Updating clients

Manual update

The following clients do not support auto-update and need to be updated by other means.

Client	Manual Update Method
Windows Lite	When they are launched they will update if the version is newer than the last one used.
Mobile	Updated through their respective app stores.
Windows multi-user Windows SSO Linux - Headless macOS - Headless k8s service	Must be updated manually.

Client

Manual Update Method

Windows Lite

When they are launched they will update if the version is newer than the last one used.

Mobile

Updated through their respective app stores.

Windows multi-user
Windows SSO

Linux - Headless

macOS - Headless

k8s service

Must be updated manually.

Auto-update

The Client Auto-Update feature allows the client to download an update file for its specific platform if its version is lower than the given version and the defined criteria script returns true. The update occurs during first login or when the entitlement token is renewed.

The Client auto-update service manages the process of updating the following client types, removing any need for ongoing local device management.

Client	Client Auto-Update Process
Windows macOS - Full Linux - Full macOS - Always-on	The auto-update function is installed when the client installer runs. The client will notify the user when an update is pending and they can choose to install it immediately. Otherwise it will be installed when it is restarted.
Windows - Headless	Windows headless clients already use system services, so there is no requirement for a separate auto-update function. Because there is no UI related to these system processes, the update will be applied automatically as soon as the client is ready.
Windows - Always-on	Update mechanisms can be triggered through the full or headless clients. Both halves of the always-on client will be updated at the same time.

Client

Client Auto-Update Process

Windows
macOS - Full

Linux - Full

macOS - Always-on

The auto-update function is installed when the client installer runs.
The client will notify the user when an update is pending and they can choose to install it immediately. Otherwise it will be installed when it is restarted.

Windows - Headless

Windows headless clients already use system services, so there is no requirement for a separate auto-update function.
Because there is no UI related to these system processes, the update will be applied automatically as soon as the client is ready.

Windows - Always-on

Update mechanisms can be triggered through the full or headless clients. Both halves of the always-on client will be updated at the same time.

Disable the auto-update service

The auto update service is a convenient way to upgrade the full client, but it runs as system service so it increases the attack surface of your system. There are currently no known vulnerabilities related to this service, but if you're not using this AppGate ZTNA feature to deploy upgrades across your user base, we recommend disabling this service using the following commands.

Operating System	Command
Windows	`sc config AppgateUpdateService start= Disabled` `sc stop AppgateUpdateService`
macOS	`sudo launchctl stop com.appgate.sdp.updater` `sudo launchctl remove com.appgate.sdp.updater`

Operating System

Command

Windows

sc config AppgateUpdateService start= Disabled

sc stop AppgateUpdateService

macOS

sudo launchctl stop com.appgate.sdp.updater

sudo launchctl remove com.appgate.sdp.updater

NOTE
On macOS you will need to reinstall the client to re-enable this feature.