique external IP addresses.
    </Warning>
  </Step>

  <Step title="Enter installation credentials">
    On the **Installation Credentials** page, enter the credentials of a user with administrator permissions on the target computers.

    | Environment                 | User type                    | Domain field      |
    | --------------------------- | ---------------------------- | ----------------- |
    | **Domain-joined computers** | Domain administrator account | Domain name       |
    | **Workgroup computers**     | Local administrator account  | Enter `workgroup` |

    Click **Next** to continue.

    <Note>
      If the **Domain** field is left empty, the credentials entered are treated as local user credentials. The Client will be installed under `<target_PC_name>\<user_name>`.
    </Note>

    <Warning>
      If workgroup computers do not share the same administrator account credentials, remote installation cannot proceed. Use the [local installation using the installation package](#local-installation-using-the-installation-package) method instead.
    </Warning>
  </Step>

  <Step title="Monitor installation progress">
    Progress appears on the **Client Installation** page. If the progress does not refresh automatically, click the **Refresh** button to update.
  </Step>

  <Step title="Handle failed installations">
    If installation fails on any Client, **Failed** appears in the **Status** column along with the failure reason in the **Details** column. Click **Retry (Failed Clients)** to attempt reinstallation on those Clients.

    <Note>
      If the connection with the Application Server fails during the install, the Client will not be installed.
    </Note>
  </Step>

  <Step title="Confirm completion">
    When installation finishes, **Finished** appears in the **Status** column. The installed Clients then appear on the **Clients** page and in the **All Clients** group on the **Client Groups** tab.
  </Step>
</Steps>

## Remote installation using PsExec

PsExec is a Microsoft Sysinternals tool that runs commands on remote Windows machines from the command line. It is a common alternative when the Management Tool remote install cannot be used (for example, in networks with strict administrative boundaries where per-machine execution is preferred).

<Steps>
  <Step title="Get PsTools and the Client installer">
    Download the **PsTools** package from Microsoft Sysinternals and unpack it. Then [download the Client installation file](/docs/administration/clients/install-windows#prerequisites) from the Management Tool.
  </Step>

  <Step title="Place both in the same folder">
    Copy `PsExec.exe` and `SytecaClient.exe` to the same folder.
  </Step>

  <Step title="Open an administrator command prompt">
    Run `cmd.exe` as administrator, then change directory to the folder with the installer and PsExec:

    ```powershell theme={"system"}
    cd <Path_to_folder>
    ```
  </Step>

  <Step title="Run the PsExec install command">
    Enter the following command:

    ```powershell theme={"system"}
    psexec.exe -i\\<Target_PC_IP_address> -u <User_name> -p <Password> -c -f <Path_to_the_SytecaClient.exe> /ServerName=<Server_name_or_IP_address>
    ```

    The parameters mean:

    | Parameter                                 | Purpose                                                                               |
    | ----------------------------------------- | ------------------------------------------------------------------------------------- |
    | `<Target_PC_IP_address>`                  | IP address of the computer where the Windows Client will be installed.                |
    | `-u <User_name>`                          | Username with administrator permissions on the target computer.                       |
    | `-p <Password>`                           | Password for the user. Omit to be prompted interactively.                             |
    | `-c SytecaClient.exe`                     | The Client installation file to copy and execute.                                     |
    | `/ServerName=<Server_name_or_IP_address>` | Application Server name or IP the Client will connect to.                             |
    | `/TenantKey=<Tenant_key>`                 | Optional. Tenant Key for Multi-Tenant deployments installing to a non-default tenant. |
  </Step>
</Steps>

<Note>
  If the target computer and the machine running PsExec are on different Virtual Local Area Networks (VLANs), verify the target computer can ping the Application Server before starting the install.
</Note>

## Group Policy installation using an MSI file

For domains already using Group Policy to deploy software, the Group Policy method installs the Syteca Client on all computers in a selected Group Policy Object (GPO). This requires generating an MSI transform (MST) file with Microsoft Orca to inject the Application Server parameters into the installer.

The full procedure has two parts: creating the MST configuration file, and installing via Group Policy.

### 1. Create the configuration file with Microsoft Orca

<Steps>
  <Step title="Open agent.msi in Orca">
    Right-click the `agent.msi` file and select **Edit with Orca**.
  </Step>

  <Step title="Create a new transform">
    On the **Transform** menu, select **New Transform**.
  </Step>

  <Step title="Open the Property table">
    In the **Tables** pane, click **Property**. Right-click in the main pane and select **Add Row**.
  </Step>

  <Step title="(SaaS only) Add silent install properties">
    For SaaS installations of `EkranSystemClient.msi` via GPO, add these properties:

    | Property         | Value              |
    | ---------------- | ------------------ |
    | `SILENT_INSTALL` | `Y`                |
    | `PROXY_HOST`     | `<SaaS_ProxyHost>` |
  </Step>

  <Step title="Add the Application Server property (default settings)">
    To install with default Client settings, add this property:

    | Property      | Value         |
    | ------------- | ------------- |
    | `SERVER_NAME` | `<Server_IP>` |

