Installer command lines

This page lists every installer Netzilo publishes for the Netzilo client and the Enterprise Browser, the parameters each one accepts, and the command line for each deployment case: interactive, silent, non-admin, pre-enrolled, upgrade and uninstall.

Read Pick the file first. The Windows client has four installer files that look alike but take different switches. A switch that is right for one file is ignored by another, and the install then succeeds in the wrong mode.

Pick the file

All files are served from https://pkg.netzilo.com.

There is no x86 or ARM64 Windows MSI and no ARM64 Windows EXE. On Windows on ARM, the x64 installers install in non-admin mode automatically.

How the Windows installers work

All four Windows client files run the same install engine, installer.exe, which copies itself to %ProgramData%\Netzilo Client. What follows holds for every file:

• The engine elevates itself. Run as SYSTEM (Intune or ConfigMgr device context) or as an elevated administrator, there is no prompt. Run as a standard user, Windows shows a UAC prompt, even under /qn. If the prompt is cancelled, the install fails with exit code 1. It does not fall back to non-admin mode.
• The install folder is fixed at %ProgramData%\Netzilo Client. INSTALLDIR, /D= and TARGETDIR have no effect.
• A pending reboot blocks the install. After a driver update, the next install says "Please reboot computer and try again." Reboot first.
• A failed install rolls back completely and deletes %ProgramData%\Netzilo, including its own logs. Always write the MSI log to a path outside that folder.

Quick reference

Windows MSI

The MSI is the only Windows client file whose properties are parsed reliably and that suppresses every dialog. It is a per-user package (x64) with one Add/Remove Programs entry, Netzilo Client. Its ProductCode changes with every build.

Other properties in the package, such as INSTALLDIR, SHOWTRAY or FORCE_UPDATE, do nothing.

:: Silent install, admin mode
msiexec /i netzilo_x64.msi /qn /norestart /l*v "%TEMP%\netzilo_msi.log"

:: Silent install, pre-enrolled
msiexec /i netzilo_x64.msi /qn /norestart CONFIGFILE="C:\Deploy\netzilo-deploy.json" /l*v "%TEMP%\netzilo_msi.log"

:: Config file next to the .msi
msiexec /i "\\fs01\pkg\netzilo\netzilo_x64.msi" /qn /norestart CONFIGFILE=netzilo-deploy.json

:: Silent install, non-admin mode
msiexec /i netzilo_x64.msi /qn /norestart NONADMIN=1

Always pass /norestart (or REBOOT=ReallySuppress). When a driver update needs a reboot, the package schedules one, and without suppression a silent install can restart the machine. With suppression the install returns 3010 and the reboot is up to you.

From PowerShell, keep each property in one argument:

Start-Process msiexec.exe -Wait -ArgumentList '/i','netzilo_x64.msi','/qn','/norestart','CONFIGFILE="C:\Deploy\netzilo-deploy.json"','/l*v','C:\Windows\Temp\netzilo_msi.log'

Intune, SCCM and Group Policy

• Run in device (system) context. In Intune, package the MSI as a Windows app (Win32) with install behaviour System. Do not use a line-of-business MSI app: Intune installs a per-user MSI in the user's context, where a standard user gets a UAC prompt they cannot complete. In ConfigMgr, choose "Install for system". With Group Policy, use computer configuration software installation.

• Install command: msiexec /i netzilo_x64.msi /qn /norestart, plus CONFIGFILE="…" if you pre-enrol.

• Detection rule: never the MSI ProductCode, which changes with every build. Detect the file %ProgramData%\Netzilo Client\netzilo.exe, or the registry value Version under HKLM\SOFTWARE\Netzilo (admin mode; non-admin installs write it under HKCU).

• Return codes:

  Code	Meaning
  0	success
  3010	success, reboot required (with /norestart)
  1603	the install engine failed
  1618	another install is running

• Installed as SYSTEM, the Netzilo Client entry belongs to SYSTEM and is not shown to signed-in users. Uninstall it from the same context.

Upgrades. The MSI upgrades any installed Netzilo Client MSI in place, including the same version, and the device keeps its configuration and identity. Builds of one release line can replace each other in either direction, so deploy the build you mean.

Offline EXE

nz_installer_64.exe carries the whole client and needs no internet.

This file parses NONADMIN= and CONFIGFILE= loosely. The value of each option runs to the next letter N (for NONADMIN=) or C (for CONFIGFILE=) that is not inside quotes:

Rules: quote the CONFIGFILE path, put the option last, and never pass both options to this file. Under /S, error and reboot message boxes can still appear. Do not rely on the exit code; check that the service runs and netzilo.exe exists. The log is %ProgramData%\Netzilo\netzilo_offline_nsis_install.log.

