--- updatedAt: 2026-06-12T12:35:13.000Z agentTools: siteIndex: https://techdocs.akamai.com/llms.txt projectIndex: https://techdocs.akamai.com/guardicore-platform-agent/llms.txt --- # Silent installation For deploying Guardicore Platform Agent on multiple workstations, consider using software deployment solutions. Command-line installation is supported, though specific commands vary depending on your environment. Silent installation requires downloading platform-specific installers (Windows or Mac). You can append optional arguments to the installation command to preconfigure Guardicore Platform Agent with an [IdP hostname](https://techdocs.akamai.com/eaa/docs/id-idps), [ETP entitlement or activation code](https://techdocs.akamai.com/etp/docs/view-entitlement-code), and other settings.\ Before installation, the silent installer removes any existing version of Guardicore Platform Agent. To set up the Segmentation service in the agent, refer to the [Guardicore Segmentation documentation](https://techdocs.akamai.com/segmentation-v51/docs/the-unified-agent#agent-installation). > 📘 Manual upgrade and OTA upgrade limitations > > When updating the agent to a new version, only the `AUTO_START`, `MINIMIZED`, and `ALLOW_DOWNGRADE` parameters are evaluated and applied during installation. # ​Akamai​ Guardicore Platform Agent silent install on Windows Follow these steps to install the agent on Windows using a command line interface. ## Use the `MSI` installer 1. [Download the latest Guardicore Platform Agent `MSI` installer for Windows from ​Enterprise Center](https://techdocs.akamai.com/guardicore-platform-agent/docs/manage-client-versions#download-the---installer-copy-the-installer-url-or-hash-code). 2. Open the command line (`cmd`), navigate to your downloads directory, and enter the following command to start the silent installation. Replace `` with the version number from the downloaded installer file. ```shell msiexec /i -windows.msi> /quiet ``` 3. The installation starts and runs silently. After the installation is complete, the Guardicore Platform Agent window opens. If you encounter any issues during the installation, refer to the [troubleshooting section](https://techdocs.akamai.com/guardicore-platform-agent/docs/troubleshoot-akamai-zero-trust-client). > ❗️ Component selection parameters > > When you specify at least one component selection parameter in Guardicore Platform Agent 7.1.0 or later, the installer doesn't install components that aren't specified.\ > If you don't specify any component selection parameters, the agent is enabled with Access (Cloud Zone and Edge Transport) and Threat Protection. You can use the following optional parameters: [block:parameters] { "data": { "h-0": "Parameter", "h-1": "What it does", "0-0": "`THREAT_PROTECTION=\"enable\"` \n \nThis parameter is available in Guardicore Platform Agent 7.2.0 and later. For 7.1.0, see `DNS_FIREWALL`.", "0-1": "This is a component selection parameter. \n \nInstalls Threat Protection.", "1-0": "`DNS_FIREWALL=\"enable\"` \n \nThis parameter is available in Guardicore Platform Agent 7.1.0. For earlier versions, see `WITH_ETP`.", "1-1": "This is a component selection parameter. \n \nInstalls DNS Firewall (Threat Protection).", "2-0": "`ACCESS_DPOP=\"enable\"` \n \nThis parameter is available in Guardicore Platform Agent 7.1.0 and later.", "2-1": "This is a component selection parameter. \n \nInstalls Access Cloud Zone Transport component.", "3-0": "`ACCESS_EDGE=\"enable\"` \n \nThis parameter is available in Guardicore Platform Agent 7.1.0 and later.", "3-1": "This is a component selection parameter. \n \nInstalls Access Edge Transport component (automatically installs Access Cloud Zone Transport).", "4-0": "`SEGMENTATION=\"enable\"` \n \nThis parameter is available in Guardicore Platform Agent 7.1.0 and later.", "4-1": "This is a component selection parameter. \n \nRequires `GC_SERVER_ADDRESSES` . \nInstalls Guardicore Network Segmentation Agent component.", "5-0": "`HEADLESS=\"yes\"` \n \nThis parameter is available in Guardicore Platform Agent 7.1.0 and later.", "5-1": "Requires `SEGMENTATION=\"enable\"`. \n \nInstalls the Segmentation agent in a headless mode (GUI isn't installed). \n \nUse this parameter if Segmentation is the only