FileWave Client

• Enrolling Devices
• Desktop / Laptop Client Install and Configure
• Enrolling Computer Clients in to FileWave
• Mass Deploy Windows FileWave Client
• Apple Notarisation and Custom PKG Installers
• Apple MDM Enrolment Methods
• User Approved MDM Enrollment (macOS)
• macOS MDM Enrolment State
• Enrolling Mobile Devices into FileWave
• Enrolling Apple TV into FileWave
• Importing Computer Clients from a File
• FileWave Client Configuration
• FileWave Custom Installer
• Superprefs Fileset
• FileWave Client Configuration Settings
• Filewave Firewall Scripts for Windows
• Placeholders
• Locking Devices
• Location Tracking
• Location Tracking Technologies
• Location Tracking Setup
• How the FileWave Client Communicates
• Executing a Client-Side Script-Based Verification
• Inventory-only Clients
• Troubleshooting
• Apple MDM Missing Enrolment Profile
• Clearing FileWave Client Certs
• FileWave Client notification for zsh running in the background
• FileWave Client Rename Behavior
• FileWave Client Status Check: How to ask the client what it is doing on macOS and Windows
• FileWave Windows Network Sweeper
• PSExec as a Helper in Troubleshooting
• Troubleshooting Windows Client Upgrade Fileset Issues
• Using PsExec to Remotely Restart the FileWaveWinClient Service
• Network Proxy, Content Filter, and SSL Inspection Troubleshooting
• Using PowerShell to Remotely Check the Windows FileWave Client Status
• When does the inventory client run scans?
• Troubleshooting Deployment Issues with the FileWave Upgrade Fileset
• First FileWave Client 15.1.0+ Upgrade Requires Reboot on macOS 14+
• Offboarding Clients
• Archiving Clients
• Retiring a device from FileWave
• Uninstall the FileWave Client on Windows
• Uninstall the FileWave Client on macOS
• Removing Android Devices

Enrolling Devices

Desktop / Laptop Client Install and Configure

The FileWave Client runs on both OS X/macOS and Windows computers with the following requirements:

Operating Systems Supported

• macOS
• Windows 10 & 11

For specific versions look at the Downloads page to see what is required for that version.

Downloading the FileWave client installer

The FileWave Client installer is available as part of the FileWave bundle for the specific operating system. The most current version, as well as selected older versions, of the installer are located on the FileWave KB in Downloads. For the computers mentioned under Legacy Support, you will need to install the most recent client supported on your OS.

You should download all installers you will need for your deployment at the same time. They can be stored on a file server, or on a flash drive in Windows format for cross platform compatibility (OS X / macOS systems can read Windows-formatted drives without additional drivers).

Note: The installer instructions for the Linux server and Booster are also located on the same page of the web site. Server installation instructions are covered in FileWave Server Installation. There is no Linux client.

Installing the FileWave client

Client installers for both macOS and Windows use the same general dialogs. You will need to read and accept the license agreement, and you will be presented with a dialog window asking you for specific information to connect your client. Note: on some Windows computers, the FileWave Client Installer Assistant window is positioned directly behind the installer window, which you need to move to get to the Installer Assistant to complete the installation.

Installation Settings

• Server address / port - Enter the IP address or FQDN of your FileWave server. Enter the TCP port number for the client to communicate with the server (default is 20015)
• Booster address / port - If your client is going to get its Filesets from a Booster, enter the IP address or FQDN of the FileWave Booster. Enter the TCP port number for the client to communicate with the Booster (20013)

Note: More on working with FileWave Boosters in Boosters.

• Use Computer Name for Client Name - this box allows you to use the device's computer name as its FileWave client name.
• Client Name - enter a valid name based on any criteria you have for your deployment. It is recommended that you do not use special characters in the client name. Dashes, underscores, and slashes are ok.
• Client Password / Confirm… - enter a password for the FileWave Admin to connect to the client. This does not need to be an administrator password that you are using for that device locally. Note: You must provide a password in order for the Remote Control/VNC relay to function.

Edit Custom Data…

The custom fields consist of a series of optional Inventory data fields that can be used to provide more detailed information on any Client. This information cannot be set in the automated installer, and must be applied manually. The information provided will be displayed as part of the Client Info in the Clients pane of the main FileWave Admin window by right-clicking on any client and selecting the Client Info… menu item, as well as in Inventory queries.

Automating installation with a custom client installer

While the manual method of running the installer and entering all of the connection information works fine for small deployments, FileWave provides you with the ability to perform larger scale installations. A customized client installer is available through the FileWave website:

For macOS: https://custom.filewave.com/py/custom_client_mac.py
For Windows: https://custom.filewave.com/py/custom_client_win.py

The customized client for macOS required for MDM/ADE support and is required to be uploaded as part of the Mobile preferences in FileWave Admin.

The form is shown on the next page.

Many fields are required.

Note: The default port setting is 20015. However, SSL is now required, and the system will automatically use port 20017 instead when 20015 is entered. Do not manually set the port to 20017. Always enter 20015, and the system will handle the SSL port change for you.

Advanced Options

The custom installer does not ask the user for any device specific information, and can be distributed through several means:

• Apple's Automated Device Enrollment (ADE) uses the custom installer to enroll institutionally purchased devices automatically with your FileWave server (See the DEP section later in this Chapter for more details).
• Add the custom installer to an image set when doing direct or network mass imaging (See the Imaging Chapter of this manual for more details).
• Use a remote installation tool, such as Apple Remote Desktop, to distribute the custom installer to large numbers of existing devices.
• Use a 3rd party imaging tool, such as DeployStudio, to build a custom client set.

Note: FileWave provides "recipes" of possible deployment workflows for the custom installer in the KB.

Enrolling Computer Clients in to FileWave

Click on the New Client toolbar icon will bring up the Create New Client window. Clicking on Desktop clients will open the New Client From Server window, which is where computer clients will show up once the FileWave client on the device checks in with the designated FileWave server specified in the client settings. These settings were either manually entered when installing the client or specified when a custom client installer was produced using the FileWave Support webpage.

You can select Clients and assign them to a Group, or leave them in the root Group. You can always place Clones of the Clients into any Groups you wish to administer them from.

You may also pre-assign Clients into a specific Group by checking the Automatically add all new clients to the selected Group checkbox. If you are going to be creating new Clients in waves, you can change this selection between each new batch of Clients.

Related Content

• Conflict Resolution
• Enrolling Mobile Devices

Mass Deploy Windows FileWave Client

Summary

One of the most irritating bumps in the road towards the administrative freedom of FileWave is installing the FileWave Client on your computers for the first time. Now that we've started using MSI-based installers, you can easily deploy the FileWave WinClient via a domain server or log-on script. This post provides materials to aid in WinClient Mass Deployment.

