--- title: "Windows clients" slug: "windows-clients-v6-7" description: "Explore various Windows Client types, including Full, Lite, Multi-user, and Headless, to find the best fit for your enterprise needs." tags: ["Client Configuration", "Windows Client"] updated: 2026-07-07T16:07:00Z published: 2026-07-07T16:07:00Z canonical: "support.appgate.com/windows-clients-v6-7" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.appgate.com/llms.txt > Use this file to discover all available pages before exploring further. # Windows clients ## Client types There are a number of different types of Windows client. For a quick overview of the differences refer to the [Client compatibility matrix](/v1/docs/client-deployment-and-management-v6-7). | [***Full***](/v1/docs/windows-clients-v6-7) | Designed for normal enterprise usage - including pre-installation as part of standard builds | | --- | --- | | [***Lite***](/v1/docs/windows-lite-client-v6-7) | Designed for third party usage - where the user may not have admin rights on their device. | | [***Multi-user***](/v1/docs/windows-multi-user-client-v6-7) | For installation on terminal servers. Provides each user their own AppGate ZTNA session. | | [***Headless***](/v1/docs/windows-headless-client-v6-7) | For installation on unattended machines such as servers. | | [***Always-On***](/v1/docs/windows-always-on-client-v6-7) | For normal enterprise usage where an always-on connection to certain (protected) hosts is required | | [***SSO*** ***(PLAP)***](/v1/docs/windows-sso-plap-client-v6-7) | Works with Windows SSO to allow users to perform a domain sign-in even when working remotely. | Ensure the client version is designed for use with the associated software OS version - see [Download Center](https://www.appgate.com/support/software-defined-perimeter-support/sdp-v6-5) ## Installing and running the client Each type of Windows client has a page containing more specific details about how it is installed. Most use the same installer with various command line options full details of which are covered below; however the lite client has its own installer. It is normally best to uninstall one type before changing to another type of Windows client. Never try to partially uninstall the client such as only removing the AppGate ZTNA driver. It is not uncommon for end point protection softwares to interfere with or break the installation of the client. The client contains a number of components/executables listed below which may require to be given access within the end-point protection software. ### Using Windows events to check if AppGate ZTNA is connected Windows logs are created by the AppGate ZTNA driver. These can be seen in the Event Viewer where the Source will be shown as , the Event ID will be sown as <256>, and either or will be reported. These can be useful where other processes that rely on network connectivity can monitor these events, and wait for before they attempt to send any network traffic. ### Using the command line for pre-installation and uninstallation of the client When the installer executable is run normally (when a user clicks it), then the full client will be installed. #### Pre-installation of the client You might want to pre-install the client on standard device builds and minimize any subsequent user interactions required. One way to do this is to pre-install one or more profiles at install time using the /P switch. Client profiles include the CA fingerprint, SPA key, and choice of IdP. This can be obtained from the [Client Profiles](/v1/docs/client-profiles-v6-7) UI. By example; to complete pre-installation of the client and profile link (so the users will be ready to use the client) run: `appgate-sdp-installer.exe /S /P="appgate://controller.myco.com/profilename..."` When the installer .exe is run from the command line then the following switches may be added (precede each with a space): | /help or /? | Lists installer usage/flags. | | --- | --- | | /S | Installer will run silently without any popup. Return code other than 0 indicates that an error occurred during installation. | | /D | Will install the client into an alternative directory (/D=C:\here). Can be used with /S. Must always be the last option given. | | /I or /DISABLESCRIPTS | Will prevent the running of device claim scripts. | | /A or /STARTCLIENT | Run the client after silent install is finished. | | /W or /AUTOSTARTALL | After this installation finishes the client will auto-start for ALL users. (Normally it will only auto-start for the user that installed it.) This uses Windows Active Setup which has its own characteristics. It only allows settings to be applied once for OTHER users for a given piece of software. So installing 6.0.2 twice will only apply auto-start for OTHER users the first time. > [!NOTE] > **NOTE** > > This does not affect the usual auto-start operation (such as at power up, when performing re-installation or upgrades); this can be changed in the client's Settings menu or by the administrator in [Client Settings](/v1/docs/configure-policies-v6-7). | | /Q or /SKIPAUTOSTART | Do not configure autostart for the the user that installed it. (see /W) | | /G or /DISABLEUSERACCEPTANCE | Do not show the data usage user acceptance screen the first time the client starts. (Not relevant in the case of Headless.) | | /T or /ATTENTIONMODE | Pre-set the Attention level default value [0=Low, 1=Normal, 2=High] | | /P="profile1;profile2" or /PROFILES="profile1;profile2" | Set one or multiple profile links that will be used with fresh installs of the client. Each profile should be separated using a semicolon encapsulated in quotes ["profile1;profile2"]. i.e. /P="appgate://url1.com/abc;appgate://url2.com/def" | | /E or /HEADLESS | Install client as a Windows service so that it runs with no UI. | | /O or /ALWAYSON | Install client as both a full client and as a headless client so that it always runs in one mode or the other. | | /L or /SSO | Install client as a Windows SSO (PLAP) service so that it captures credentials from a customized Windows sign-in screen. | | /M or /MULTIUSER | Install client as a multi-user client. See [Multi-user Client](/v1/docs/windows-multi-user-client-v6-7) for details of how this works. | | /C or /CACHEPIN | Enable PIN caching when using the LDAP certificate identity provider. | | /R or /SETSIGNEDIN | Sets the 'Keep me signed in' option as the default. Also enables the 'SAML/Certificate auto sign-in' option as the default. | ![SAML/Certificate auto sign-in option for automatic authentication in applications.