TraitWare Windows Passwordless MFA Agent Installer Guide

Deployment Key Installation (Manual & Microsoft Intune)

Note: This is currently in Beta. Reach out to contact@traitware.com if you are interested in being screened as a candidate for use.

Overview

This guide covers installing the TraitWare Windows Passwordless MFA agent using a Deployment Key. A deployment key enables device provisioning and optional user registration during installation.
All command-line options and examples in this document assume a deployment key is being used.

Note: Installing TraitWare without a deployment key (install-only scenarios) is covered in a separate document and is not included here.

TABLE OF CONTENTS

• TraitWare Windows Installer Guide
  • Overview
  • Installation Modes
  • Create Deployment Key (TraitWare Console)
  • Name the deployment, select a seat limit, and set the preferred expiration date
  • Manual Installation (Command Line)
    • Installer Rules
  • Installer Parameters
    • Provisioning
    • DEPLOYMENTKEYRequired to provision a device.
  • User Information
  • Local User Options
  • Example Commands
    • Provision Device Only
    • Provision + Entra ID User
    • Provision + Local User (Create if Missing)
    • Provision + Local User (Use Existing Password)
    • Provision + Local User (Force Password Reset)
  • Microsoft Intune Deployment (Intune Console)
    • Create the Application
    • Upload the Package
    • App Information
    • Program Configuration
    • Requirements
    • Detection Rules
    • Dependencies
    • Supersedence
    • Assignments
    • Review & Create
    • Notes
  • Deployment and Sync
  • Bulk Device Sync
  • Single Device Sync

Installation Modes

When using a deployment key, the installer supports the following modes:

• Provision only – Provisions the device

• Provision + user registration – Provisions the device and registers a user

Installer behavior is determined entirely by the parameters provided.

Create Deployment Key (TraitWare Console)

The first step in a remote deployment is to create a Deployment Key. This is used in remote install scripts to automatically register the TraitWare Windows Passwordless MFA agent.

In the TraitWare Admin Console, navigate to Deploy Endpoints

Select the Remote Deployment tab

Click New Remote Deployment

Name the deployment, select a seat limit, and set the preferred expiration date

Click Submit

The key can be copied now or later for use in the deployment steps

Click Done

The Deployment Key is available to use 

Additional options are available after creating the deployment key (Copy/Reovke/Delete)

Manual Installation (Command Line)

Installer Rules

• DEPLOYMENTKEY only → Provision device

• DEPLOYMENTKEY + user info → Provision device and register user

• No DEPLOYMENTKEY → Not covered in this guide

Installer Parameters

Provisioning

• DEPLOYMENTKEY
  Required to provision a device.

User Information

• USERDOMAIN
  • local → Local Windows user

  • EntraID → Microsoft Entra ID user

• USEREMAIL
  TraitWare user email
  (Must match the Entra ID email when using USERDOMAIN=EntraID)

• USERNAME
  Local Windows username (required for USERDOMAIN=local)

• USERPASSWORD
  Required for Entra ID users
  Optional for some local-user flows

Local User Options

(Only applicable when USERDOMAIN=local)

• CREATELOCALUSER=true
  Creates the local user if it does not exist

  • Password is automatically generated

• AUTOGENERATEPASSWORD=true
  Validates the existing password and sets a new random password

• FORCERESETPASSWORD=true
  Resets the local password without validating the old password
  (Only used when AUTOGENERATEPASSWORD is not explicitly set to false)

• No password flags
  Requires the current password and does not change it

Example Commands

Replace placeholder values (< >) with real values.

Note: Make sure the .msi file name listed in the script is the same version used on the .intunewin installer being used. It is correct to name the .msi file in the script as in the examples. Do NOT rename this to the .intunewin filename.

It will always have the form: TraitWareInstaller_x_x_x.msi where x is replaced with the version number on the TraitWareInstaller_x_x_x.intunewin file.

Provision Device Only

msiexec /i "TraitWareInstaller_2_1_0.msi" /qn /norestart DEPLOYMENTKEY=<deployment-key>

msiexec /i "TraitWareInstaller_2_1_0.msi" /qn /norestart DEPLOYMENTKEY=<deployment-key> USERDOMAIN=EntraID USEREMAIL=<user-email> USERPASSWORD=<user-password>

msiexec /i "TraitWareInstaller_2_1_0.msi" /qn /norestart DEPLOYMENTKEY=<deployment-key> USERDOMAIN=local USEREMAIL=<user-email> USERNAME=<local-username> CREATELOCALUSER=true

msiexec /i "TraitWareInstaller_2_1_0.msi" /qn /norestart DEPLOYMENTKEY=<deployment-key> USERDOMAIN=local USEREMAIL=<user-email> USERNAME=<local-username> USERPASSWORD=<current-password>

msiexec /i "TraitWareInstaller_2_1_0.msi" /qn /norestart DEPLOYMENTKEY=<deployment-key> USERDOMAIN=local USEREMAIL=<user-email> USERNAME=<local-username> FORCERESETPASSWORD=true