Skip to main content

​
What this is for

The Windows installer is a per-machine MSI, guardway-gw-cli-windows-x86_64.msi, built for silent deployment. It installs to C:\Program Files\Guardway, puts gw-cli on the machine PATH, and starts the agent and the Guardway tray icon in every signed-in user’s session right away and at each sign-in after that. There is nothing to run after the install. Download: https://api.guardway.ai/v1/downloads/gw-cli/latest/guardway-gw-cli-windows-x86_64.msi. Verify it against SHA256SUMS in the same folder.

​
What the package installs

Identifiers for your deployment tool:
  • UpgradeCode (permanent, detects any version): {45544182-2B7E-42C6-BE77-0167C1E039A6}
  • ProductCode changes with each release. Read it from the MSI or from your tool’s inventory after the first deployment.

​
How to install

1

Add the app

Upload the MSI as a Line-of-business app. Intune reads the ProductCode and version from the file and handles detection and upgrades. Or package it as a Win32 app with install command msiexec /i guardway-gw-cli-windows-x86_64.msi /qn, uninstall command msiexec /x "{ProductCode}" /qn, install behavior System, and an MSI detection rule.
2

Assign to device groups

Assign to devices, not users. The install runs as SYSTEM with no interactive session, so no SmartScreen prompt appears.
3

Enroll with a user-context script (optional)

Enrollment is per user on Windows. Deploy the enroll command as a PowerShell script that runs with the logged-on credentials. See Activate.
Updating is installing on top. Install the newer MSI the same way. It removes the previous version in the same transaction, stops the running agent first so the new code runs immediately, and keeps every user’s data and enrollment. Never uninstall first.

​
After the install

The Guardway tray icon appears in each signed-in session within a few seconds. Verify:
Open a new terminal for the updated PATH. To stage installs during the day without icons appearing, add GW_NO_SESSION_LAUNCH=1 to the msiexec command; the agent then starts at each user’s next sign-in. Then enroll the machine.

​
Managed mode on Windows

The MSI installs Observe. The managed mode, which Enforce, Live guard Block, AI Control and skill custody need, is one elevated command:
It registers a SYSTEM scheduled task named com.guardway.gw-cli.tap, not a Windows service, so look for it with schtasks /Query /TN com.guardway.gw-cli.tap. On Windows the Enforce posture points AI tools directly at your gateway rather than through a local relay, so only Enforce, fail closed applies; see Posture.

​
Removing

On a machine in the managed mode, run gw-cli hook --managed --remove first so held skills are returned and AI tools are unwired before the files go. See Uninstall & Recovery.

​
Limits

  • x86_64 only. Windows on ARM is not supported.
  • Remote Desktop hosts with several users signed in at once may not get the agent started in every session until those users sign in again.
  • MSIs older than 0.2.148 cannot update themselves; install a current MSI over them once.