icon-zapp.svg
Client Connector

Customizing Zscaler Client Connector with Install Options for MSI

You can use the MSI file to manually install Zscaler Client Connector on a device or if you're deploying the app to your users using GPO, SCCM, or other device management methods that support MSI files. After downloading the Zscaler Client Connector MSI installer file in the Zscaler Client Connector Portal, you can deploy the file as is with your device management method.

You can also add to the file install options to customize the app for your organization using one of the following methods:

  • Orca.exe is available in the Microsoft Windows Software Development Kit (SDK). To learn more, refer to the Microsoft documentation.

    To create an MST file using Orca:

    1. Open Orca and go to File > Open.
    2. Locate and double-click the MSI file.
    3. Go to Transform > New Transform.Clicking the New Transform option to create a MST file for Zscaler Client Connector
    4. In the Tables column, click Property.The Zscaler Client Connector MSI file properties
    5. Edit the values for the following install options or add more options:

      • If your organization is provisioned on more than one cloud, your users are asked to select the cloud where their traffic is sent during the enrollment process.

        With this install option, you can specify the cloud where the app sends user traffic so your users don't have to make the selection during enrollment. This option is not needed if your organization is provisioned on one cloud. The app automatically sends traffic to the proper cloud and your users don't need to make a selection during enrollment.

        This install option is required if you enable the STRICTENFORCEMENT option.

        To add the CLOUDNAME install option:

        1. Click Tables from the top menu, and then click Add Row.

        2. In the Add Row window:

          1. For Property, enter CLOUDNAME.
          2. Press Enter or click the Value field.
          3. For Value, enter the name of the cloud where your organization is provisioned in lowercase letters. For example, if your cloud name is zscalertwo.net, you'd enter zscalertwo. To learn more, see What Is My Cloud Name for ZIA?

          Adding the CLOUDNAME install option for the Zscaler Client Connector MST file

        3. Click OK.

          The install option appears on a new line.CLOUDNAME install option for the Zscaler Client Connector MST file

        Close

      • The DEVICETOKEN install option only applies to Zscaler Internet Access (ZIA). It is not supported by Zscaler Private Access (ZPA).

        This install option allows you to use the Zscaler Client Connector Portal as an IdP. The Zscaler service silently provisions and authenticates users even if you don't have an authentication mechanism in place. Before adding this option, you must generate a device token in the Zscaler Client Connector Portal and complete the full configuration described in Using the Zscaler Client Connector Portal as an IdP.

        To add the DEVICETOKEN install option:

        1. Click Tables from the top menu, and then click Add Row.
        2. In the Add Row window:
          1. For Property, enter DEVICETOKEN.
          2. Press Enter or click the Value field.

          3. For Value, enter the appropriate device token from the Zscaler Client Connector Portal. To learn more, see Using the Zscaler Client Connector Portal as an IdP.

        3. Click OK.

          Adding the DEVICETOKEN install option for the Zscaler Client Connector MST file

          The install option appears on a new line.

          DEVICETOKEN install option for the Zscaler Client Connector MST file

        Close

      • This install option forces the app window to stay hidden before users enroll. Users can always open the window by clicking the app icon in the system tray.

        To enable the HIDEAPPUIONLAUNCH install option:

        1. In the table, double-click on the HIDEAPPUIONLAUNCH value.
        2. Enter 1 as the value. By default, the value is 0 (i.e., disabled).

        HIDEAPPUIONLAUNCH install option for the Zscaler Client Connector MST file

        Close

      • This install option allows you to specify which app profile policy you want to enforce for the app before the user enrolls. All relevant settings associated with the policy apply, including the bypass of the IdP login page. After the user enrolls, this policy is replaced with an app profile policy that matches the user based on group affiliation.

        Prerequisites:

        • This install option is only applicable and required if you enable the STRICTENFORCEMENT option and want users to enroll with the app before accessing the internet.
        • In the Zscaler Client Connector Portal, you must configure the app profile policy that you want to enforce and ensure that the custom PAC file associated with that policy includes a bypass for your IdP login page. This allows the user to access the IdP page to log in as necessary before enrolling with the app.

        To add the POLICYTOKEN install option:

        1. Click Tables from the top menu, and then click Add Row.
        2. In the Add Row window:
          1. For Property, enter POLICYTOKEN.
          2. Press Enter or click the Value field.