service set up in the agent (Access and DNS Firewall are disabled).", "6-0": "`IDP=\"youridphostname.com\"`", "6-1": "Specifies the hostname of your Identity Provider (IdP) for authentication after installation. Enter the IdP hostname without the `https://` protocol prefix.", "7-0": "`TOKEN=\"ETP activation or entitlement code\"`", "7-1": "Activates Threat Protection with an ETP activation or entitlement code after installation. If you're using the command line to distribute the Guardicore Platform Agent across many computers with device management software, enter the [entitlement code](https://techdocs.akamai.com/etp/docs/view-entitlement-code#view-entitlement-code). If you're activating the agent on a user's personal computer, you can enter an entitlement code or an [activation code](https://techdocs.akamai.com/etp/docs/set-up-byod#email-activation-codes-to-users).", "8-0": "`AUTO_START=\"no\"\\|\"yes\"`", "8-1": "Set to `no` to prevent the Guardicore Platform Agent GUI from launching automatically after successful installation. Note that if the user manually starts the agent, it will automatically launch from then on at OS boot, unless you specify `START_ON_BOOT=\"no\"`. \nThis parameter isn't usually needed. Use it only if you have a strong reason to do so. \n \nSet to `yes` to launch Guardicore Platform Agent automatically after successful installation. \n \nIf unspecified, this parameter defaults to `yes`.", "9-0": "`START_ON_BOOT=\"no\"\\|\"yes\"`", "9-1": "Set to `no` to prevent the Guardicore Platform Agent GUI from launching automatically at OS startup. This parameter suppresses the autostart functionality, even if the user has manually started the client in the past. \n \nWith Threat Protection enabled in Enterprise Center, Guardicore Platform Agent onboards traffic to SIA even if the GUI is not running. \n \nWith Access enabled in Enterprise Center, Guardicore Platform Agent doesn’t onboard traffic to EAA if the GUI is not running or the user is not authenticated. \n \nSet to `yes` to launch Guardicore Platform Agent automatically at OS startup. \n \nIf unspecified, this parameter defaults to `yes`.", "10-0": "`MINIMIZED=\"yes\"\\|\"no\"`", "10-1": "Set to `yes` to start the Guardicore Platform Agent GUI minimized after successful installation. \n \nSet to `no` to display the Guardicore Platform Agent GUI after successful installation. \n \nIf unspecified, this parameter defaults to `no`. \n \nThis parameter applies only if autostart isn’t disabled with the `AUTO_START=\"no\"` parameter. \n \nThis parameter only takes effect if one of the following parameters is also specified: `IDP`, `TOKEN`, or `GC_SERVER_ADDRESSES`. If none of these are provided, the GUI launches in normal mode and the user is prompted to set up the agent, regardless of the `MINIMIZED=\"yes\"` setting.", "11-0": "`AZTC_LANG=\"\"`", "11-1": "Sets the display language. English is the default language. \n \nAvailable values are the following: `Japanese`, `Brasil`.", "12-0": "`FORWARD_PROXY=\"enable\"`", "12-1": "Proxy is disabled by default. Specifying this parameter with an `enable` value launches the agent with Remote Proxy enabled after successful installation. This lets Guardicore Platform Agent use your manually configured OS proxy settings. \nTo learn more about using proxies with Guardicore Platform Agent, refer to the [proxy documentation](https://techdocs.akamai.com/guardicore-platform-agent/docs/proxy-support).", "13-0": "`FORWARD_PROXY_URL=://:`", "13-1": "With `FORWARD_PROXY` enabled, this parameter lets you use a PAC file and specify your forward proxy’s protocol, hostname, and port. \n \nAccepted protocols: `https` \nAccepted hosts: `IPv4`, `IPv6`, and `domain name`

