Enterprise deployment / Windows

# Install Muniment Desktop on Windows

Preview reference for the two verified Windows package contracts. Installers are not publicly available during preview; use the package supplied through your approved release channel.

## Choose a package

The `-machine.msi` package installs for the machine under `%ProgramFiles%`. It requires administrator rights and is available to every user of the computer. The NSIS executable installs under `%LocalAppData%` without administrator rights and is available only to the current user.

## Verify the signature

Windows packages supplied through your approved release channel are code-signed via Azure Trusted Signing under Green Kangaroo, LLC. Before fleet deployment, run the checks below. Continue only when SignTool reports a successful signature check and PowerShell reports the signer as `CN=Green Kangaroo LLC`.

signature and publisher verification

```
signtool verify /pa /v muniment-machine.msi
(Get-AuthenticodeSignature .\muniment-machine.msi).SignerCertificate.Subject
```

## Per-machine MSI

Run the MSI from an elevated Command Prompt or a deployment agent with administrator rights. Use the artifact whose name ends in `-machine.msi`; do not set `ALLUSERS` on another MSI to change its scope.

silent install

```
msiexec.exe /i "muniment-machine.msi" /qn /norestart
```

silent uninstall

```
msiexec.exe /x "muniment-machine.msi" /qn /norestart
```

`/qn` displays no interface and `/norestart` prevents Windows Installer from restarting the computer. The calling system should handle a restart if `msiexec.exe` returns 3010.

## Per-user NSIS

Run both commands in the target user's session so `%LocalAppData%` and the per-user registration refer to that user. The installer does not require administrator rights. The `/S` switch is case-sensitive.

silent install

```
muniment-nsis.exe /S
```

silent uninstall

```
"%LocalAppData%\muniment\uninstall.exe" /S
```

## Upgrade support

The per-machine MSI has a stable Windows Installer upgrade identity, so a newer Muniment MSI upgrades an installed copy in place. The verified package contract does not promise upgrade-in-place behavior for the per-user NSIS installer; use the MSI where supported fleet upgrades are required.