          3. For Value, enter the policy token associated with the policy you want to enforce before enrollment. To learn more, see Configuring Zscaler Client Connector App Profiles.

        3. Click OK.

          Adding the POLICYTOKEN install option for the Zscaler Client Connector MST file

          The install option appears on a new line.POLICYTOKEN install option for the Zscaler Client Connector MST file

        Close

      • This install option forces a reinstallation of the driver, even if you already have a driver installed. Use this option if you're having issues with your current driver.

        To enable the REINSTALLDRIVER install option:

        1. In the table, double-click the REINSTALLDRIVER value.
        2. Enter 1 as the value. By default, the value is 0 (i.e., disabled).

        Adding the REINSTALLDRIVER install option for the Zscaler Client Connector MST file

        Close

      • This install option only works when the forwarding profile action for Zscaler Client Connector is Tunnel or Tunnel with Local Proxy. To learn more, see Configuring Forwarding Profiles for Zscaler Client Connector.

        This install option allows you to require users to enroll with the app before accessing the internet and blocks traffic in the following situations:

        • The user has not yet logged in after a new install.
        • A user logs in and logs out.
        • An administrator removes a device.

        This install option does not affect users that remain logged in and disable the ZIA service.

        If you enable this install option, the --cloudName and --policyToken options are required.

        To enable this option using the CLI, enter --strictEnforcement 1. By default, the value is 0 (i.e., disabled).

        Adding the STRICTENFORCEMENT install option for the Zscaler Client Connector MST file

        Close

      • This install option allows you to silently uninstall the app from users' devices using device management methods like GPO. This option is only available when using MSI. The password you add for this option must match the uninstall Password configured for access in unattended mode. Using the password, you can uninstall the app from your users' devices by removing the MST file from the GPO.

        Prerequisites:

        • Your users must be enrolled in the app. If users have the app installed on their devices but have not enrolled, you cannot uninstall the app using this method.
        • You must have an Uninstall Password enabled and an unexpired uninstall password generated. To learn more, see Configuring Passwords for Access in Unattended Mode.

        To add the UNINSTALLPASSWORDCMDLINE install option:

        1. Click Tables from the top menu, and then click Add Row.
        2. In the Add Row window:
          1. For Property, enter UNINSTALLPASSWORDCMDLINE.
          2. Press Enter or click the Value field.
          3. For Value, enter the uninstall Password configured for access in unattended mode.

        3. Click OK.

          Adding the UNINSTALLPASSWORD install option for the Zscaler Client Connector MST file

          The install option appears on a new line.

          UNINSTALLPASSWORD install option for the Zscaler Client Connector MST file

        The uninstall password for unattended mode is available only in Zscaler Client Connector version 4.2.1 or later for Windows. If you use an earlier version or you prefer to use the password configured in the app profile, enter the following in the Add Row window:

        • A Property of UNINSTALLPASSWORD
        • A Value of the Uninstall Password configured in the app profile.
        Close

      • This install option allows users to skip the app enrollment page. If SSO is enabled for your organization, users are taken directly to your organization's SSO login page. If you've integrated SSO with the app (i.e., using a mechanism like Integrated Windows Authentication [IWA]), users can also skip the SSO login page and are automatically enrolled with Zscaler service and logged in.

        To add the USERDOMAIN install option:

        1. Click Tables from the top menu, and then click Add Row.
        2. In the Add Row window:
          1. For Property, enter USERDOMAIN.
          2. Press Enter or click the Value field.
          3. For Value, enter your organization's domain name. If your instance has multiple domains associated with it, enter the primary domain for your instance.

        3. Click OK

          .Adding the USERDOMAIN install option for the Zscaler Client Connector MST file

          The install option appears on a new line.

          USERDOMAIN install option for the Zscaler Client Connector MST file

        Close

      • You can specify a unique username for each device using the UNAME parameter in the CLI.

        The following conditions apply:

        • The UNAME parameter requires the userDomain parameter to be non-empty.
        • The UNAME parameter can have a maximum of 255 alphanumeric and special characters.

        To add the UNAME install option:

        1. Click Tables from the top menu, and then click Add Row.
        2. In the Add Row window:
          1. For Property, enter UNAME.
          2. Press Enter or click the Value field.
          3. For Value, enter test.

        3. Click OK.

          Add the UNAME install option for the Zscaler Client Connector MST file

          The install option appears on a new line.