If you’d like to use an IPv6 address in a URL, encase it in a bracket. For example: `https://[2001:db8::1]:80` \n \nIf your organization uses a PAC file, you need to modify it for it to work with Guardicore Platform Agent. Contact your ​Akamai​ account representative for assistance. \nTo learn more about using proxies with Guardicore Platform Agent, refer to the [proxy documentation](https://techdocs.akamai.com/guardicore-platform-agent/docs/proxy-support).", "14-0": "`GC_OFFLINE_INSTALL=\"true\"\\|\"false\"`", "14-1": "When set to `true`, Segmentation is installed using the Agent version bundled with the installer (network connectivity to the Aggregator is not required).", "15-0": "`GC_SERVER_ADDRESSES=\":,:\"`", "15-1": "Comma-separated Aggregator IP addresses or hostnames. Addresses are provided by the Centra technical platform owner.", "16-0": "`GC_PASSWORD=\"\"`", "16-1": "Agent installation passphrase. Retrieve from the Centra UI: Administration → System → Configuration → Agents installation → Agents installation password", "17-0": "`GC_DATA_PATH=\"\"`", "17-1": "Sets custom installation path for the Segmentation data files (certificates, log files, configuration, and storage).", "18-0": "`GC_LOGGING_PROFILE=\"\"`", "18-1": "Sets the logging rotation profile for the Segmentation agent ('min', 'max' or 'medium').", "19-0": "`GC_PROFILE=\"\"`", "19-1": "Install Segmentation agent modules from a specific profile.", "20-0": "`GC_LABELS=\"\"`", "20-1": "List of labels in the form of `key1:value1,key2:value2` for labeling the Segmentation agent instance.", "21-0": "`GC_OVERRIDE_UUID_FILE _RELOAD=\"true\"`", "21-1": "Don't use semi-persistent UUID file to mark agent UUID (Windows 2003 and above).", "22-0": "`WITH_ETP=\"false\"` \n \nFor Guardicore Platform Agent 7.1.0 and later, see `DNS_FIREWALL`. \nThis parameter isn't available in Guardicore Platform Agent 7.2.0 and later.", "22-1": "Set to `false` to permanently disable Threat Protection on the workstation, even if it’s available in your contract and configured in Enterprise Center. \n \nTo re-enable Threat Protection, reinstall the agent without this parameter.", "23-0": "`ALLOW_DOWNGRADE=\"yes\"`", "23-1": "By default, Guardicore Platform Agent prevents end-users from manually downgrading to an older version of the agent. If the end-user attempts to install an older version of the agent, the installation fails and agent operation remains uninterrupted. \n \nBy specifying this parameter with a `yes` value, you allow your end-users to downgrade the agent using an older version of the Guardicore Platform Agent installer. \n \nThis parameter applies only to manual downgrade attempts. You can deploy a [client downgrade from Enterprise Center](https://techdocs.akamai.com/guardicore-platform-agent/docs/manage-client-versions#automatic-upgrade) regardless of this setting.", "24-0": "`DEBUG_LOG_ON_START=\"yes\"`", "24-1": "Enables debug logging immediately after successful agent installation. " }, "cols": 2, "rows": 25, "align": [ "left", "left" ] } [/block] **Example** The following command silently installs Guardicore Platform Agent with a pre-configured IdP hostname: ```shell msiexec /i -windows.msi> IDP="connect.company.com" /quiet ``` Next, you can [configure your ​Akamai​ Guardicore Platform Agent](https://techdocs.akamai.com/guardicore-platform-agent/docs/configure-aztc). # ​Akamai​ Guardicore Platform Agent silent install on macOS Follow these steps to install the agent on macOS using a command line interface. ## Use the `PKG` installer > 👍 Install Guardicore Platform Agent components selectively > > The `PKG` installer doesn't support component selection parameters. To selectively install Guardicore Platform Agent components on macOS, use the [`SH` installer](https://techdocs.akamai.com/guardicore-platform-agent/docs/silent-installation#use-the-sh-installer). 1. [Download the latest Guardicore Platform Agent `PKG` installer for macOS from ​Enterprise Center](https://techdocs.akamai.com/guardicore-platform-agent/docs/manage-client-versions#download-the---installer-copy-the-installer-url-or-hash-code). 2. You can specify these optional parameters in `gpa-install.cfg` before you install the agent: > 📘 > > Place the `gpa-install.cfg` configuration file in the same directory as the installer package. The configuration file gets deleted automatically after successful installation. [block:parameters] { "data": { "h-0": "Parameter", "h-1": "What it does", "0-0": "`IDP=youridphostname.com`", "0-1": "Specifies the hostname of your Identity Provider (IdP) for authentication after installation. Enter the IdP hostname without the `https://` protocol prefix.", "1-0": "`TOKEN=`", "1-1": "Activates Threat Protection with an ETP activation or entitlement code after installation. If you're using