> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guardway.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Windows (.msi)

> Install the Guardway agent on Windows with the per-machine MSI through Intune, SCCM, Group Policy or msiexec, and verify it starts for every user.

## What this is for

The Windows installer is a per-machine MSI, `guardway-gw-cli-windows-x86_64.msi`, built for silent
deployment. It installs to `C:\Program Files\Guardway`, puts `gw-cli` on the machine PATH, and
starts the agent and the Guardway tray icon in every signed-in user's session right away and at
each sign-in after that. There is nothing to run after the install.

Download: `https://api.guardway.ai/v1/downloads/gw-cli/latest/guardway-gw-cli-windows-x86_64.msi`.
Verify it against `SHA256SUMS` in the same folder.

## What the package installs

| Item | Path |
| - | - |
| Agent, scanning engine and tray | `C:\Program Files\Guardway\gw-cli.exe`, `skillspector.exe`, `gw-tray.exe` |
| Auto-start for every user | `HKLM\…\Run` entries **Guardway Tap** and **Guardway Tray** |
| Per-user data | `%USERPROFILE%\.guardway` for each user |
| Machine-wide data (managed mode) | `C:\ProgramData\Guardway` |
| Agent updater (managed mode) | Scheduled task **Guardway gw-cli updater**, every 15 minutes |

Identifiers for your deployment tool:

* **UpgradeCode** (permanent, detects any version): `{45544182-2B7E-42C6-BE77-0167C1E039A6}`
* **ProductCode** changes with each release. Read it from the MSI or from your tool's inventory after the first deployment.

## How to install

<Tabs>
  <Tab title="Intune">
    <Steps>
      <Step title="Add the app">
        Upload the MSI as a **Line-of-business app**. Intune reads the ProductCode and version from the file and handles detection and upgrades. Or package it as a Win32 app with install command `msiexec /i guardway-gw-cli-windows-x86_64.msi /qn`, uninstall command `msiexec /x "{ProductCode}" /qn`, install behavior **System**, and an MSI detection rule.
      </Step>

      <Step title="Assign to device groups">
        Assign to devices, not users. The install runs as SYSTEM with no interactive session, so no SmartScreen prompt appears.
      </Step>

      <Step title="Enroll with a user-context script (optional)">
        Enrollment is per user on Windows. Deploy the enroll command as a PowerShell script that runs with the logged-on credentials. See [Activate](/endpoint-ai-risk/connect/activate#managed-installs).
      </Step>
    </Steps>
  </Tab>

  <Tab title="SCCM">
    Create an **Application** with an MSI deployment type. Installation program `msiexec /i "guardway-gw-cli-windows-x86_64.msi" /qn /norestart`, uninstall program `msiexec /x "{ProductCode}" /qn /norestart`, detection by **MSI product code**, install for system, whether or not a user is logged on. Deploy to a device collection. Deploy an upgrade as its own application with no supersedence rule.
  </Tab>

  <Tab title="Group Policy">
    Assign the MSI under **Computer Configuration › Policies › Software Settings › Software installation** to **computers**, from a UNC path that **Domain Computers** can read. No transform is needed. It installs at the next boot. For upgrades, add the new MSI as a package that upgrades the old one and keep "Package can upgrade over the existing package": the MSI replaces the old build in one transaction.
  </Tab>

  <Tab title="By hand">
    ```powershell theme={null}
    msiexec /i guardway-gw-cli-windows-x86_64.msi /qn      # silent
    ```

    Double-clicking the MSI works as well. The MSI is not yet code-signed, so a hand install shows "Windows protected your PC"; choose **More info › Run anyway**. Deployments through Intune, SCCM or Group Policy never show it.
  </Tab>
</Tabs>

<Tip>
  **Updating is installing on top.** Install the newer MSI the same way. It removes the previous
  version in the same transaction, stops the running agent first so the new code runs immediately,
  and keeps every user's data and enrollment. Never uninstall first.
</Tip>

## After the install

The Guardway tray icon appears in each signed-in session within a few seconds. Verify:

```powershell theme={null}
gw-cli hook --installed-mode     # prints: observe | managed | none
gw-cli hook --status
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Guardway Tap"
```

Open a new terminal for the updated PATH. To stage installs during the day without icons
appearing, add `GW_NO_SESSION_LAUNCH=1` to the `msiexec` command; the agent then starts at each
user's next sign-in.

Then [enroll the machine](/endpoint-ai-risk/connect/activate).

## Managed mode on Windows

The MSI installs **Observe**. The managed mode, which Enforce, Live guard **Block**, AI Control and
skill custody need, is one elevated command:

```powershell theme={null}
& "C:\Program Files\Guardway\gw-cli.exe" hook --managed            # managed
& "C:\Program Files\Guardway\gw-cli.exe" hook --managed --remove   # back to observe
```

It registers a SYSTEM scheduled task named `com.guardway.gw-cli.tap`, not a Windows service, so
look for it with `schtasks /Query /TN com.guardway.gw-cli.tap`. On Windows the Enforce posture
points AI tools directly at your gateway rather than through a local relay, so only
**Enforce, fail closed** applies; see [Posture](/endpoint-ai-risk/policy#posture).

## Removing

```powershell theme={null}
msiexec /x "{ProductCode}" /qn
```

On a machine in the managed mode, run `gw-cli hook --managed --remove` first so held skills are
returned and AI tools are unwired before the files go. See
[Uninstall & Recovery](/endpoint-ai-risk/agent/uninstall#other-platforms).

## Limits

* x86\_64 only. Windows on ARM is not supported.
* Remote Desktop hosts with several users signed in at once may not get the agent started in every session until those users sign in again.
* MSIs older than 0.2.148 cannot update themselves; install a current MSI over them once.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.