You can follow this method or possibly a more simple method is outlined here Deploying FileWave Client with Group Policy (GPO) from the eval guide.

Download the latest Windows FileWave Client (it's an exe in version 5.7 and up ) and WinClient Prefs Writer (link at bottom). To convert the exe into an msi installer check the conversion script

generatefwwinclientmsi.vbs.zip

This is an example on how you would run it:
cscript C:\path\generatefwwinclientmsi.vbs C:\path\FileWaveClient.exe

Edit the preferences script to include your settings. I have put in example settings -- you must put your own in and then save the file.

Before:

After:

Once the script is edited, these are both ready to execute on a computer, either by log-on script or some remote activation. Make sure that the MSI installs before the preferences script runs.

If you install the Client via the command line, add the "/quiet" argument to execute a silent installation. For a comprehensive list of the available arguments for MSI's, run the MSI using the "/?" argument.

Apple Notarisation and Custom PKG Installers

Description

Apple has introduced notarisation as a requirement for installation of PKGs on macOS with macOS version 10.15. Notarisation status can be determined in two ways : 

• Offline: cryptographically verifying a ticket stapled to the PKG at installer creation time
• Online: contacting apples servers to verify an app / installer has been notarised

Information

Custom installers for FileWave Client and Booster will be notarised starting from Version 13.2.2 and upwards, however, the notarisation ticket will not be stapled onto the PKG you download from https://custom.filewave.com at the current time, requiring 'Online' confirmation. 

Provided your macOS machines can reach the required servers outlined in https://support.apple.com/en-us/HT210060 , you can expect everything to work as normal after 10-15 minutes of downloading the custom PKG. 

Custom PKG Version 13.2.2
Version 13.2.2 Custom PKGs created prior to 4th March 2020 will not be notarised and will require re-creating if notarisation is required

Starting in FileWave 16.3, current FileWave binaries and applications are signed as FileWave (USA), Inc. (UWMR88SA8G) instead of FileWave (Europe) Gmbh (83S2TRZ3CS). The spctl examples below use an older FileWave Client 13.2.2 package, so they still show the previous signing identity. On current 16.3.x builds, expect the signer name and team identifier to reflect the newer FileWave (USA), Inc. identity.

Confirmation

The PKG may be tested for notarisation.  On macOS 10.15.x you may observe the following:

Before notarisation has been completed by Apple:

Unnotarised

% spctl -a -vvv -t install FileWaveClient_13.2.2-fw.filewave.com-20-Feb-2020.pkg
FileWaveClient_13.2.2-fw.filewave.com-20-Feb-2020.pkg: rejected
source=Unnotarized Developer ID
origin=Developer ID Installer: FileWave (Europe) Gmbh (83S2TRZ3CS)

After notarisation has been completed by Apple:

Notarised

% spctl -a -vvv -t install FileWaveClient_13.2.2-fw.filewave.com-20-Feb-2020.pkg
FileWaveClient_13.2.2-fw.filewave.com-20-Feb-2020.pkg: accepted
source=Notarized Developer ID
origin=Developer ID Installer: FileWave (Europe) Gmbh (83S2TRZ3CS)

Apple MDM Enrolment Methods

Description

Initiating Enrolment

This refers to the driving force of enrolment.

Consider Automated Device Enrolment (ADE), delivering the Profile before authentication (if configured). This is an example of profile-based enrolment.

Account-driven enrolment relies on the authentication of a user in advance.

User vs Device Enrolment

Automated Device Enrolment links enrolment with the identity of the device; providing the maximum management options available.  The extreme opposite is Bring Your Own Device (BYOD) enrolment.  This is an example of the user's identity linking enrolment and provides the minimum amount of control.

User enrolment cryptographically separates organisational data from user data and limits many features of MDM.  Further details explained in Apple's KB:

User Enrolment and MDM

Overview

Therefore, the key methods of enrolment can be categorised as:

• profile-based device enrolment
• account-driven device enrolment
• profile-based user enrolment
• account-driven user enrolment

Enrolment Methods

Automated Device Enrolment

On startup, the device reaches out to Apple and, where associated, the Enrolment Profile is delivered to the device and installed.  The user is then prompted for authentication (if not configured for no authentication).

OTA Enrolment

This enrolment type potentially has two offerings:

• User authenticates to download the Enrolment Profile and then instals the Profile manually.
• An Enrolment Profile is provided to the user, for example by email, and the user manually instals the Profile.

BYOD

BYOD also could be described with two possible options:

• Enrolment Profile is downloaded and then the user authenticates (deprecated, see below note)
• User authenticates in Settings and then approves the subsequently downloaded Profile.

Deprecation

Although definitions exist for all enrolment methods above, as of iOS18 and macOS15 Apple will no longer support profile-based user enrolment.   This impacts the first described BYOD enrolment method, meaning BYOD with personal devices must action account-driven user enrolment.

Account-Driven User Enrolment

Although these are personal devices, this enrolment method requires the user to add credentials into Settings which must be a Managed Apple ID.  Federated Authentication links a supported IdP with Apple, matching Managed Apples IDs with IdP usernames and passwords.

Federated Authentication

Initial support for Account-driven user enrolment is currently targeted for FileWave 15.5.  Confirmation of inclusion should be available closer to release.

Related Content

• Account-Driven User Enrolment for i(Pad)OS
• Apple Automated Device Enrolment
• Apple Manual Enrolment

User Approved MDM Enrollment (macOS)

Description

Apple has introduced a new concept with macOS High Sierra, User Approved MDM Enrolment.  This will only affect the management of settings that Apple deemed to be considered ‘security-sensitive.  All other non-sensitive settings will continue to work, as previously, without User Approved Enrolment.  This does not affect devices enrolled through DEP.

There are two aspects to this.  

• User Approved MDM Enrolment
• Configuration Profile payloads that will require User Approved MDM Enrolment.

The first payload Apple has announced that will use these features is the Kernel Extensions payload.

https://support.apple.com/en-us/HT208019

Unlike other payloads, any ‘security-sensitive’ payload will be deliverable only by MDM and will rely on the MDM enrolment being User Approved.

User Approved MDM Enrolment

Currently, User Approved MDM Enrolment relies on the device being enrolled; the method of enrolment does not matter yet but will do in future releases.  At this point, the enrolment must be either:

• DEP enrolment (user approval not required)
• User installing the enrolment profile manually
• User accepts the enrolment profile through System Preferences > Profiles:

You will notice this approval box in 10.13.2, if the method of enrolment was hidden from the user, e.g. scripted.  Devices enrolled on earlier versions and then upgraded will automatically be MDM enrolled as User Approved.