    For Multi-Tenant deployments installing to a specific tenant, also add:

    | Property     | Value          |
    | ------------ | -------------- |
    | `TENANT_KEY` | `<Tenant_key>` |
  </Step>

  <Step title="(Alternative) Add the INI file path for custom settings">
    To install with custom Client settings via an INI file, rename `SytecaClient.ini` to `agent.ini`, copy `agent.ini` to a shared folder accessible from all target computers, and add this property in Orca:

    | Property   | Value                     |
    | ---------- | ------------------------- |
    | `INI_PATH` | `<Full_Path_to_INI_file>` |
  </Step>

  <Step title="Generate and save the MST file">
    On the **Transform** menu, select **Generate Transform**. Save the MST file with a descriptive name, for example `SytecaClient.mst`.
  </Step>
</Steps>

### 2. Install the Client via Group Policy

<Steps>
  <Step title="Prepare a shared folder">
    Create a shared folder accessible from all target computers. Copy `agent.msi`, the MST file (and the INI file, if used) to this folder.

    <Warning>
      Paths to `agent.msi`, the MST file, and the INI file must all be **network share paths accessible from every target computer**, not local paths or mapped network drives. Every user account participating in the install must have at least **Read** permission on the share.
    </Warning>
  </Step>

  <Step title="Open Group Policy Management">
    On the domain controller, open **Administrative Tools** and click **Group Policy Management**.
  </Step>

  <Step title="Create the GPO">
    Right-click **Group Policy Objects** and select **New**. Enter a name (for example, `Syteca Client installation`) and click **OK**.
  </Step>

  <Step title="Link the GPO to the domain">
    Right-click your domain in the navigation pane and select **Link an Existing GPO**. Select the GPO you created and click **OK**.
  </Step>

  <Step title="Set the scope of the GPO">
    Click the GPO in the navigation pane. On the **Scope** tab, in the **Security Filtering** section, click **Authenticated Users** and click **Remove**.

    Click **Add**. In the **Select User, Computer, or Group** dialog, enter the name of the group whose members the GPO applies to, and click **OK**.
  </Step>

  <Step title="Configure the software package">
    Right-click the GPO and select **Edit**. In the Group Policy Management Editor, navigate to **Computer Configuration > Policies > Software Settings**. Right-click **Software installation** and select **New > Package**.

    Locate `agent.msi` on the network share.

    In the **Deploy Software** window, select **Advanced**. On the **Modifications** tab, click **Add** and locate the MST file on the network share.
  </Step>

  <Step title="Apply the GPO by restarting target computers">
    Restart the target computers to apply the GPO. It may require 2 or 3 restarts for the GPO to fully update across the domain.
  </Step>
</Steps>

<Note>
  If both an MSI and an INI file are placed in the same shared folder, the settings from the INI file are applied to the Client computers automatically. In that case the MST file does not need to be created; the INI file alone provides the Application Server parameters.
</Note>

## Third-party software deployment

For organizations already running centralized deployment infrastructure (System Center Configuration Manager, Active Directory login scripts, and similar tools), the Client can be installed silently via a single command line.

Download the [Client installation file](/docs/administration/clients/install-windows), then invoke your deployment tool with the following command:

```powershell theme={"system"}
SytecaClient.exe /ServerName=<Server_name>
```

The Client is installed with the default configuration.

For Multi-Tenant deployments where the Client must go to a specific tenant, add the `/TenantKey` parameter:

```powershell theme={"system"}
SytecaClient.exe /ServerName=<Server_name> /TenantKey=<tenant_key>
```

## Generate the installation package

<Warning>
  **IN SAAS ONLY:** this process differs slightly — see [Getting Started with a SaaS Deployment](/docs/get-started/saas-deployment) instead.
</Warning>

<Steps>
  <Step title="Open Install Clients">
    Log in to the Management Tool as a user with the [administrative Client Installation and Management permission](/docs/administration/users/administrative-permissions), click **Clients**, then **Install Clients** in the top right.
  </Step>

  <Step title="Download the installation file">
    On the **Computers without Clients** page, click **Download Installation File**.
  </Step>

  <Step title="Select the package type">
    On the **Installation File Download** page, select **Windows**, then click **Windows Client Installation Package (.ini + .exe)**.
  </Step>

  <Step title="Configure the package">
    On the **Generate Installation Package** page, optionally protect the package from modification, set the **Server name / IP address** Clients should connect to, and choose the [Client configuration](/docs/administration/clients/windows) to apply. Click **Next**.

    <Note>
      The server address must be static. Use a unique external IP address for cloud-based Application Servers.
    </Note>
  </Step>

  <Step title="Download completes">
    The package downloads to your computer, per your browser's download settings.
  </Step>
</Steps>

## Local installation using the installation package

For local installation with predefined custom monitoring parameters, the Management Tool generates a ZIP installation package containing both the installer and an INI configuration file. This method suits deployments where administrators want to distribute a preconfigured package across all endpoints without configuring each installation individually.

<Steps>
  <Step title="Copy the installation package to the target computer">
    Extract the ZIP package. It contains `SytecaClient.exe` and `SytecaClient.ini`. Copy both files to the target computer.