          UNAME install option for the Zscaler Client Connector MST file

        Close

      • This install option prevents end users from stopping, modifying, and deleting Zscaler products and services.

        To add the ENABLEANTITAMPERING install option:

        1. Click Tables from the top menu, and then select the ENABLEANTITAMPERING property.
        2. For Value, replace the 0 with a 1.
        ENABLEANTITAMPERING install option for the Zscaler Client Connector MST fileClose

      • This install option enables integration with Imprivata OneSign. If enabled, Zscaler Client Connector silently logs in an Imprivata OneSign user to Zscaler Client Connector, applies security policies, and logs the end user activity in Zscaler Client Connector.

        1. In the table, double-click the ENABLEIMPRIVATAINTEGRATION value.
        2. Enter 1 as the value. By default, the value is 0 (i.e., disabled).

        Close

      • This install option allows you to install Zscaler Client Connector to enroll new users during a ZPA-related cloud outage or Internet Service Provider (ISP) outage. You can pass a predownloaded configuration file with Business Continuity settings from the ZPA Admin Portal. To learn more, see About Business Continuity.

        If you pass this install option, you must also pass the BCPMAPUBKEYHASH option.

        To add the BCPCONFIGFILEPATH install option:

        1. Click Tables from the top menu, and then click Add Row.
        2. In the Add Row window:
          1. For Property, enter BCPCONFIGFILEPATH.
          2. Press Enter or click the Value field.
          3. For Value, enter the path to the configuration file.

        3. Click OK.

          The install option appears on a new line.

        Close

      • This install option allows you to install Zscaler Client Connector to enroll new users during a ZPA-related cloud outage or Internet Service Provider (ISP) outage. You can pass a public key provided by ZPA and copied from the Zscaler Client Connector Portal. To learn more, see About Business Continuity.

        If you pass this install option, you must also pass the BCPCONFIGFILEPATH option.

        To add the BCPMAPUBKEYHASH install option:

        1. Click Tables from the top menu, and then click Add Row.
        2. In the Add Row window:
          1. For Property, enter BCPMAPUBKEYHASH.
          2. Press Enter or click the Value field.
          3. For Value, enter the public key.

        3. Click OK.

          The install option appears on a new line.

        Close
    6. To save your changes after adding the options you want, go to Transform > Generate Transform...The Generate Transform option to create a MST file for Zscaler Client Connector
    7. In the Save Transform As window, enter a file name and click Save.Saving the Zscaler Client Connector MST file

    After creating the MST, you can use it when deploying Zscaler Client Connector to your users with Active Directory.

    Close

  • Zscaler recommends using the MST file to install Zscaler Client Connector with custom options. However, if you have a device management tool that does not support MST (e.g., SCCM or PSEXEC) or you are manually installing the MSI file, you can run the MSI file using the CLI and add the options needed.

    To run the MSI file using CLI options:

    1. Start a command prompt as an administrator:
      1. Click Start.
      2. In the Start Search box, enter cmd, then press CTRL+SHIFT+ENTER.
      3. If the User Account Control (UAC) window appears, confirm that you want to continue.

    Running the command prompt as an administrator to run the Zscaler Client Connector MSI file

    1. Enter the following command:
    msiexec /i "<complete path>" /quiet <install options>
    • Replace <complete path> with the absolute pathname to the MSI install file. For example, C:\Users\User\Downloads\Zscaler-windows-1.0.2.000018-installer.msi
    • Use the /quiet switch to install the app in silent mode.
    • Replace <install options> with one or more of the following install options:

      • If your organization is provisioned on more than one cloud, your users are asked to select the cloud where their traffic is sent during the enrollment process.

        Selecting a cloud on the Zscaler Client Connector

        With this install option, you can specify the cloud where the app sends user traffic so that your users do not have to make the selection during enrollment. Do not use this option if your organization is provisioned on one cloud. The app automatically sends traffic to the proper cloud and your users do not need to make a selection during enrollment.

        This install option is required if you enable the STRICTENFORCEMENT option.

        To add this option using the CLI, enter CLOUDNAME=<organization's cloud name in lowercase>. For example, if your cloud name is zscalertwo.net, you would enter zscalertwo. To learn more, see What Is My Cloud Name for ZIA?

        Close

      • The DEVICETOKEN install option only applies to Zscaler Internet Access (ZIA). It is not supported by Zscaler Private Access (ZPA).

