Deploying the desktop app

Installers

The MSI installs the app in Program Files for everyone on the computer, with a Start menu entry and no desktop icon, and has it start at every sign-in, in the notification area; msiexec /x with the same file removes it. The PKG installs it in Applications and adds a launch agent that starts it at every sign-in, in the menu bar; to remove it, delete /Applications/Tokaware.app and /Library/LaunchAgents/com.tokaware.app.plist. Each installs over an older version.

Installed for everyone, the app does not update itself: install each new version the same way. The EXE, DMG and AppImage, which people install for themselves, keep themselves up to date unless the configuration below turns that off. Every release is on the releases page (tokaware.com/releases), its files at downloads.tokaware.com with the checksum of each in SHA256SUMS.txt.

The managed configuration

What the configuration sets comes before anything chosen in the app, and before the organization's policy where it is stricter. The app reads it when it starts, so a change takes effect the next time it starts. Leave out what you do not set.

Where it goes

On Windows the app reads the policy key in HKEY_LOCAL_MACHINE first, then managed.json in ProgramData, then the same policy key in HKEY_CURRENT_USER: the first with a good value for a key decides it. In the registry, text is a string value and true or false a DWORD of 1 or 0. On macOS it reads the computer's profile before the user's.

managed.json

For C:\ProgramData\Tokaware\managed.json on Windows and /etc/tokaware/managed.json on Linux.

{
  "organization": "YOUR-ORGANIZATION-ID",
  "requireEnrollment": true,
  "lockConnection": true
}

The registry

A .reg file for the policy key, or the same values set by Group Policy preferences or a script.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Tokaware]
"organization"="YOUR-ORGANIZATION-ID"
"requireEnrollment"=dword:00000001
"lockConnection"=dword:00000001

macOS

The keys for a configuration profile's custom settings, for the preference domain com.tokaware.app. On macOS 13 and later, people are told a background item was added; a managed login items payload for the label com.tokaware.app keeps them from turning it off.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>organization</key>
  <string>YOUR-ORGANIZATION-ID</string>
  <key>requireEnrollment</key>
  <true/>
  <key>lockConnection</key>
  <true/>
</dict>
</plist>

What people see

• With requireEnrollment, the app asks whoever uses it to sign in, with a notification when it started out of sight, and connects the computer to the organization as soon as they have, again when someone else signs in there. Someone who is not in the organization is told to ask for an invite.
• Settings, General says the app is managed by their organization and lists what it sets; the computer's panel says what its IT set, offers no organization but the one named, and no Disconnect with lockConnection.
• Remote sessions and what sessions say go no further than the configuration and the organization's policy both allow, whatever the app's own settings say.

What the organization sees

The Computers tab marks each managed computer, next to its enrollment, version and settings, and holds it to the organization's policy like any other. Computers without the app can report through Claude Code's and Codex's own telemetry instead (Settings, Collection).

• Security
• API