Kernel Extensions

Apple introduced a halfway house with the release of 10.13.  Apple has now released version 10.13.4 which has full implementation of this feature.

How does this affect kernel extensions?

Attempts to install a Kernel Extension with a device that is not enrolled into MDM will be greeted with the following message:

To approve the Kernel Extension will either require MDM enrolment or the user allowing the blocked Extension to run, via System Preferences > Security & Privacy > General:

What happens if I already have kernel extensions installed?

Any extension installed prior to upgrading to 10.13 High Sierra will continue to work, only newly installed kernel extensions will be affected.

Once a particular kernel extension is approved, subsequent upgrades to that kernel extension will automatically be user-approved.

Managing Kernel Extensions through MDM

Prior to version 10.13.4, there is no management beyond having the device enrolled into MDM.  However, with 10.13.4, management is now available through the Kernel Extension Policy payload, allowing extension loading without user consent when enrolled appropriately; the payload can only be delivered with MDM, to devices that are User Approved MDM Enrolled.  This could result in apps relying on kernel extensions to stop functioning properly (e.g. VPN clients, antivirus software).

As of FileWave version 12.7.0, the Kernel Extensions payload was introduced.  To allow Kernel Extensions requires either:

1. 'Team Identifier'
2. Individually using the 'Kernel Extension bundle ID'.

These values are stored locally on a device after installation.  Therefore, to find these values involves installing them on a device and then reading these values from a file, e.g., for a machine that has VMware Tools installed.  One machine could have all Extensions installed prior to running the command to list all necessary Kernel Extensions.

$ sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy 'select team_id,bundle_id from kext_policy;'
EG7KH642X6|com.vmware.kext.VMwareGfx
EG7KH642X6|com.vmware.kext.vmhgfs

This lists the Team Identifier followed by the Bundle ID for two Kernel Extensions that have been added with the installation of VMware Tools.  Both have the same Team Identifier, but have differing Bundle IDs.

1. To just use Team Identifier, add the returned Team Identifier from the command for the Kernel Extensions you wish to approve, to the 'Allowed Team Identifiers' whtielist.  All Kernel Extensions with this Team Identifier will be whitelisted.
2. To only allow certain Kernel Extensions, instead use the 'Allowed Kernel Extensions' whitelist and add both Team Identifier and Bundle ID.  Note, legacy Extensions may not have a Team Identifier.  For those that don't, just supply the Bundle ID and leave the Team Identifier empty.

There is also a community of users that are adding Identifiers and Bundle IDs which could save you having to instal in advance.  

Community Kernel Extensions List

Data in this list is not checked in any way. As this is in place for security reasons and anyone can add information to this file, use with care:

Community Kernel Extensions List

Can I use User Approved Kernel Extension loading without MDM?

Yes.  This however involves booting the computer into recovery mode and using the following command:

$ spctl

See the man page for required options:

https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man8/spctl.8.html

N.B. This is stored in NVRAM.  If you reset the NVRAM, you will lose the ability to use User Approved Kernel Extension loading with this method until the steps are retraced.  A firmware password could be set to prevent unauthorized NVRAM resets.

Extensions Payload

The Extensions payload should not be confused with the Kernel Extensions payload.

https://help.apple.com/profilemanager/mac/5.4/#/apd58550e429

The Extensions payload controls those extensions visible through the Extensions System Preferences and will not affect Kernel Extensions

macOS MDM Enrolment State

DESCRIPTION

macOS devices are unique, in as much as they may be managed by both the FileWave Client and Apple's MDM process.  The MDM Enrolment State is an inventory item which shows the current state of MDM enrolment.

FileWave requires the FileWave Client for basic management of macOS devices.  MDM is an additional extra to expand the management options, as provided by Apple.  There is no MDM only option for macOS devices.

INFORMATION

MDM Enrolment State

The state is a live report of the current status of the device's enrolment; imagine if a device was initially MDM enrolled, but the enrolment profile has been subsequently removed from the device.  Status values include:

• Full Enrolled – Device was MDM enrolled and all is good.  This would be usual for DEP or OTA
• Server only – Devices was MDM enrolled, but the device no longer has an enrolment profile installed
• Device only – Device has an MDM enrolment profile installed, yet the database has no reference of this
• Undefined – Device is running a version of FileWave older than 14.3.0 or has not yet reported back its state
• Not Enrolled – Device has never been MDM enrolled and is managed purely by the FileWave Client

DIRECTIONS

A query may be used to identify devices that are not in an expected state, for example, identify devices that no longer have an Enrolment Profile installed

An example query could look something like:

Add, edit or remove criteria to meet desired reporting.

ADDITIONAL INFORMATION

To assist identifying why a device may show as 'Device Only', the following Custom Fields may be added, reporting the Server Root Cert Name and the APNs of the enrolment profile:

MDM Server Root Certificate Name

Enrolment Profile APNs Topic

Enrolling Mobile Devices into FileWave

Before FileWave 11.1, iOS devices needed to enroll in MDM before they could be imported into FileWave Admin. Starting with FileWave 11.1, it's possible to pre-import iOS devices; i.e., make Placeholders for them in the database, before they enroll either using a CSV file containing serial numbers+Client names or from a ADE account. After a placeholder record is created, it's possible to create associations. Any associated Filesets will be deployed to the device as soon as it actually enrolls. In other words, you can create workflows in advance of devices actually enrolling that will automatically occur once the devices enroll.
Mobile devices (iOS and Android) can be enrolled to become clients on your FileWave server manually, or through an automated process, such as Apple Configurator. Apple iOS devices and macOS computers can also be enrolled through Apple's ADE Device Enrollment (ADE). An enrolled device will contain a FileWave certificate and MDM profile that will allow management of that device.

Web-based enrollment - iOS

For users to enroll their mobile devices over the Internet, they will need a URL that points them to your FileWave MDM server. You can find that URL in FileWave Admin under /Assistants/Enroll iOS Device:

You can create a Web Clip with that URL embedded or copy the URL to the Clipboard and email it to your users. When they go to that URL on their mobile device, they will get instructions on how to properly enroll their device with your server. Having your FileWave server linked to your LDAP server allows the users to authenticate as themselves, instead of using a generic user account. This provides the benefit of having the user's LDAP record link its account information to the device. Another result of this is that the user can be automatically invited to link their Apple ID with your FileWave VPP service.

The user is presented with a dialog prompting to install a MDM server certificate, then enroll the device. The second step is when the user will be asked to authenticate - and this is where LDAP integration comes in handy. If not using LDAP, you need to inform users of the generic credential to use, or else they will not be able to proceed with step 2.