    <Note>
      In SaaS deployments, the installer is `SytecaClient.msi` instead of `SytecaClient.exe`.
    </Note>
  </Step>

  <Step title="Run the installer as administrator">
    On the target computer, log in with an administrator account. Double-click `SytecaClient.exe` to start the installation. The installer reads its configuration from the co-located `SytecaClient.ini`.
  </Step>

  <Step title="Confirm the Client appears in the Management Tool">
    After installation completes, the Client appears on the **Clients** page of the Management Tool.
  </Step>
</Steps>

## Local installation without an INI file

The simplest local installation. Only the `SytecaClient.exe` file is needed; the `SytecaClient.ini` file is generated automatically with default parameters. Suitable when the default Client configuration is acceptable.

<Note>
  In SaaS, the process for downloading the Client installer differs. See [Getting Started with a SaaS Deployment](/docs/get-started/saas-deployment) for the SaaS-specific procedure.
</Note>

There are two variants for this installation method:

### Variant 1: Interactive UI

<Steps>
  <Step title="Copy the installer to the target computer">
    Copy `SytecaClient.exe` to the target computer.
  </Step>

  <Step title="Launch as administrator">
    Launch `SytecaClient.exe` with an administrator account.
  </Step>

  <Step title="Enter the Application Server">
    In the window that opens, enter the name or IP address of the computer hosting the Application Server. Click **Install**.

    For Multi-Tenant deployments, select the **Use Tenant Key for multi-tenant mode** checkbox, then enter the Tenant Key for the target tenant.

    <Note>
      The Tenant Key can be copied from the Management Tool (on the Tenants page) by the administrator of the built-in default tenant. If a Tenant Key is not specified, the Client is installed on the built-in default tenant.
    </Note>
  </Step>
</Steps>

### Variant 2: Command line

<Steps>
  <Step title="Open an administrator command prompt">
    On the target computer, open `cmd.exe` as administrator.
  </Step>

  <Step title="Run the installer with the ServerName parameter">
    Enter:

    ```powershell theme={"system"}
    SytecaClient.exe /ServerName=<Server_Name>
    ```
  </Step>
</Steps>

<Warning>
  If no connection can be established with the Application Server, the installation fails and an error message is displayed. Verify network connectivity to the Application Server before starting.
</Warning>

Once installation completes, the Client appears on the **Clients** page of the Management Tool.

## Amazon WorkSpaces bundle deployment

Amazon WorkSpaces is a desktop-as-a-service platform. Installing the Syteca Client on every new WorkSpace individually is impractical. Instead, install the Client once on a template WorkSpace, create a bundle from it, and provision new WorkSpaces from the bundle. Each new WorkSpace inherits the Client and connects to the Application Server on first boot.

<Steps>
  <Step title="Download the Client installation file from the Management Tool">
    Download `SytecaClient.exe` from the Management Tool. See [Downloading the Windows Client Installation EXE File](/docs/administration/clients/install-windows#local-installation-without-an-ini-file).
  </Step>

  <Step title="Install the Client on the template WorkSpace">
    Connect to the template Amazon WorkSpace. Run the Client installation file with administrator permissions.
  </Step>

  <Step title="Remove the AgentGUID registry value">
    Open the Windows Registry Editor and navigate to:

    ```text theme={"system"}
    HKEY_LOCAL_MACHINE\SOFTWARE\EkranSystem\Client
    ```

    Right-click **AgentGUID** and select **Delete**. Confirm the deletion.

    <Note>
      Removing `AgentGUID` is what allows each new WorkSpace created from the bundle to register as a distinct Client. Without this step, all WorkSpaces created from the bundle would share the same GUID and collapse into a single Client entry in the Management Tool.
    </Note>

    <Warning>
      Deleting `AgentGUID` requires Protected Mode to be disabled on the Client. Protected Mode blocks registry edits by design.
    </Warning>
  </Step>

  <Step title="Create the Amazon image and bundle">
    In the Amazon WorkSpaces management console:

    1. Create an image of the template WorkSpace.
    2. Create a bundle from the new image.
    3. Provision new Amazon WorkSpaces from the bundle.
  </Step>
</Steps>

New Amazon WorkSpaces created from the bundle automatically connect to the Syteca Application Server on first boot.

<Warning>
  Ensure the Syteca Application Server accepts TCP connections on port **9447** for Client-to-Application-Server communication.
</Warning>

## Related

<CardGroup cols={2}>
  <Card title="Windows install prerequisites" icon="monitor-check" href="/docs/administration/clients/windows-install-prerequisites">
    Verify Server and Remote Procedure Call (RPC) services on target Windows computers before remote install.
  </Card>

  <Card title="Install Linux Clients" icon="terminal" href="/docs/administration/clients/install-linux">
    Linux and SELinux Client installation from the command line.
  </Card>

  <Card title="Install macOS Clients" icon="apple" href="/docs/administration/clients/install-macos">
    macOS Client installation, including hidden Client variant.
  </Card>

  <Card title="Clients overview" icon="laptop" href="/docs/administration/clients/overview">
    View and manage installed Clients from the Management Tool.
  </Card>
</CardGroup>