Pack

nz_installer_64.pack is the same client as a self-extracting archive. Rename it to .exe before you run it. It is the only file that takes non-admin mode and a config file together reliably.

copy nz_installer_64.pack nz_installer_64.exe
nz_installer_64.exe -s
nz_installer_64.exe -s -na "--config-file=C:\Deploy\netzilo-deploy.json"

Online EXE

netzilo_setup.exe is a small downloader. It downloads the real installer while it runs, so it needs internet, and fails offline with "failed to download installer." It takes the same options as the offline EXE, with the same parsing.

It exits with 0 even when the download or the install failed. A deployment tool cannot tell a failed install from a good one. Use it only for a person installing by hand. The log is %ProgramData%\Netzilo\netzilo_online_install.log.

Tenant-named installers

An installer that Netzilo prepares for a tenant has a file name ending in _<tenant>, such as netzilo_x64_acme.msi. When it runs, it downloads that tenant's configuration and writes it over the device's config.json, on every run, upgrades included. The device's identity is replaced by the published one. Upgrade with the plain-named file, netzilo_x64.msi, to keep each device's identity.

Renaming a published file to …_<anything> makes the installer look for a tenant of that name. Keep the published file names.

Admin mode and non-admin mode

• The mode is chosen at the first install and remembered. Upgrades and uninstalls read it back; you do not pass NONADMIN again.
• A non-admin install over an admin install is refused: "Admin mode is already installed, please uninstall Netzilo Client and try again." An admin install over a non-admin install removes the non-admin install first.
• On Windows on ARM every install is network-only.

Pre-enrol with a config file

CONFIGFILE (MSI, EXE) and --config-file (pack) take the input of netzilo deploy-user, not a settings file. With an administrator's or agent's access token, the installer creates (or updates) a Netzilo user and an access token for that user, and the device signs in with that token. No SSO sign-in is involved.

String values may use ${VARIABLE} environment expansion.

{
  "servicetoken": "nzl_…",
  "use_current_user": true,
  "groups": ["Laptops", "Sales"],
  "tokenname": "device-enrolment",
  "tokenexp": 365
}

The user is created with the role user, and the token is stored encrypted in %ProgramData%\Netzilo\pat.dat. A wrong token or an unreachable server does not fail the install: you get a device that is installed but not enrolled. Check the devices under Endpoint > Peers after the rollout.

Upgrade and uninstall on Windows

Upgrade. Run any client file over an installed client. The engine stops the services and drivers, replaces the files and restarts them. Configuration and identity are kept, except with a tenant-named file or a CONFIGFILE that contains apiurl. When a driver changed while it was loaded, the upgrade asks for a reboot (MSI 3010), and further installs are refused until you reboot. The EXE forms do not compare versions.

Uninstall.

• -u alone shows dialogs; -u -s hides only the progress window.
• The engine's uninstall always returns 0. Check that %ProgramData%\Netzilo Client is gone.
• Uninstall removes everything, with no option to keep configuration: the services and drivers, %ProgramData%\Netzilo Client, %ProgramData%\Netzilo (configuration, identity, pat.dat, logs), C:\Netzilo, the registry keys, shortcuts and the PATH entry. A reinstall is a new peer; delete the old one under Endpoint > Peers.

Enterprise Browser MSI

netzilo_enterprise_browser.msi is a per-machine x64 package. It installs to %ProgramFiles%\Netzilo\NetziloEnterpriseBrowser\Application\.

Neither property is remembered. Pass both on every install and upgrade. An upgrade without TENANT writes an empty tenant, and one without SHORTCUTNAME removes the custom shortcut name.

:: Netzilo Cloud
msiexec /i netzilo_enterprise_browser.msi /qn /norestart TENANT=https://go.netzilo.com SHORTCUTNAME="Acme Browser" /l*v "%TEMP%\netzilo_browser_msi.log"

:: Self-hosted server
msiexec /i netzilo_enterprise_browser.msi /qn /norestart TENANT=https://netzilo.example.com SHORTCUTNAME="Acme Browser"

TENANT must not contain spaces or double quotes. Detect the install by the file %ProgramFiles%\Netzilo\NetziloEnterpriseBrowser\Application\netzilobrowser.exe. Return codes are the standard msiexec codes.

Uninstall: msiexec /x {ProductCode} /qn /norestart. If the browser has updated itself since that MSI was installed, this fails with 1603. Then run the browser's own uninstaller (below) and remove the MSI registration with msiexec /x {ProductCode} /qn.

Enterprise Browser EXE

netzilo_enterprise_browser.exe is the browser's own installer with Netzilo switches.