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/ag51-autosaml.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A57%3A33Z&se=2026-10-27T00%3A57%3A33Z&sr=c&sp=r&sig=l4y64aOB7mUrDl6fNwI45yd91Qsi8ZJbfHpHr1kVl0E%3D) | | /N or /DISABLEUSERCHECK | Allow the full client to operate (pass traffic) even when the active Windows session is different from the Windows session that was used to launch the full client. Otherwise operation of the client and driver will be paused when there is a mismatch preventing one session 'hijacking' another user's session. | | /Z or /UNINSTALL | Triggers the installer to run the associated uninstaller. | #### Uninstaller As well as triggering the uninstaller from the installer, it can be run independently. Go to the installation folder and run: `%programfiles%\appgate sdp\uninstaller.exe` When the uninstaller executable is run from the command line then the following switches may be added (precede each with a space): | /S | Uninstaller will run silently without any pop-up. Return code other than 0 indicates that an error occurred during uninstallation. | | --- | --- | | /K, /KEEPSETTINGS | Will keep all client settings. | > [!NOTE] > NOTE > > If scripting the installer using PowerShell you should add an extra pair of single quotes ' ' around any double quotes " ". e.g. xxx.exe /P='"myurl"'. ### Windows client - Components/Executables #### Standard Executables | **Appgate SDP Service.exe** Will run as USER - they handle the business logic. | `%programfiles%\appgate sdp\service\appgate sdp service.exe` | | --- | --- | | **Appgate SDP.exe** Multiple processes that run as USER - they handle the UI. | `%programfiles%\appgate sdp\ui\appgate sdp.exe` | | **appgate-driver.exe** The virtual network adapter that runs as SYSTEM - it handles connections to the Gateways. | `%programfiles%\appgate sdp\driver\appgate-driver.exe` | > [!NOTE] > NOTE > > You might need to give access to some or all of these if you are using an aggressive form of antivirus which prevents programs from executing. These will additionally create: `%PROGRAMDATA%\appgate\` `%APPDATA%\appgate\` `%PROGRAMFILES%\appgate sdp\` Upgraded clients may retain some existing paths even though new paths are now used. This only shows the paths used in new installations. ### Configuration settings | **View the network adapter** | Use `ipconfig` and look for the AppGate ZTNA adapter ![Network configuration details for Appgate SDP VPN Tunnel including IP addresses and DNS servers.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/ag53-ipconfig.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A57%3A33Z&se=2026-10-27T00%3A57%3A33Z&sr=c&sp=r&sig=l4y64aOB7mUrDl6fNwI45yd91Qsi8ZJbfHpHr1kVl0E%3D) #### | | --- | --- | | **View local firewall rules** | Use `netsh wfp show filters` (As an admin, this will create a file filters.xml containing the filters.) | | **View client settings** | The user.config file for the client can be found in: `%APPDATA%\Appgate\Appgate_SDP_Service_Url_<some_random_text>\<version>\` | | **Clean all client settings** | Simply delete the user.config file. | | **Remove client profile links** | Go to `%APPDATA%\Appgate\` and delete the files `Profiles` and `ProfileConfigurations`. | | **Remove all stored passwords, cookies, and certificates** | With admin rights, run (Win+R) and perform a search for "certmgr.msc". Delete certificates under ”AppGate” in the right hand-pane of the below panel. ![Certificate management interface displaying AppGate certificates and their details.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/ag40-certmgr.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A57%3A33Z&se=2026-10-27T00%3A57%3A33Z&sr=c&sp=r&sig=l4y64aOB7mUrDl6fNwI45yd91Qsi8ZJbfHpHr1kVl0E%3D) Make sure you are using Credential Manager as the correct user (to ensure the correct generic credentials are visible), then select and delete the required item. | | **Set Windows network category to Private** | 1. Go to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles` 2. Locate the profile with the *ProfileName* of AppgateSDP. 3. Go to the Category `REG_DWORD` and change the value of the network profile to: Public (0), Private (1), or Domain (2) 4. Reboot. | | **Set Windows route priority** | 1. Go to `HKEY_LOCAL_MACHINE\SOFTWARE\Appgate\Driver`. 2. Below `“NormalDesktop"="1"` add the following: `"NeedRoutes"="192.168.1.2/32, 192.168.1.3/32"` `"NeedRouteTimeout"="90"` `"NeedRouteDelay"="3"` 1. Restart the client. **NeedRoutes**. A comma separated list of /32 IP addresses entered in the full CIDR notation (for example, "192.168.1.2/32, 192.168.1.3/32"). We recommend putting DNS servers in this section. Since the DNS servers are the same on all Sites, this will always make the adapter to come up once those DNS routes are received. **NeedRouteDelay**. The delay in seconds. We recommend starting with 3. This is an optional, additional delay. Since the AD/Kerberos servers could be different based on the nearest Sites, this adds an optional delay to ensure these routes are also received. **NeedRouteTimeout**. Timeout in seconds. We recommend starting with 90. If the NeedRoutes specified are not received after this time, but other Sites are connected, then the network adapter is brought up to trigger Site fallback. | | **Find Windows device ID** | AppGate ZTNA creates a device ID when a client is first installed. For Windows this is done one of three ways: 1. Check for a registry entry. If an entry is not present, go to option 2. 2. Use `wmic csproduct get uuid` If this fails, go to option 3. 3. Use `HKLM\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid` |