Once the user has completed these two steps, the device will display the new profiles that have been installed:

If the user's device is not yet a FileWave Client (no placeholder record previously created), it will need to be captured in FileWave Admin. You will go to the Clients pane, select New Client from the toolbar.

Select Enrolled Mobile Devices and you will get the list of all mobile devices that have performed an online enrollment, or have been activated by Apple Configurator:

The device(s) can be automatically added to an existing client Group, or you can manually add them to a Group, if desired. If you have devices set to be automatically added to a specific Group, then you will just see them appear as members in that Group.
Note: Unless you want all devices that enroll during a specific timeframe to end up in a designated Group, you should leave automatic placement off. You should also think about using Clones instead of the actual device client as members of any Groups. 

Automatic or Forced Enrollment - iOS

Another option for enrollment is using an embedded enrollment profile as part of a mobile device configuration. Apple Configurator allows you to import a FileWave MDM enrollment profile, which will then be used to assign the device to your FileWave MDM server.

Instructions are included here for Apple Configurator v2.2.1.

Single device enrollment

In FileWave Admin, under /Assistants/Enroll iOS Device, you select Device Enrollment:

Apple Configurator v2.2.1

Apple Configurator 2's blueprints let you record actions that can be applied to devices. You add configuration profiles and apps to blueprints, just as you would add them to a physical device. You can prepare a blueprint so it has the MDM data and supervision identify attached. Once you have the blueprint the way you want, you can apply it to a device. For detailed info on how to use Apple Configurator 2, see: http://help.apple.com/configurator/mac/2.0/

To create a blueprint, click  in the toolbar, select Edit Blueprints, then click on New in the bottom left corner to create a new blueprint. Perform your edits. When you finish, click Done.

AC2 allows you to configure sets of devices, re-installing iOS, setting up profiles, and assigning to an MDM server.

Apple Configurator 2 supports using an Apple VPP account to assign purchases to attached devices. You should only set this up if you are not going to be using VPP from your FileWave server to associate licensed content, or if you are going to use a separate account to apply specific core content to your iOS devices outside of any FileWave workflows.

Note: You cannot use the same VPP account token you are using on your FileWave server to distribute content!

App Store account

You can sign in to the App Store using the following:

Volume Purchase Program (VPP) account: You log in with the Apple ID associated with your VPP account or the Apple ID associated with a purchaser you specify

Your personal account: This is the iTunes account you use to purchase personal apps

WARNING: If your VPP account is already associated with another instance of Apple Configurator 2 or an MDM solution, all app assignments from those previous associations will be revoked.

Once you have enrolled your mobile devices, and added them as clients in FileWave, you should see a set of installed profiles like the ones below.

Using AC2 for direct assignment of applications allows you to preload your iOS devices with core applications without requiring user interaction. The workflow would create a layer in your deployment model that lets you preconfigure devices that will become FileWave Clients for all day-to-day operations and management; but come equipped with a starting set of tools.

Mass Enrollment for iOS

You can set up Apple Configurator for bulk enrollment of preconfigured iOS devices by using this option in the Enroll iOS Device assistant. The device must be connected to Wi-Fi already before this process will work. If not, then make sure you add a Wi-Fi profile to your Apple Configurator setup. This process is built into AC2 using the steps above, since it already supports setting up multiple devices simultaneously.

In this case, you would just download the MDM Enrollment profile, import it into Apple Configurator, and apply it to a set of iOS devices that were cloned with wireless settings, or a profile, already in place.

FileWave Enterprise App Portal for iOS

Starting with FileWave 8.5, iOS devices running iOS 7+ use a native iOS App Portal (Kiosk) instead of the web clip. iOS 8+ devices must use the App Portal. Instructions on how to deploy the App Portal are covered in Chapter 5 on mobile Filesets. When iOS devices are enrolled, they get the web clip version of the Kiosk. The new Enterprise App Portal automatically replaces the web clip and provides a more robust, responsive self-service tool.

Activation Lock Bypass

Since the introduction of iOS 7, device users have been able to enable a feature known as Activation Lock - which is linked to Find My iPhone. This feature ties a device to a specific Apple ID. In order to activate a device with an Activation Lock after a wipe or reset, the Apple ID credentials of the locking account are required. Where this can become problematical is having a 1:1 deployment where a user sets the Activation Lock on their device, then leaves without de-activating the lock. Prior to iOS 7.1, this issue was limited to unsupervised devices, since supervision inhibited the activation lock. Apple has provided a process now to supervise a device, yet still provide the activation lock - as well as a way to deactivate the lock when necessary.

FileWave Admin contains a new Assistant labeled Activation Lock Management. When an iOS device is enrolled in the FileWave MDM, its activation lock is stored in the FileWave Server.

If a device is sent a remote wipe command, the activation lock can be disabled at the same time.

These lock bypass codes are stored in the FileWave server, and remain even when the device has been un-enrolled. The information concerning devices with bypass codes is even provided in Inventory queries. Best practice is to maintain the codes for institutional devices, regardless of the device's enrollment status, as a safety measure. If the device is no longer used, or taken offline, do NOT delete the device from your FileWave database, just archive the device. Once the device has been deleted, the activation lock information is deleted also.

Note: In order to access the Activation Lock Bypass controls in FileWave Admin, you must login as the superuser (fwadmin).

iOS/tvOS Device Placeholders

Text File (iOS Devices from CSV)

When importing from a CSV file, FileWave Admin will ask for the CSV file first. The following fields are supported:

• serial number of the iOS device;
• client name; and,
• comments (optional).

After opening the file, a dialog opens with the list of parsed devices, allowing you to select which devices to import. The dialog is the same as for importing text files.

Just select any devices and click Add X Clients. After doing that, the new devices will appear in the Clients view. However, there's almost no information provided for them.

It's possible to create associations and manage licenses (VPP for instance) on placeholder records the same way as if the devices had already enrolled. Update the model and any associated Filesets will be deployed automatically when the devices enroll. 

iOS Devices from ADE

A ADE account must be configured in FileWave Admin before being able to pre-import from DEP.
When importing from ADE, FileWave Admin will show the list of ADE accounts and the number of devices associated to that account that are iOS devices and whose serial number are not already used with your FileWave Server.

You check the ADE accounts from which you want to import devices, then click OK. After doing so, placeholders for all devices from the selected account will be created. You can create associations as usual, update the model, and their corresponding Filesets will be deployed when the devices enroll.

Once the device is enrolled, its name in FileWave transitions from the serial number to the actual device name. If there is a ADE naming convention, that will automatically apply. 

