What this is for
Once a machine reports, you never have to touch it to keep its agent current. The Agent updates section of its Endpoint AI Policy sets whether machines install updates themselves, how far behind the newest release they stay, and when they may do it. This page explains what happens on the machine.The policy
Under Notify, Fleet shows which machines have an update available in the Sensor column and
nothing is installed. Under Auto-install, each machine installs the release the policy selects,
with nobody present, inside its maintenance window. The agent only installs releases from Guardway’s
signed release index, never downgrades itself, and checks that the new version is serving before it
finishes.
What runs on the machine
Check a machine with:
Updating by hand
Installing the next package over the current one is always supported and keeps the mode, enrollment and data:installer -pkg on macOS, msiexec /i on Windows, apt install or
dnf upgrade on Linux. sudo gw-cli upgrade follows the policy’s target on macOS and Windows;
on a Linux package install it prints the apt or dnf command instead of replacing the binary.
One-time bootstrap
Machines on old agents have no updater yet:- macOS and Windows managed installs older than the updater: install the current package once.
- Windows MSIs older than 0.2.148 and Linux packages older than 0.2.160 cannot update themselves: install the current package over them once.
Limits
- A release that changes the code-signing identity on macOS is never installed unattended, because it would void Full Disk Access. It needs the package or
sudo gw-cli upgrade. - A per-user archive install has no machine-wide updater; update it with
gw-cli upgrade. - Homes on an external or network volume on macOS need Full Disk Access for the updater.