the command line to distribute the Guardicore Platform Agent across many computers with device management software, enter the [entitlement code](https://techdocs.akamai.com/etp/docs/view-entitlement-code#view-entitlement-code) . If you're activating the agent on a user's personal computer, you can enter an entitlement code or an [activation code](https://techdocs.akamai.com/etp/docs/set-up-byod#email-activation-codes-to-users) .", "2-0": "`AUTO_START=no\\|yes`", "2-1": "Set to `no` to prevent the Guardicore Platform Agent GUI from launching automatically after successful installation. Note that if the user manually starts the agent, it will automatically launch from then on at OS boot, unless you specify `START_ON_BOOT=\"no\"`. \nThis parameter isn't usually needed. Use it only if you have a strong reason to do so. \n \nSet to `yes` to launch Guardicore Platform Agent automatically after successful installation. \n \nIf unspecified, this parameter defaults to `yes`.", "3-0": "`START_ON_BOOT=no\\|yes`", "3-1": "Set to `no` to prevent the Guardicore Platform Agent GUI from launching automatically at OS startup. This parameter suppresses the autostart functionality, even if the user has manually started the client in the past. \n \nWith Threat Protection enabled in Enterprise Center, Guardicore Platform Agent onboards traffic to SIA even if the GUI is not running. \n \nWith Access enabled in Enterprise Center, Guardicore Platform Agent doesn’t onboard traffic to EAA if the GUI is not running or the user is not authenticated. \n \nSet to `yes` to launch Guardicore Platform Agent automatically at OS startup. \n \nIf unspecified, this parameter defaults to `yes`.", "4-0": "`MINIMIZED=yes\\|no`", "4-1": "Set to `yes` to start the Guardicore Platform Agent GUI minimized after successful installation. \n \nSet to `no` to display the Guardicore Platform Agent GUI after successful installation. \n \nIf unspecified, this parameter defaults to `no`. \n \nThis parameter applies only if autostart isn’t disabled with the `AUTO_START=\"no\"` parameter. \n \nThis parameter only takes effect if one of the following parameters is also specified: `IDP`, `TOKEN`, or `GC_SERVER_ADDRESSES`. If none of these are provided, the GUI launches in normal mode and the user is prompted to set up the agent, regardless of the `MINIMIZED=yes` setting.", "5-0": "`AZTC_LANG=`", "5-1": "Sets the display language. English is the default language. \n \nAvailable values are the following: `Japanese`, `Brasil`.", "6-0": "`FORWARD_PROXY=enable`", "6-1": "Proxy is disabled by default. Specifying this parameter with an `enable` value launches the agent with Remote Proxy enabled after successful installation. This lets Guardicore Platform Agent use your manually configured OS proxy settings. \nTo learn more about using proxies with Guardicore Platform Agent, refer to the [proxy documentation](https://techdocs.akamai.com/guardicore-platform-agent/docs/proxy-support) .", "7-0": "`FORWARD_PROXY_URL=://:`", "7-1": "With `FORWARD_PROXY` enabled, this parameter lets you use a PAC file and specify your forward proxy’s protocol, hostname, and port. \n \nAccepted protocols:`https` \nAccepted hosts: `IPv4`, `IPv6`, and `domain name`

If you’d like to use an IPv6 address in a URL, encase it in a bracket. For example: `https://[2001:db8::1]:80` \n \nIf your organization uses a PAC file, you need to modify it for it to work with Guardicore Platform Agent. Contact your ​Akamai​ account representative for assistance. \nTo learn more about using proxies with Guardicore Platform Agent, refer to the [proxy documentation](https://techdocs.akamai.com/guardicore-platform-agent/docs/proxy-support).", "8-0": "`GC_OFFLINE_INSTALL=true\\|false`", "8-1": "When set to `true`, Segmentation is installed using the Agent version bundled with the installer (network connectivity to the Aggregator is not required).", "9-0": "`GC_SERVER_ADDRESSES=:,:\"`", "9-1": "Comma-separated Aggregator IP addresses or hostnames. Addresses are provided by the Centra technical platform owner.", "10-0": "`GC_PASSWORD=`", "10-1": "Segmentation Agent installation passphrase. Retrieve from the Centra UI: Administration → System → Configuration → Agents installation → Agents installation