Related Content

• Conflict Resolution
• Enrolling Computer Clients

Enrolling Apple TV into FileWave

You can use Apple Configurator to enroll Apple TV devices into FileWave. The screenshots below show the blueprint-based workflow.

In Apple Configurator, create a new blueprint and set the target to Apple TV.

Newer Apple Configurator versions may change individual dialogs, but the overall process remains similar.

Click the Prepare icon.

The Prepare Devices dialog opens.

Click Next. Select New server... in the server selection box, then click Next.

Enter a server name and the URL for over-the-air enrollment, including the required port number at the end of the URL, then click Next. The server name is only for identification in Apple Configurator and does not need to match DNS.

If Apple Configurator can connect to the FileWave Server, it shows the trust profile and FileWave Root Certificate. For the required enrollment profile, use FileWave Admin's Enroll iOS Device assistant and download the profile from the Apple TV tab.

Click Choose... and select the enrollment profile you downloaded from FileWave Admin.

After the enrollment profile is selected, click Next. In FileWave, create a Wi-Fi profile with the SSID and password the Apple TV needs to join the wireless network. Add that Wi-Fi profile to the blueprint with Choose....

Click Next.

Select the language and diagnostic/usage-data options you want to use, then click Prepare.

The blueprint now has the required pieces and can be applied to a connected Apple TV.

Related Content

• Enrolling Devices
• Conflict Resolution

Importing Computer Clients from a File

You can import a "tab-delimited" text file (not a CSV file).

See Placeholders for more workflow information. Can be useful for

• Network Imaging Guide
• Automated Device Enrollment (ADE)
• Enrolling Mobile Devices into FileWave
• Working with FileWave Clients

The import location is in the Create New Client pane:

The new format looks like this:

Client Name <tab> Comment <tab> Serial or MAC

• Name is mandatory
• Comment is optional
• Serial or MAC is optional if you are going to be adding clients that are already named later; otherwise, you must provide either a serial number or MAC address.

MAC address formats can have colons (:) between octets. For serial numbers, only capital letters (A-Z) and ordinal numbers (0-9) are allowed. Create the text file using a text editor that can save the file in plain text format with Unix or Windows line endings.

Please download the template for more details:

When creating your own file, remember to include a header row on the first line to define the column names, just like in the template.

FileWave Client Configuration

FileWave Custom Installer

Why

When installing the FileWave client on computers, it is necessary for the client to know certain information, for example, the FileWave Server address, whilst other information may also be useful to include: Boosters, Booster Routing, Enabling/Disabling Remote Connections, etc.

Similarly, when installing Boosters, they also require essential information including the FieWave Server and ports.

For this reason, the FileWave Custom Builder allows details to be entered and then for Clients download an MSI or PKG ready for provisioning devices or with Boosters there is the addition of creating a Debian custom installer.

When

Each of the installers could be used manually on devices, but the custom MSI is particularly useful when imaging Windows onto devices, whilst the custom PKG achieves the zero-touch enrolment for macOS and DEP.

Information

The FilleWave Custom Installer is available via two URLs:

• https://custom.filewave.com
• https://custom.filewave.ch

Enter the details to match the FileWave Environment, e.g server's FQDN, Client or Booster version, etc.  Once completed, hit the 'Build' button and FileWave will create the custom installer.

Superprefs Fileset

What

When you create a Custom Client installer, the FileWave Client preferences are packaged into that installer: server name, ports, Boosters, and related client settings. That is useful for the base configuration, but one preference set is not always right for every device.

A Superprefs file lets you deploy selected FileWave Client preference changes to macOS or Windows devices after the client is installed. You can use one Superprefs Fileset for a broad change, or multiple Superprefs Filesets for different groups of devices.

Only the settings included in the Superprefs file are changed. Settings that are not included remain untouched on the client.

When to use this

• Changing client logging level for troubleshooting
• Adjusting Booster or communication preferences for a specific group of devices
• Applying a new client preference without rebuilding and redeploying the Custom Client installer
• Returning temporary troubleshooting settings back to standard values after testing

Ingredients

• FileWave Clients on macOS or Windows
• FileWave Superprefs Editor
• FileWave Central Admin App

Create the Superprefs plist

The Superprefs Editor is installed with the FileWave Central Admin App:

When the editor opens, it may ask you to open an existing plist. Cancel that window if you are creating a new Superprefs file.

Only settings that you add or edit in the Superprefs Editor are written into the plist. This keeps the deployment focused and avoids overwriting unrelated client preferences.

Example: set Debug Level to 99

Debug Level has three common values:

To enable debug logging, open the Superprefs Editor, cancel the Finder or Explorer window if you are creating a new file, go to the Options tab, set Debug Level to 99, and save the file.

The file must be named fwcld.newprefs.plist.

The saved plist should contain only the changed key:

Dict {
    debugLevel = 99
}

Package the plist in a Fileset

The fwcld.newprefs.plist file can be placed in any reasonable path inside the Fileset. A dedicated Superprefs folder makes the purpose clear and lets you keep separate folders for different preference sets.

You can add the file to an existing Fileset, but a dedicated Fileset is usually easier to target, test, and remove later.

From the FileWave Central Admin App:

• Create a new Empty Fileset and name it clearly.
• Open the Fileset and disable Hide unused folders.
• Select or create the desired location for the plist file.
• Drag fwcld.newprefs.plist from Finder or Explorer into that location in the Fileset.

Using the debug logging example for macOS, the Fileset could look like this:

When the Fileset activates on a client, Debug Level should switch to 99 and the client log should reflect the change.

Always test with one device or a small pilot group before associating the Superprefs Fileset more broadly.

For temporary troubleshooting, create a matching Superprefs Fileset that returns Debug Level to the standard value of 10 when analysis is complete.

GUI observation

Some Superprefs Editor entries are Boolean values, such as Booster Routing. Boolean entries can be set to True, set to False, or left unset. A dash means the value is not included in the Superprefs file.

The three states appear as:

Related Content

• FileWave Client Configuration Settings
• FileWave Fileset Types
• How the FileWave Client Communicates

FileWave Client Configuration Settings

Configuration Settings are found in the Windows registry or macOS plist:

• macOS: /usr/local/etc/fwcld.plist
• Windows FileWave 15.4.2 or lower: HKLM\Software\FileWave\WinClient (32bit OS), HKLM\Software\FileWave\WOW6432\WinClient (64bit OS)
• Windows FileWave 15.5.0 or higher:  HKLM\Software\FileWave\WOW6432\WinClient 

Please refer to Creating a Superprefs Fileset to find out how to change these settings on any number of clients using a fileset.

