Manual update
The following Clients do NOT support auto-update and need to be updated by other means.
Windows lite
When they are launched (from a URL) they will update if the version is newer that the one used last time
Mobile
Updated via the respective app stores
Windows multi-user, Windows SSO, Linux headless, macOS headless, k8s service
Must be done manually
Auto-updater
The Client Auto-Update feature allows the Client to download an update file for its specific platform if its version is lower than the given version and the defined Criteria Script returns true. Update occurs during first login or when the Entitlement Token is renewed.
The Client auto-update service manages the process of updating the following Clients types, removing any need for ongoing local device management.
Windows, macOS & Linux - Full
macOS - always-on
The auto-update function is installed when the Client installer is run.
The Client will notify the user when an update is pending who can choose to install it immediately. Otherwise it will be installed when it is restarted.
Windows - headless
These Clients already utilize system services, so there is no requirement for a separate auto-update function as it can be included in this service.
Because there is no UI related to these system processes then the update will be applied automatically as soon as the Client is ready to perform the update.
Windows - always-on
Depending on which is connected at the time, update mechanisms can be triggered via the full or headless Clients in the usual way. Both halves of the always-on Client will be updated at the same time.
Disable the auto-update service
Whilst this auto update service is a very convenient way to upgrade the full Client, it runs as system service so increases the attack surface of your system. There are currently no known vulnerabilities related to this service but if you're not using this Appgate SDP feature to deploy upgrades across your user base, you should disable this service using these commands.
Windows
sc config AppgateUpdateService start= Disabled
sc stop AppgateUpdateService
macOS
sudo launchctl stop com.appgate.sdp.updater
sudo launchctl remove com.appgate.sdp.updater
NOTE
On macOS you will need to reinstall the Client to re-enable this feature.