password", "11-0": "`GC_DATA_PATH=`", "11-1": "Sets custom installation path for the Segmentation data files (certificates, log files, configuration, and storage).", "12-0": "`GC_LOGGING_PROFILE=`", "12-1": "Sets the logging rotation profile for the Segmentation agent ('min', 'max' or 'medium').", "13-0": "`GC_PROFILE=`", "13-1": "Install Segmentation agent modules from a specific profile.", "14-0": "`GC_LABELS=`", "14-1": "List of labels in the form of `key1:value1,key2:value2` for labeling the Segmentation agent instance.", "15-0": "`WITH_ETP=false` \n \nFor Guardicore Platform Agent 7.1.0 and later, see `DNS_FIREWALL`. \nThis parameter isn't available in Guardicore Platform Agent 7.2.0 and later.", "15-1": "Set to `false` to permanently disable Threat Protection on the workstation, even if it’s available in your contract and configured in Enterprise Center. \n \nTo re-enable Threat Protection, reinstall the agent without this parameter.", "16-0": "`ALLOW_DOWNGRADE=yes`", "16-1": "By default, Guardicore Platform Agent prevents end-users from manually downgrading to an older version of the agent. If the end-user attempts to install an older version of the agent, the installation fails and agent operation remains uninterrupted. \n \nBy specifying this parameter with a `yes` value, you allow your end-users to downgrade the agent using an older version of the Guardicore Platform Agent installer. \n \nThis parameter applies only to manual downgrade attempts. You can deploy a [client downgrade from Enterprise Center](https://techdocs.akamai.com/guardicore-platform-agent/docs/manage-client-versions#automatic-upgrade) regardless of this setting.", "17-0": "`DEBUG_LOG_ON_START=yes`", "17-1": "Enables debug logging immediately after successful agent installation." }, "cols": 2, "rows": 18, "align": [ "left", "left" ] } [/block] 3. Open the macOS Terminal, navigate to your downloads directory, and enter the following command to start the silent installation. Replace `` with the version number from the downloaded installer file. ```shell sudo installer -pkg -macos.pkg> -target / ``` 4. The installation starts and runs silently. After the installation is complete, the Guardicore Platform Agent window opens. If you encounter any issues during the installation, refer to the [troubleshooting section](https://techdocs.akamai.com/guardicore-platform-agent/docs/troubleshoot-akamai-zero-trust-client). **Example** The following commands silently install Guardicore Platform Agent with a pre-configured IdP hostname and ETP code: ```shell cat > ./gpa-install.cfg << EOF IDP=youridphostname.com TOKEN=9ffc01d7-0000-0000-0000-40c3ffbf70fa EOF sudo installer -pkg ./-macos.pkg> -target / rm ./gpa-install.cfg || true ``` ## Use the `SH` installer > ❗️ Component selection parameters > > When you specify at least one component selection parameter in Guardicore Platform Agent 7.1.0 or later, the installer doesn't install components that aren't specified.\ > If you don't specify any component selection parameters, the agent is enabled with Access (Cloud Zone and Edge Transport) and Threat Protection. 1. [Download the latest Guardicore Platform Agent `SH` installer for macOS from ​Enterprise Center](https://techdocs.akamai.com/guardicore-platform-agent/docs/manage-client-versions#download-the---installer-copy-the-installer-url-or-hash-code). 2. Open the Terminal, navigate to your downloads directory, and enter the following command to start the installation. Replace `` with the version number from the downloaded installer file. ```shell GuardicorePlatformAgentInstaller--macos ``` 3. After the installation is complete, the Guardicore Platform Agent window opens. If you encounter any issues during the installation, refer to the [troubleshooting section](https://techdocs.akamai.com/guardicore-platform-agent/docs/troubleshoot-akamai-zero-trust-client). 