        This install option allows you to use the Zscaler Client Connector Portal as an IdP. The Zscaler service silently provisions and authenticates users even if you don't have an authentication mechanism in place. Before adding this option, you must generate a device token in the Zscaler Client Connector Portal and must have completed the full configuration detailed in Using the Zscaler Client Connector Portal as an IdP.

        To add this option using the CLI, enter DEVICETOKEN=<device token from the Zscaler Client Connector Portal>.

        A device token from the Zscaler Client Connector Portal

        Close

      • This install option forces the app window to stay hidden before users enroll. Users can always open the window by clicking the app icon in the system tray.

        To enable this option using the CLI, enter HIDEAPPUIONLAUNCH=1. By default, the value is 0 (i.e., disabled).

        Close

      • This install option allows you to specify which app profile policy you want to enforce for the app before the user enrolls. All relevant settings associated with the policy apply, including the bypass of the IdP login page. After the user enrolls, this policy is replaced with the app profile policy that matches the user based on group affiliation.

        Prerequisites:

        • This install option is only applicable, and required, if you enable the STRICTENFORCEMENT option and want users to enroll with the app before accessing the internet.
        • In the Zscaler Client Connector Portal, you must configure the app profile policy that you want to enforce and ensure that the custom PAC file associated with that policy includes a bypass for your IdP login page. This allows the user to access the IdP page to log in as necessary before enrolling with the app.


        To add this option using the CLI, enter POLICYTOKEN=<policy token from the Zscaler Client Connector Portal>.

        The policy token for a Zscaler Client Connector profile policy

        Close

      • This install option forces a reinstallation of the driver, even if you already have a driver installed. Use this option if you are having issues with the currently installed driver.

        To enable this option using the CLI, enter REINSTALLDRIVER=1. By default, the value is 0 (i.e., disabled).

        Close

      • This install option only works when the forwarding profile action for Zscaler Client Connector is Tunnel or Tunnel with Local Proxy. To learn more, see Configuring Forwarding Profiles for Zscaler Client Connector.

        This install option allows you to require users to enroll with the app before accessing the internet and blocks traffic in the following situations:

        • The user has not yet logged in after a new install.
        • A user logs in and logs out.
        • An administrator removes a device.

        This install option does not affect users that remain logged in and disable the ZIA service.

        If you enable this install option, the --cloudName and --policyToken options are required.

        To enable this option using the CLI, enter --strictEnforcement=1. By default, the value is 0 (i.e., disabled).

        Close

      • This install option allows users to skip the app enrollment page. If SSO is enabled for your organization, users are taken directly to your organization's SSO login page. If you've integrated SSO with the app (i.e., using a mechanism like Integrated Windows Authentication [IWA]), users can also skip the SSO login page and are automatically enrolled with Zscaler service and logged in.

        To add this option using the CLI, enter USERDOMAIN=<organization's domain name>. If your instance has multiple domains associated with it, enter the primary domain for your instance.

        Close

      • You can specify a unique username for each device using the UNAME parameter in the CLI.

        The following conditions apply:

        • The UNAME parameter requires the userDomain parameter to be non-empty.
        • The UNAME parameter can have a maximum of 255 alphanumeric and special characters.
        Close

      • This install option enables integration with Imprivata OneSign. If enabled, Zscaler Client Connector silently logs in an Imprivata OneSign user to Zscaler Client Connector, applies security policies, and logs the end-user activity in Zscaler Client Connector.

        Close

      • This install option prevents end users from stopping, modifying, and deleting Zscaler products and services. To enable this option using the CLI, enter ENABLEANTITAMPERING=1. By default, the value is 0 (i.e., disabled).

        Close

      • This install option allows you to install Zscaler Client Connector to enroll new users during a ZPA-related cloud outage or Internet Service Provider (ISP) outage. You can pass a predownloaded configuration file with Business Continuity settings from the ZPA Admin Portal. To learn more, see About Business Continuity.

        If you pass this install option, you must also pass the BCPMAPUBKEYHASH option.

        To add this option using the CLI, enter BCPCONFIGFILEPATH=<path to the configuration file>.

        Close

      • This install option allows you to install Zscaler Client Connector to enroll new users during a ZPA-related cloud outage or Internet Service Provider (ISP) outage. You can pass a public key provided by ZPA and copied from the Zscaler Client Connector Portal. To learn more, see About Business Continuity.