The following list shows the default settings in the left row, describes the function and valid alternative settings (native)

Basic/Minimal Configuration

Note: The default port setting above is 20015. However, SSL is now required, and the system will automatically use port 20017 instead when 20015 is entered. Do not manually set the port to 20017. Always enter 20015, and the system will handle the SSL port change for you.

Booster configuration

TeamViewer (was Observe Client)

Ports the client listens on

Client behaviour

Location Related

Obsolete / Unused keys

Filewave Firewall Scripts for Windows

Summary

FileWave Installers by default leave Windows Firewall settings untouched. This article provides scripts that opens the Windows Firewall so the Windows processes can accept connections from the outside. 

For FileWave 15.5 we have baked this in to the normal client upgrade process. We are posting the script here in the KB as an example of how to change firewall rules via script, but also in case you need to apply it if the upgrade Fileset was not successful in adding the rule.

FileWave 16.0.0 will remove the need for this rule entirely so we made this change very simple to add and remove for 15.5. As of FileWave 16.0.0 this article is merely for historical purposes or to serve as an example if you wanted to know how to make Firewall rules via a script.

Procedure

Use the attached .bat file for 15.4.2 or lower or Fileset for 15.5.s to open the firewall for the respective executable at their standard install locations. If you've installed a Filewave component to a nonstandard path, please adapt the path inside the scripts.

• Script for FileWave 15.4.2 or lower: fwcld-ports-15.4.2.bat
• Fileset for FileWave 15.5.x: FileWave Firewall Settings 15.5.fileset.zip

The Scripts allow both in- and outbound connections on all ports for the installed FileWave executables and follow the basic syntax :

Windows 10 and beyond running FileWave 15.5.x:

netsh advfirewall firewall add rule name="FileWave Client" \
action=allow program="C:\Program Files\FileWave\client\fwcld.exe" \
enable=yes dir=in description="Filewave Client Inbound Access, usually only port 20010 is needed for client monitor connections"

Custom Fields

The following download contains two Custom Fields to report the firewall status of the FileWave Client, for example:

Custom Fields download:

Related Content

• Default TCP and UDP Port Usage

Placeholders

Placeholders

Placeholders for computers and mobile devices are useful in many situations where you need to create a device FileWave has not seen yet, and pre-assign them varying content:

• Import new Windows computers and assign them what image you want to put on them (see: Windows Network Imaging - PXE )
• Import new devices (mac, Windows, iOS etc) and assign them custom names 
• Import iOS or macOS devices and assign them custom fields so DEP can name with with variables (see: DEP Naming)
• Import devices (any OS) and assign them custom fields so that smart groups can deploy pre-assigned software immediately upon enrollment

This Article will focus on a situation where you need to import devices and give them custom field values before they are enrolled. This is great for fields like:

• Barcode / Asset tag
• Location
• Use
• Warranty information like expiration date

Preparing the Files

We typically start out with one large file; A CSV/excel that looks something like this:

We will actually need to import this file two times

1. To create the placeholders
2. To Assign the custom fields to the placeholders

Creating the Placeholders

Use the "New Client" UI to import a tab delineated version of just serial number and name column

More detailed instructions:
Windows / macOS : Importing Computer Clients from a File
iOS / tvOS : Enrolling Mobile Devices into FileWave

Create the Custom Fields and import

You can can either import the custom fields file  or follow the create step

Import Custom Fields

1. Download the custom field file:  FileWave Custom Fields.customfields
2. Open your (Assistance → Custom Fields → ) "Edit Custom Fields" UI
3. Press "import" Browse for file

For more see: Importing and Exporting Custom Field Files

Create Custom Fields

Create any needed custom fields and assign them to all devices, or specific devices. 

1. Open the custom field UI

2. Create Custom fields for Use, Location, barcode;

   1. Use: Provided: Admin, Type: string, Restricted: True, Values: None (DEFAULT), Faculty, Student, Administration

   2. Location: Provided: Admin, Type: string, Restricted: True, Values: None (Default), Site A, Site B

   3. Barcode: Provided: Admin, Type: string, Restricted: False, Use Default Values: True (Default: None) 

   4. Take note of the "Internal Name" from the custom fields (I.E: barcode, location, use)

More detailed instructions:
Custom Fields

Import Custom Field Values

Once the fields are created and assigned to the proper devices we need to import your file again in the custom fields UI. This time with the serial, barcode, location, use column.

You can actually have FileWave to create a sample CSV file with the proper headings by going to 

1. (Assistance → Custom Fields → ) "Import Custom Fields" UI
2. Press "Download Template"
3. Select the values you want to import (barcode, location and use in our case)
4. Specify the field to identify clients (for example Serial Number or Client Name)
5. Save

Edit in a spreadsheet app (excel, numbers, etc) and add the needed vales and bring it back in

Note that you can also set custom field values for placeholders manually by right-clicking if you have only a few to update

Locking Devices

What is it?

What are device locks? What is the difference between "Lock" and "Lock Devices"

The locking behavior is the same for macOS, Windows, iOS, and non-EMM Android.

Answer

Lock / Unlock

Lock - Locking a client binds that client to the current model number. Meaning that if something unexpected should happen during a migration or update, a connecting client ignores any new manifests from the server (see: Upgrading your On-Premise FileWave Server).

Unlock - Allows a device to be updated to the latest model.

Lock Device

Lock the actual screen of the device. The user will be unable to use the device till a passcode (if present) is entered.

ADDITIONAL INFORMATION

When you lock a device the kiosk will not be available to the user. It will open, but display a message to the user they they are blocked.

Locked device shows a lock icon or text in the client view, device info, and client monitor:

Location Tracking

Location Tracking Technologies

FileWave Location Tracking

The location reporting feature in FileWave is disabled by default. It is recommended that you; verify that this feature is per your organization’s policies and AUP (Acceptable Use Policy). Notify your end users before activating location reporting, as enabling the feature will prompt for permission to access location information. For details on how this works, look here: Location Tracking

Technologies used for Location Tracking

Location tracking technologies used will differ from client platform to client platform. 

Maps used:

• ThunderForest - https://www.thunderforest.com/

Client location detection methods:

• On macOS/Windows - https://doc.qt.io/qt-5/location-positioning-cpp.html which tries different sources.

• On Windows specifically - https://learn.microsoft.com/en-gb/windows/win32/api/locationapi/nf-locationapi-ilocation-getreportstatus

• On iOS - The iOS API for location from Apple.

• On ChromeOS - The Google API for location from Google.

Related Content

• Location Tracking

Location Tracking Setup

FileWave Location Tracking

The location reporting feature in FileWave is disabled by default. It is recommended that you; verify that this feature is in accordance with your organization’s policies and AUP (Acceptable Use Policy). Notify your end users before activating location reporting, as enabling the feature will prompt permission for access location information.