:: Per-machine, in-browser updates kept working
netzilo_enterprise_browser.exe --system-level --netzilo-tenant=https://go.netzilo.com --netzilo-update=https://pkg.netzilo.com/download/windows/browser_updates.json --shortcut-name="Acme Browser"

:: Per-user
netzilo_enterprise_browser.exe --netzilo-tenant=https://go.netzilo.com --netzilo-update=https://pkg.netzilo.com/download/windows/browser_updates.json

Values must not contain double quotes or backslashes. Running the EXE again updates in place; downgrades are allowed. The browser carries its own copy of the Netzilo client and does not use an installed Netzilo client service.

Uninstall:

"%ProgramFiles%\Netzilo\NetziloEnterpriseBrowser\Application\<version>\Installer\setup.exe" --uninstall --system-level --force-uninstall

<version> is the folder name of the installed version. For a per-user install, run the same command from %LOCALAPPDATA%\Netzilo\NetziloEnterpriseBrowser\Application\<version>\Installer\ without --system-level.

macOS

sudo installer -pkg nz_installer_arm64.pkg -target /     # Apple silicon
sudo installer -pkg nz_installer_amd64.pkg -target /     # Intel

• The package takes no parameters and reads no configuration at install time. It installs /Applications/Netzilo.app, then installs and starts the service and the menu-bar app. Installing it again upgrades in place.
• It adds the client to the PATH of the account that runs the installer, which is root under sudo, Jamf or another MDM. In scripts, call /Applications/Netzilo.app/Contents/MacOS/netzilo by its full path.
• Enrol after the install: sudo /Applications/Netzilo.app/Contents/MacOS/netzilo up --setup-key <KEY> (add --management-url https://<your-domain> for self-hosted), or let the user sign in from the menu-bar app.
• Jamf or another MDM: deploy the package as is and run the netzilo up line as a policy script. Pre-approve the system extensions com.netzilo.NetziloFilter and com.netzilo.NetziloSecurity with a SystemExtensions payload, and grant Full Disk Access with a separate privacy preferences profile. Without Full Disk Access the security features stay off.

The Enterprise Browser for macOS (.dmg from the Add Peer dialog) installs /Applications/Netzilo Enterprise Browser.app and has no install-time parameters.

Linux

curl -fsSL https://pkg.netzilo.com/download/linux/install_netzilo_linux.sh | sh

• The script takes no arguments and no environment variables. It needs sudo, wget and systemd. It removes an existing client, installs /usr/bin/netzilo and the service Netzilo, then starts and enables it.
• Running it again upgrades the client and logs the device out.
• Enrol after the install: sudo netzilo up --setup-key <key> (add --management-url https://<your-domain> for self-hosted).
• Without the script: download https://pkg.netzilo.com/download/linux/netzilo, then netzilo service install and netzilo service start.
• There is no .deb or .rpm package of the client.

Troubleshooting

nz_installer_64.exe -s shows the installer pages. -s is not a switch of the offline EXE. Use /S, or the MSI.

NONADMIN=1 on an EXE gave an admin install. The option was not the last argument. Put it last, or use the MSI.

An EXE with CONFIGFILE= installed, but the device is not enrolled. The unquoted path contained a C, or deploy-user failed (wrong token, server not reachable). Use the MSI's CONFIGFILE, check the token, or enrol with netzilo up --setup-key.

"Cannot access config file." The path does not exist for the account running the installer (SYSTEM cannot read a user's mapped drive), or NONADMIN=1 was appended to the path. Use an absolute local or UNC path that account can read.

"Please reboot computer and try again." A driver change waits for a reboot. Reboot and run the install again.

"Please uninstall sandbox software and try again." Sandboxie is running. Remove it first.

The install fails right after a UAC prompt was cancelled. There is no fallback to non-admin mode. Deploy as SYSTEM, run elevated, or pass NONADMIN=1.

The MSI returns 1603. The install engine failed, and the MSI log shows only "returned actual error code 1". Run the pack with -s on that machine to see the engine's message, and check the causes above. The engine's own log, %ProgramData%\Netzilo\installer_internal.log, is encrypted and readable by Netzilo support only; attach it to a support case.

A silent install restarted the machine. /norestart was missing.

The online EXE "succeeded" but nothing is installed. It always exits with 0. Use the MSI.

Intune reports the app as not installed after a new release. The detection rule uses the ProductCode. Detect by file or registry.

A device lost its identity after an upgrade. A tenant-named installer or a CONFIGFILE with apiurl was used. Upgrade with the plain-named MSI and no CONFIGFILE, and delete the old peer.

The browser shortcut lost its name, or the extension shows no portal, after an MSI upgrade. SHORTCUTNAME or TENANT was not passed again. Redeploy with both.

Related Documentation

• Install Netzilo - the Add Peer dialog and interactive installs on every platform
• Setup Keys - keys for enrolling servers after a silent install
• Agents - service accounts and their access tokens for deploy-user
• CLI - netzilo up, deploy-user and the other commands
• Enterprise Browser - what the Enterprise Browser is
• Troubleshooting client issues - problems after the install