        If you pass this install option, you must also pass the BCPCONFIGFILEPATH option.

        To add this option using the CLI, enter BCPMAPUBKEYHASH=<public key from the Zscaler Client Connector Portal>.

        Close

      • This install option allows you to pass a predownloaded configuration file with fail-close settings to use when Zscaler Client Connector is in strict enforcement mode.

        If you pass this install option, you must also pass the STRICTENFORCEMENT and SEFAILCLOSECONFIGTHUMBPRINT options.

        To add this option using the CLI, enter IMPORTSEFAILCLOSECONFIG=<path to the configuration file>.

        Close

      • This install option allows you to pass the public key for a predownloaded configuration file with fail-close settings to use when Zscaler Client Connector is in strict enforcement mode.

        If you pass this install option, you must also pass the STRICTENFORCEMENT and IMPORTSEFAILCLOSECONFIG options.

        To add this option using the CLI, enter SEFAILCLOSECONFIGTHUMBPRINT=<public key from the Zscaler Client Connector Portal>.

        Close

    The following image is an example of a CLI where:

    • The absolute path to the MSI file is C:\Users\User\Downloads\Zscaler-windows-1.2.0.000311-installer.msi.
    • The /quiet switch is used to install the app in silent mode.
    • The cloud on which the organization is provisioned is zscalertwo.
    • The device token value is 4e36647447326e5a553335303232416e6279784b51513d3d.
    • The policy token value is 32343A343A312E31204D6967726174696F6E.
    • The organization's domain name is safemarch.com.
    • The UNAME is test.

    Running the Zscaler Client Connector MSI file with a command line

    Close

  • Zscaler Client Connector only supports a dedicated, single-user virtual desktop infrastructure (VDI) model. Multi-session VDIs are not supported.

    Follow these best practices when using Zscaler Client Connector in a (VDI):

    Install Zscaler Client Connector on the master VM using the following parameters:

    1. Configure Citrix UPM to backup and restore to the following folder: {UserProfileFolder}\AppData\Roaming\Zscaler
    2. Run your installer:
      • For the .exe installer, run the installer executable file: --vdi 1 --configTimeout 300 --installLWFDriver 1 –hideAppUIOnLaunch
      • For the .msi installer, run the MSI installer: msiexec/i ZCC_installer.msi USERDOMAIN=<AD domain> CLOUDNAME=<cloudname> VDI=1 CONFIGTIMEOUT=300 INSTALLLWFDRIVER=1
    Close
Related Articles
Understanding Zscaler Client Connector App DownloadsConfiguring Zscaler Client Connector for Microsoft 365 Cloud PCsCustomizing Zscaler Client Connector with Install Options for MSICustomizing Zscaler Client Connector with Install Options for EXECustomizing Zscaler Client Connector with Install Options for macOSCustomizing Zscaler Client Connector with Install Options for LinuxCustomizing Zscaler Client Connector with Install Options for AndroidCustomizing Zscaler Client Connector with Install Options for iOSDeploying Zscaler Client Connector with Active Directory for WindowsDeploying ZDX With Workspace ONE UEM for iOSDeploying ZDX with Jamf Pro for iOSDual Tunnel Feature Configuration with Jamf Pro for iOSDual Tunnel Feature Configuration with Microsoft Intune for iOSDeploying Zscaler Client Connector with MaaS360 for AndroidDeploying Zscaler Client Connector with MaaS360 for iOSDeploying Zscaler Client Connector with Microsoft Intune for AndroidDeploying Zscaler Client Connector with Microsoft Intune for macOSDeploying Zscaler Client Connector with Microsoft Intune for iOSDeploying Zscaler Client Connector with Google WorkspaceDeploying Zscaler Client Connector with MobileIron for iOSDeploying Zscaler Client Connector with MobileIron for AndroidDeploying Zscaler Client Connector with JAMF Pro for macOSDeploying Zscaler Client Connector with Jamf Pro for iOSDeploying Zscaler Client Connector with Workspace ONE UEM for AndroidDeploying Zscaler Client Connector with Workspace ONE UEM for iOSBlocking LAN AccessBest Practices for Zscaler Client Connector DeploymentBest Practices for Updating Latest Versions of Zscaler Client Connector ApplicationUninstalling Zscaler Client ConnectorReverting Zscaler Client Connector to the Previous VersionUpgrading Zscaler Client Connector