4. You can specify these optional installation parameters: [block:parameters] { "data": { "h-0": "Parameter", "h-1": "What it does", "0-0": "`-h, --help`", "0-1": "Display a help message and exit.", "1-0": "`-v, --version`", "1-1": "Display installer version information and exit.", "2-0": "`--access-dpop`", "2-1": "This is a component selection parameter. \n \nInstalls Access Cloud Zone Transport.", "3-0": "`--access-edge`", "3-1": "This is a component selection parameter. \n \nInstalls Access Edge Transport.", "4-0": "`--threat-protection` \n \nThis parameter is available in Guardicore Platform Agent 7.2.0 and later. For 7.1.0, see `--dns-firewall`.", "4-1": "This is a component selection parameter. \n \nInstalls Threat Protection.", "5-0": "`--dns-firewall` \n \nThis parameter is available in Guardicore Platform Agent 7.1.0.", "5-1": "This is a component selection parameter. \n \nInstalls Threat Protection.", "6-0": "`--segmentation`", "6-1": "This is a component selection parameter. \n \nInstalls Network Segmentation Agent.", "7-0": "`--headless`", "7-1": "Install without GUI application. Applies only when installing Network Segmentation Agent alone.", "8-0": "`-a, --all`", "8-1": "Install all available components.", "9-0": "`--idp `", "9-1": "Specifies the hostname of your Identity Provider (IdP) for authentication after installation. Enter the IdP hostname without the `https://` protocol prefix.", "10-0": "`--token `", "10-1": "Activates Threat Protection with an ETP activation or entitlement code after installation. If you're using the command line to distribute the Guardicore Platform Agent across many computers with device management software, enter the [entitlement code](https://techdocs.akamai.com/etp/docs/view-entitlement-code#view-entitlement-code) . If you're activating the agent on a user's personal computer, you can enter an entitlement code or an [activation code](https://techdocs.akamai.com/etp/docs/set-up-byod#email-activation-codes-to-users) .", "11-0": "`--allow-downgrade`", "11-1": "By default, Guardicore Platform Agent prevents end-users from manually downgrading to an older version of the agent. If the end-user attempts to install an older version of the agent, the installation fails and agent operation remains uninterrupted. \n \nBy specifying this parameter, you allow your end-users to downgrade the agent using an older version of the Guardicore Platform Agent installer. \n \nThis parameter applies only to manual downgrade attempts. You can deploy a [client downgrade from Enterprise Center](https://techdocs.akamai.com/guardicore-platform-agent/docs/manage-client-versions#automatic-upgrade) regardless of this setting.", "12-0": "`--no-auto-start`", "12-1": "Specify to prevent the Guardicore Platform Agent GUI from launching automatically after successful installation. Note that if the user manually starts the agent, it will automatically launch from then on at OS boot, unless you specify `--no-gui-on-boot`. \nThis parameter isn't usually needed. Use it only if you have a strong reason to do so.", "13-0": "`--minimized`", "13-1": "Specify to start the Guardicore Platform Agent GUI minimized after successful installation. \n \nThis parameter applies only if autostart isn’t disabled with the `--no-auto-start` parameter. \n \nThis parameter only takes effect if one of the following parameters is also specified: `--idp`, `--token`, or `--gc-srv-addr`. If none of these are provided, the GUI launches in normal mode and the user is prompted to set up the agent.", "14-0": "`--no-gui-on-boot`", "14-1": "Specify to prevent the GUI application from starting automatically on system boot. The agent still starts on boot without the GUI.", "15-0": "`--lang `", "15-1": "Sets the display language. English is the default language. \n \nAvailable values are the following: `Japanese`, `Brasil`.", "16-0": "`--gc-password `", "16-1": "Segmentation Agent installation passphrase. Retrieve from the Centra UI: Administration → System → Configuration → Agents installation → Agents installation password", "17-0": "`--gc-srv-addr `", "17-1": "Comma-separated Aggregator IP addresses or hostnames. Addresses are provided by the Centra technical platform owner.", "18-0": "`--gc-offline`", "18-1": "When specified, Segmentation is installed using the Agent version bundled with the installer (network connectivity to the Aggregator is not required).", "19-0": "`--gc-profile `", "19-1": "Install Segmentation agent modules from a specific profile.", "20-0": "`--gc-log-profile `", "20-1": "Sets the logging rotation profile for the Segmentation agent ('min', 'max' or 'medium').", "21-0": "`--gc-labels