Install using MSI

The MSI installer is the recommended method for all new deployments. It supports silent installation, SCCM, Intune, and GPO deployment natively.

---

Prerequisites

Before running the MSI installer, ensure the following dependencies are installed on the target machine. The MSI installer does NOT install these automatically, unlike the EXE installer.

Dependency	Minimum Version	Download
Microsoft Visual C++ Redistributable 2015–2022	v14.42 or later	Download from Microsoft
.NET Framework	4.8.1 or later	Download from Microsoft

If either dependency is missing, the MSI installation will fail silently. Verify both are installed before proceeding.

UI Mode Installation

1. Obtain the installer package from your 1Kosmos representative. The package contains:

   • 1KosmosCredentialProvider-<version>.msi

   • registryconfig.ini

2. Right-click 1KosmosCredentialProvider-<version>.msi and select Run as administrator.

3. Follow the on-screen installation wizard.

4. Default installation directory: C:\Program Files\1Kosmos\1KosmosCredentialProvider

5. Log files are available at: C:\Program Files\1Kosmos\1KosmosCredentialProvider\Logs

6. Restart the workstation after installation is complete.

A restart is required for the Credential Provider to appear on the Windows login screen.

Silent Installation

For deployments where no user interaction is required.

To install silently (no UI, no restart):

Install silently with no UI and no restart:

msiexec /i 1KosmosCredentialProvider-<version>.msi /qn /norestart

Install silently with registry configuration applied at install time:

msiexec /i 1KosmosCredentialProvider-<version>.msi /qn REGISTRYCONFIG="C:\temp\registryconfig.ini" /norestart

Install with wizard visible but no user input required:

msiexec /i 1KosmosCredentialProvider-<version>.msi /norestart

Install with wizard visible and registry configuration:

msiexec /i 1KosmosCredentialProvider-<version>.msi REGISTRYCONFIG="C:\temp\registryconfig.ini" /norestart

/norestart: Use when deploying via SCCM or Intune to control the restart separately. Without this flag, the installer restarts the machine immediately after installation.

REGISTRYCONFIG: The path must be a full absolute path. Relative paths are not supported.

Configuring registryconfig.ini

The registryconfig.ini file applies tenant connection details and registry settings during installation. It is included in the installer package received from your 1Kosmos representative.

Registry Key	Type	Description	Example Value
tenantUrl	REG_SZ	Tenant URL to connect to the 1Kosmos platform	acme.1kosmos.net
communityName	REG_SZ	Name of the 1Kosmos community	default
proxyUrl	REG_SZ	URL of the proxy server (optional)	http://12.12.12.12:8083/proxy.pac
proxyUsername	REG_SZ	Username for authenticated proxy (optional)	username
proxyPassword	REG_SZ	Password for authenticated proxy (optional)	[your proxy password]
VaultUrl	REG_SZ	CyberArk vault URL (shared account deployments only)	sampletest.privilegecloud.cyberark.com
VaultUser	REG_SZ	CyberArk vault service account username	svc_account
VaultUserCredential	REG_SZ	CyberArk vault service account password	[your vault password]
VaultProxyUrl	REG_SZ	CyberArk proxy URL (optional)	192.168.0.0
VaultProxyApiKey	REG_SZ	CyberArk proxy API key	d0f100ab-xx76-4xx8-bxc2-7xx175xxx22b
RdpDisabled	REG_DWORD	When set to 1, bypasses RDP logins allowing native credential passthrough	0
ClearLastUsedProvider	REG_DWORD	When set to 1, OS does not remember the last used provider	0
DisablePwdOnLogin	REG_DWORD	When set to 1, disables the password provider during Login/Unlock	0
DisablePwdOnCredUI	REG_DWORD	When set to 1, disables the password provider during CredUI (Run As / RDP)	0
Disable1KosmosOnLogin	REG_DWORD	When set to 1, hides the 1Kosmos Credential Provider during Login/Unlock	0
Disable1KosmosOnCredUI	REG_DWORD	When set to 1, excludes 1Kosmos from CredUI flows	0

The registryconfig.ini file does not support double quotes in any value. Passwords containing double quotes will cause configuration to fail.

All configuration is applied to the Windows Registry. The config.json file used in EXE v1.x installations is not used by the MSI installer.

---

Mass Deployment

SCCM / Microsoft Endpoint Configuration Manager

msiexec /i 1KosmosCredentialProvider-<version>.msi /qn REGISTRYCONFIG="\\server\share\registryconfig.ini" /norestart

Pre-stage the registryconfig.ini file to a network share or include it in the deployment package. Schedule the restart through SCCM separately.

Microsoft Intune

Wrap the MSI using the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) and create a Win32 app in Intune with the following settings:

Install command: msiexec /i 1KosmosCredentialProvider-<version>.msi /qn REGISTRYCONFIG="C:\temp\registryconfig.ini" /norestart

Uninstall command: msiexec /x 1KosmosCredentialProvider-<version>.msi /qn /norestart

Detection rule: File detection on C:\Program Files\1Kosmos\BlockIDCredentialProvider\

Group Policy (GPO)

Add the MSI to a GPO software installation policy targeting the relevant computer OUs.

GPO software installation does not support passing MSI properties such as REGISTRYCONFIG directly. Configure registry settings separately using a GPO Registry preference or a startup script that runs the silent install command with the REGISTRYCONFIG parameter.