> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/installation/install-using-msi.md). # Install using MSI *** ### Prerequisites Before running the MSI installer, ensure the following dependencies are installed on the target machine. The MSI installer does NOT install these automatically, unlike the EXE installer. | Dependency | Minimum Version | Download | | ---------------------------------------------- | --------------- | ---------------------------------------------------------------------------------------------- | | Microsoft Visual C++ Redistributable 2015–2022 | v14.42 or later | [Download from Microsoft](https://aka.ms/vs/17/release/vc_redist.x64.exe) | | .NET Framework | 4.8.1 or later | [Download from Microsoft](https://dotnet.microsoft.com/en-us/download/dotnet-framework/net481) | {% hint style="info" %} If either dependency is missing, the MSI installation will fail silently. Verify both are installed before proceeding. {% endhint %} ### UI Mode Installation 1. Obtain the installer package from your 1Kosmos representative. The package contains: * `1KosmosCredentialProvider-.msi` * `registryconfig.ini` 2. Right-click `1KosmosCredentialProvider-.msi` and select **Run as administrator**. 3. Follow the on-screen installation wizard. 4. Default installation directory: `C:\Program Files\1Kosmos\BlockIDCredentialProvider` 5. Log files are available at: `C:\Program Files\1Kosmos\BlockIDCredentialProvider\Logs` 6. Restart the workstation after installation is complete. {% hint style="info" %} A restart is required for the Credential Provider to appear on the Windows login screen. {% endhint %} ### Silent Installation For deployments where no user interaction is required. To install silently (no UI, no restart): **Install silently with no UI and no restart:** `msiexec /i 1KosmosCredentialProvider-.msi /qn /norestart` **Install silently with registry configuration applied at install time:** `msiexec /i 1KosmosCredentialProvider-.msi /qn REGISTRYCONFIG="C:\temp\registryconfig.ini" /norestart` **Install with wizard visible but no user input required:** `msiexec /i 1KosmosCredentialProvider-.msi /norestart` **Install with wizard visible and registry configuration:** `msiexec /i 1KosmosCredentialProvider-.msi REGISTRYCONFIG="C:\temp\registryconfig.ini" /norestart` {% hint style="info" %} **`/norestart`:** Use when deploying via SCCM or Intune to control the restart separately. Without this flag, the installer restarts the machine immediately after installation. {% endhint %} {% hint style="info" %} **`REGISTRYCONFIG`:** The path must be a full absolute path. Relative paths are not supported. {% endhint %} ### Configuring registryconfig.ini The `registryconfig.ini` file applies tenant connection details and registry settings during installation. It is included in the installer package received from your 1Kosmos representative. | Registry Key | Type | Description | Example Value | | ---------------------- | ---------- | -------------------------------------------------------------------------- | -------------------------------------- | | tenantUrl | REG\_SZ | Tenant URL to connect to the 1Kosmos platform | acme.1kosmos.net | | communityName | REG\_SZ | Name of the 1Kosmos community | default | | proxyUrl | REG\_SZ | URL of the proxy server (optional) | | | proxyUsername | REG\_SZ | Username for authenticated proxy (optional) | username | | proxyPassword | REG\_SZ | Password for authenticated proxy (optional) | \[your proxy password] | | VaultUrl | REG\_SZ | CyberArk vault URL (shared account deployments only) | sampletest.privilegecloud.cyberark.com | | VaultUser | REG\_SZ | CyberArk vault service account username | svc\_account | | VaultUserCredential | REG\_SZ | CyberArk vault service account password | \[your vault password] | | VaultProxyUrl | REG\_SZ | CyberArk proxy URL (optional) | 192.168.0.0 | | VaultProxyApiKey | REG\_SZ | CyberArk proxy API key | d0f100ab-xx76-4xx8-bxc2-7xx175xxx22b | | RdpDisabled | REG\_DWORD | When set to 1, bypasses RDP logins allowing native credential passthrough | 0 | | ClearLastUsedProvider | REG\_DWORD | When set to 1, OS does not remember the last used provider | 0 | | DisablePwdOnLogin | REG\_DWORD | When set to 1, disables the password provider during Login/Unlock | 0 | | DisablePwdOnCredUI | REG\_DWORD | When set to 1, disables the password provider during CredUI (Run As / RDP) | 0 | | Disable1KosmosOnLogin | REG\_DWORD | When set to 1, hides the 1Kosmos Credential Provider during Login/Unlock | 0 | | Disable1KosmosOnCredUI | REG\_DWORD | When set to 1, excludes 1Kosmos from CredUI flows | 0 | {% hint style="warning" %} The `registryconfig.ini` file does not support double quotes in any value. Passwords containing double quotes will cause configuration to fail. {% endhint %} {% hint style="info" %} All configuration is applied to the Windows Registry. The `config.json` file used in EXE v1.x installations is not used by the MSI installer. {% endhint %} *** ### Mass Deployment #### SCCM / Microsoft Endpoint Configuration Manager `msiexec /i 1KosmosCredentialProvider-.msi /qn REGISTRYCONFIG="\\server\share\registryconfig.ini" /norestart` Pre-stage the `registryconfig.ini` file to a network share or include it in the deployment package. Schedule the restart through SCCM separately. #### Microsoft Intune Wrap the MSI using the Microsoft Win32 Content Prep Tool (`IntuneWinAppUtil.exe`) and create a Win32 app in Intune with the following settings: **Install command:** `msiexec /i 1KosmosCredentialProvider-.msi /qn REGISTRYCONFIG="C:\temp\registryconfig.ini" /norestart` **Uninstall command:** `msiexec /x 1KosmosCredentialProvider-.msi /qn /norestart` **Detection rule:** File detection on `C:\Program Files\1Kosmos\BlockIDCredentialProvider\` #### Group Policy (GPO) Add the MSI to a GPO software installation policy targeting the relevant computer OUs. {% hint style="info" %} GPO software installation does not support passing MSI properties such as `REGISTRYCONFIG` directly. Configure registry settings separately using a GPO Registry preference or a startup script that runs the silent install command with the `REGISTRYCONFIG` parameter. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/installation/install-using-msi.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.