Windows installation guide for the Beyond Identity Authenticator

Overview

This article addresses various options/flags with Windows installers and the differences between different installer packages of Beyond Identity. The installation configuration may vary depending on your organization's size and other variables.

Contents

• Planning the deployment

  • Managed environment

  • Unmanaged environment

• Beyond Identity Windows installers

  • Beyond Identity platform authenticator

    • Installer parameters

      • Silent install

    • Example of a managed installation

  • Beyond Identity Windows Desktop Login

    • Configure Windows Desktop Login pin complexity

    • Registry values

Planning the deployment

The various aspects that should be considered for a successful deployment are how you want to manage your deployment and does it need to be managed. Most organizations utilize MDM to manage their fleet. Some organizations may want to go a completely unmanaged route, especially if their users have more control over their computers.

The best practice is to have a smaller group of "power users" or "trusted users" that you can use for testing and managing these users separately from the entire population.

Managed environment

In a managed environment, the desire is to:

• Deploy automatically without user interaction

• Control the application version

• Test the updates internally

• Control the update rollout

Unmanaged environment

In an unmanaged environment, the desire is to:

• Allow users to install the software on their own

• Let the user decide when to update

• Require a minimum version of specific software

Beyond Identity Windows installers

This section describes different types of installer options.

Beyond Identity platform authenticator

The user authenticator application is available in three different formats.

Downloads are located at: https://app.byndid.com/downloads.

Note: The system MSI installer cannot update automatically, as the user interface is executed in the user's context, and the application is installed in the system context where the updating would need to be executed. For more information about updates, see Manage Authenticator updates.

Installer Parameters

The MSI installer has several parameters that can be used. The following table has the details:

Note: The installer must be run from an elevated command prompt with administrator privileges to set the version control policy registry values.

The registry key for the version control policy is:HKEY_LOCAL_MACHINE\Software\Policies\BeyondIdentity\Authenticator

For more information, see Manage Authenticator Updates.

Silent install

To execute a silent install, use MSIEXEC (msiexec | Microsoft Learn) standard options /qn to do silent install without user interaction.

For example:

msiexec BeyondIdentityUser.msi /qn

• This installs the authenticator in the background.

• The app will not launch after installation on its own.

Example of a managed installation

An administrator has defined a company-wide Beyond Identity Version Control Policy. They want to deploy the updates silently and not prompt users for the new updates. They configure an MDM push install to do the initial load, and they maintain that by updating the installer every quarter. The Beyond Identity Platform Authenticator is kept up to date by push installing via MDM or by updating the version control policy to have a minimum version greater than what is installed.

Installer parameters

To achieve the desired deployment, the install command is:

msiexec.exe /i BeyondIdentity.msi DisableUpdates=1 
VERSIONCONTROLID=6090000d-c256-47c5-9d70-5e9e10000f1f /qn

• This will install in the background.

• The app will not launch after installation on its own.

• Check updates is disabled from the menu options.

• Version control policy ID is set to 6090000d-c256-47c5-9d70-5e9e10000f1f

• Updating installation can be done via MDM

• Updating can be done by changing version control policy

Beyond Identity Windows Desktop Login

The Windows Desktop Login (WDL) package is a separate installer that contains services to enable passwordless desktop login using Beyond Identity on Windows. In addition to the desktop login components and services, the WDL installer contains the Platform Authenticator as well.

The WDL installer is available in two formats.

WDL downloads are located at: https://app.byndid.com/downloads.

Important: Due to a Microsoft limitation, you can enroll a maximum of 10 user accounts on a machine.

Configure Windows Desktop Login pin complexity

Windows Desktop Login version 2.90.0 and greater provides support for pin complexity and validation.

Pins support any UTF-16 characters.

Important notes:

• If Windows Hello is enabled and you are using the Windows Pin for login, if you install Beyond Identity’s Windows Desktop Login and configure a pin, the Windows Desktop Login pin will be used for login rather than the Windows Hello pin.

• Windows Desktop Login will not use the Microsoft Group Policy Object (GPO) settings if configured.

Registry values

The characters and rules for a PIN are stored in the policy registry key at: HKEY_LOCAL_MACHINE\Software\Policies\BeyondIdentity\Authenticator\PIN

The following values are available for configuration. Omitting a value will use the default.