MSI installer

PermitUSB ships as a single PermitUSB.msi. Per-machine install, signed, no forced reboot, clean uninstall.

Where to get it

Sign in and visit /app/enrollment. Click Download PermitUSB.msi. The download is gated to authenticated users — each request mints a short-lived signed URL, so anonymous traffic can't pull the binary directly.

Silent install parameters

  • TENANT_TOKEN — required. The enrollment token from the dashboard.
  • SERVER — optional. The API URL. Defaults to https://permitusb.com.
  • ENDPOINT_GROUP — optional. UUID of the target endpoint group; otherwise the tenant default.

Manual silent install

msiexec /i PermitUSB.msi /qn TENANT_TOKEN="<token>"

The dashboard's Enrollment page generates a token and shows the full msiexec command with the token pre-filled — no need to type it by hand. The Quickstart walks through it.

What gets installed

  • %ProgramFiles%\PermitUSB\Agent\ — the Worker Service
  • %ProgramFiles%\PermitUSB\Tray\ — the per-user tray app
  • %ProgramData%\PermitUSB\ — config, SQLite event store, encrypted credentials
  • Service: PermitUSB.Agent, starts automatically
  • Run-key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\PermitUSB.Tray
  • Bootstrap registry: HKLM\Software\PermitUSB\Bootstrap (cleared on uninstall)

Code signing

Production builds are EV code-signed for Defender SmartScreen compatibility. Pre-release builds may be self-signed; SmartScreen will warn on those, and the warning is expected until the EV-signed build replaces them.

Uninstall

msiexec /x PermitUSB.msi /qn

Removes service, tray app, files, registry keys. Leaves the tenant + endpoint records on the cloud — delete those from the dashboard's Endpoints page.

MSI installer — PermitUSB docs