---
title: "Updating Clients"
slug: "updating-clients-v6-5"
description: "Learn how to manually update AppGate Clients, manage auto-updates, and ensure secure access with our comprehensive guide on Windows, macOS, and Linux."
updated: 2025-10-31T18:22:30Z
published: 2025-10-31T18:22:30Z
canonical: "support.appgate.com/updating-clients-v6-5"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.appgate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Updating Clients

## Manual update

The following Clients do NOT support auto-update and need to be updated by other means.

### Windows lite

- When they are launched (from a URL) they will update if the version is newer that the one used last time

### Mobile

- Updated via the respective app stores

### Windows multi-user, Windows SSO, Linux headless, macOS headless, k8s service

- Must be done manually

## Auto-updater

The Client Auto-Update feature allows the Client to download an update file for its specific platform if its version is lower than the given version and the defined Criteria Script returns true. Update occurs during first login or when the Entitlement Token is renewed.

The [Client auto-update](/v1/docs/client-auto-update) service manages the process of updating the following Clients types, removing any need for ongoing local device management.

### Windows, macOS & Linux - Full macOS - always-on

- The auto-update function is installed when the Client installer is run.
- The Client will notify the user when an update is pending who can choose to install it immediately. Otherwise it will be installed when it is restarted.

### Windows - headless

- These Clients already utilize system services, so there is no requirement for a separate auto-update function as it can be included in this service.
- Because there is no UI related to these system processes then the update will be applied automatically as soon as the Client is ready to perform the update.

### Windows - always-on

- Depending on which is connected at the time, update mechanisms can be triggered via the full or headless Clients in the usual way. Both halves of the always-on Client will be updated at the same time.

## Disable the auto-update service

Whilst this auto update service is a very convenient way to upgrade the full Client, it runs as system service so increases the attack surface of your system. There are currently no known vulnerabilities related to this service but if you're not using this Appgate SDP feature to deploy upgrades across your user base, you should disable this service using these commands.

### Windows

`sc config AppgateUpdateService start= Disabled`

`sc stop AppgateUpdateService`

### macOS

`sudo launchctl stop com.appgate.sdp.updater`

`sudo launchctl remove com.appgate.sdp.updater`

> [!NOTE]
> **NOTE**
> 
> On macOS you will need to reinstall the Client to re-enable this feature.

A defined access right or permission granted to users or devices, allowing them to access specific resources or functionalities within the Appgate ZTNA system.

A digital key used to authenticate and authorize users or devices, enabling secure access to resources.

Appgate SDP (Software Defined Perimeter) is a security solution that provides secure access to resources based on user identity and context, leveraging a zero trust security model.