Requirements:

• FileWave version 10.1+
• Location Tracking Enabled - Server/Client
• iOS devices require the FileWave IPA App Portal for passive tracking
• All devices you want to track are already enrolled into FileWave and currently communicating properly

Supported Operating Systems:

• APK Android:  4.1+
• iOS 9+
• macOS 10.9+
• Windows 10+
• ChromeOS 43+

Things to consider:

Client State.  For the items: Tracked, Missing and Untracked, the item greyed out is the active state:

• Different States of Tracking
  • Tracked - Tracking is enabled and will update the location at different intervals
  • Missing - Tracking is enabled and will be updated around every two minutes. The client also sends the location immediately and does not wait for other scans to finish. For supervised iOS devices this option puts the device in Lost mode, has a message/footnote that can set in the FileWave Preferences under the Organization Info tab, and locks the iOS device. The device will become usable again once the missing mode is switched off. 
  • Not Tracked (DEFAULT)- No location is gathered at any time.
• The FileWave IPA App Portal needs to be sent out and opened at least once before you will be prompted and allowed to gather location from the iOS device. Once it is sent out, the old FileWave App Portal that gets installed automatically with enrollment will be removed and the new one will be installed.
• For any updated location from your iOS devices, the FileWave App Portal needs to be open, whether that be in the background or the currently active app.

There are two types of location tracking in FileWave, Passive Tracking, and Lost Mode. macOS, Windows, Chromebooks, and Android devices use Passive tracking to gather the location of the device without locking it down. Supervised iOS devices set to Missing mode will put the device in Lost mode, which locks down the device, making it unusable by the end user.

Lost Mode Setup (iOS macOS):

1. Right Click on your Supervised iOS or MDM-enrolled macOS device(s)

2. Select Missing from the Client State menu 
   
   

3. Update Model
   

4. Once the device checks in it will be in lost mode and report location.
   
   

   
   
   

5. To take it out of lost mode, select "Not Tracked" in the Client State menu

When the iOS device is in Lost Mode, do not reboot it. If the device losses Wifi, you will no longer be able to take the device out of Lost Mode since it will no longer be connecting to FileWave.

When the device is in Lost Mode, a new option in the tools menu is available, "Play Lost Mode Sound (iOS  10.3+)"

Passive Tracking Setup

This is receiving tracking data continuously. 

1. Check your server license to be sure you have "Allows collection of personal data:" set to Yes.
   

2. Make sure location services is enabled.
   
   

   iOS	macOS

   Windows	Android

   
   

3. Prepare the clients

   1. MacOS and Windows - Be sure that "Disable Personal Data Collection" option in the client preferences of your clients is not checked.
      

      You can set the "Disable personal data collection" one at a time with Client Monitor or Create a Superprefs (Creating a Superprefs Fileset) to change them in bulk.
      
      

   2. iOS - The FileWave IPA App Portal automatically deploys to your iOS devices. This used to be manual.

      FileWave 15.3+ will auto instal the latest App for you on qualifying devices.  If the App is already open, when configuring the device for tracking, it may be necessary to close and re-open the App after the device has receive the subsequent MDM commands from the Model Update.

   3. Chromebook -  Be sure the Chrome Extension is installed and configured (See Quick Start Guide for Chromebooks)

   4. Android (EMM)

      1. Force enable location tracking server side

         By force enabling EMM tracking you are ignoring "Allows collection of personal data" in your license. Even is the license is set to false, this will collect data.

         1. Edit

            /usr/local/filewave/django/filewave/settings_custom.py 

         2. add 

            settings.EMM['FWCLIENT_FORCE_ALL_DEVICES_TRACKING_ENABLED'] = True

         3. Restart apache 

            /usr/local/filewave/apache/bin/apachectl restart

         4. Update Model

      2. Force enable location services on devices (See: Force Location for EMM Android Devices)

4. Change the state to Normal

   1. Right click on your macOS, Windows, Chromebook, and Android device(s)

      For multiple devices use the filter options at the top of the client view, then select all

   2. Select Normal from the "Client State" option.

      

5. Update the model
   

6. Accept any device prompts

   iOS	macOS

7. Wait a few minutes, can potentially take up to 15 minutes. Then simply right click on your device(s) and select the Show Location(s) option to see the map below. This will be accurate within a few hundred feet for most devices.

   

Warning: In order to avoid legal issues concerning user location tracking, it is highly recommended that you enable location tracking only on devices when a unique user may authorize the service.
Privacy Policies: Apple/iOS and macOS – Microsoft/Windows – Google/Android

Additional OS Specific Considerations

macOS

Any user can agree to tracking, admin or not. Only an administrator can disable location services and/or FileWave's rights to location, as per Apple Inc. policy..

iOS

Any user can agree to tracking, can disable location services, and revoke FileWave's right to location, as per Apple Inc. policy.

Windows

The Windows operating system does not prompt the local user for access to location. Windows 10+ does have a location service that can be turned off.

Android (APK Client)

Upon installing or upgrading the Android FileWave Client to version 10.1 or greater, the user is requested to approve all rights an application needs. This includes location services, running in the background and several other rights.

Android (EMM Client)

A user can turn off their location tracking at anytime, but you can make a policy fileset that will Force Location for EMM Android Devices

Order of operation

It is important to note the way a client verifies it is able to ask the system for location information.
For example setting the state to "Missing" but it has a Superprefs file telling it the refresh interval is 0 See the flowchart for reference: 

Global Location Reporting Disable

If there are any reasons, legal or otherwise, that you do not wish to enable tracking on a global level within your organization, your FileWave license can be adjusted to enable personal mode. This will disable devices from sending application usage as well as location information.

To verify the current status of personal data collection. From FileWave Admin: Server Menu → "Activation Code..." → There you will see "Allow collection of personal data:" with Yes or No after it. 

To have personal data enabled or disabled on your license, please submit a support ticket with "Personal data License" in the subject.

Only tickets from authorized support agents whose names are on the support contract will be accepted to adjust license personal data settings.

How the FileWave Client Communicates

What

This article explains how the FileWave Client securely communicates with FileWave infrastructure components during enrollment and ongoing operations. It covers certificate-based authentication, transport mechanisms, and platform-specific communication flows so administrators understand what talks to what, how, and why.

A key design principle of FileWave communication is mutual TLS (mTLS), where both client and server authenticate each other using certificates issued by the FileWave Certificate Authority (CA).

When / Why

Understanding FileWave client communication is important when:

• Designing network topology (firewalls, proxies, NAT, boosters, NATS)
• Troubleshooting enrollment or check-in failures
• Auditing security posture (certificate usage, authentication, encryption)
• Explaining FileWave behavior to security or infrastructure teams

This knowledge is especially critical in modern deployments where communication is brokered through NATS rather than direct point-to-point HTTP(S) connections.

How

Enrollment

At this point, you have either installed the FileWave client onto a device manually, or the device has received the client automatically (for example via Automated Device Enrollment).

1. The client uses the configured server address to initiate a connection to the FileWave server.
2. The client downloads the FileWave CA certificate from the server.
3. The client generates a unique Client ID.
4. The client generates a Certificate Signing Request (CSR) and securely stores the private key locally.
5. The client sends the Client ID, device name, and CSR to the server.
   1. The client polls the server on the tickle/heartbeat interval until a certificate is issued.
   2. The server signs the CSR and returns a client certificate.
   3. The client validates the returned certificate against:
      • Its locally stored private key
      • The FileWave CA certificate
6. The client record is created in FileWave Central:
   1. Auto-add: The client is automatically approved and placed into the configured auto-add group.
   2. Upgraded client: The client is automatically approved and resumes normal operation.
   3. Manual vetting: The client remains pending in Client View → New Clients until approved.

FileWave uses mutual TLS (mTLS) from this point forward. All subsequent communication requires both the client and server to present valid certificates signed by the FileWave CA.

There is no longer a compatibility mode. Legacy documentation such as What is Compatibility Mode? applies only to historical versions and should not be used for modern deployments.

Daily Communication

The FileWave server continuously recalculates models and smart groups. As a result, a client check-in may result in new manifests even when the assigned model itself has not changed.

Modern FileWave deployments use NATS as the primary communication transport for tickle and command signaling.

macOS and Windows

Tickle (Check-in)

1. The tickle interval expires (configurable via Superprefs).
2. The client initiates communication via NATS.
3. A mutual TLS handshake occurs:
   • The server validates the client certificate.
   • The client validates the server certificate.
4. The server responds with the current model number.
   1. If the model number matches, no model manifest is downloaded.
   2. If the model number differs, the client downloads the updated manifest.
5. The client processes the manifest(s).
6. The client downloads required Filesets:
   1. From the server directly or via a Booster.
   2. The client validates the Booster certificate against the same FileWave CA.
   3. The Booster validates the client certificate and checks revocation status (CRL).
   4. If certificate validation fails at any stage, the TLS handshake fails and no data is transferred. The failure is reported back to the FileWave server.

Verify

1. A verification check-in occurs (default: every 24 hours, configurable via Superprefs).
2. After successful mTLS authentication:
   • The client verifies Fileset state
   • Inventory is refreshed
   • Files are healed according to Fileset verification settings

Verification also occurs when the client service starts (for example after a reboot) and can be triggered manually via Client Monitor, Client Info, or command line.

Android EMM

FileWave Android EMM communication is mediated through Google’s Android Management API (AMAPI).

As of FileWave 16.3, this communication follows Google's recommended API rate limit settings. This is an internal behavior change that reduces the risk of throttling and improves stability for larger Android Enterprise deployments. No administrative action or configuration change is required.

At Model Update

1. A single manifest is generated from all Android Policy Filesets assigned to the device.
2. Application assignments and permissions are included.
3. The manifest is sent to Google via AMAPI.
4. The Android device retrieves updates from Google.

Ongoing Operation

1. FileWave polls Google approximately every 5 minutes for device status updates.
2. Smart group changes trigger regeneration of manifests and updates via AMAPI.

iOS / iPadOS

FileWave communicates with Apple devices using standard MDM push and check-in mechanisms.

At Model Update

1. A push notification is sent to the device via Apple Push Notification service (APNs).
2. The device initiates a connection to the FileWave MDM server.
3. Updated manifest data is delivered to the device.

Ongoing Operation

1. The inventory interval is reached (default: 24 hours).
2. FileWave sends an APNs push requesting the device to check in.
3. The device connects to the FileWave MDM server.
4. Any updated manifests are delivered.

Related Content

• Creating a Superprefs Fileset
• Default TCP and UDP Port Usage
• Configuring Inventory Preferences
• Android EMM Known Issues

Digging Deeper

FileWave’s use of mutual TLS ensures that:

• Only trusted clients can communicate with the server
• Clients are protected from impersonation or man-in-the-middle attacks
• Boosters cannot serve unauthorized devices

The introduction of NATS improves scalability and resilience by decoupling client signaling from traditional request/response patterns. This allows FileWave to efficiently handle large device fleets while maintaining strong security guarantees.

From a security perspective, FileWave’s communication model aligns well with modern Zero Trust principles: authenticate everything, encrypt everything, and assume the network is hostile by default.

Executing a Client-Side Script-Based Verification

What

The "verify" option of the fwGUI client application allows you to run a "verify" from the client programmatically.

When/Why

We are going to use this option whenever we want to get "immediate" feedback from a client.  For instance, as a post-installation script, calling a verify would immediately make the client report updated inventory rather than waiting (up to 24 hours, default) for the next "regular" verify.

How

The verification is called as a command-line option to the fwcld app on either a Windows or macOS client as follows. The first table is for FileWave 16.0.4+ and the second table is for 15.5.x and below. Please note that 16.0.0 through 16.0.3 did not have this command.

@echo off
 
"C:\Program Files\FileWave\client\fwcld.exe" --verify
 
exit 0

#!/bin/bash
 
/usr/local/bin/FileWave.app/Contents/MacOS/fwcld --verify
 
exit 0

On FileWave version 15.5.x or lower these are the paths and executables. This is being left here so to document that the command changed on Windows between 15.4.2 and 15.5.0 and then in 16.0.0 the old Kiosk was removed and so in 16.0.3 the verify command was brought in to the new Kiosk as mentioned above;

@echo off
 
"C:\Program Files\FileWave\client\fwGUI.exe" --verify --silent
 
exit 0

#!/bin/bash
 
/usr/local/sbin/FileWave.app/Contents/Resources/fwGUI.app/Contents/MacOS/fwGUI --verify --silent
 
exit 0

Related Content

• You can change the default 24h by adjusting the "File Check Interval" in a Superprefs - Creating a Superprefs Fileset

Inventory-only Clients

Management Mode

Management Mode controls whether a computer client is fully managed or inventory only. It has two values: Managed, which is the normal mode, and Inventory only. To change the setting, right-click the client and select Management Mode.

Inventory only

Inventory only clients still report inventory data to FileWave, but they do not install assigned Filesets except for critical Filesets. At this time, the critical Filesets are FileWave upgrade Filesets. Fileset status reports Not installed, client is inventory only when a normal Fileset is blocked by this mode.

Troubleshooting

Apple MDM Missing Enrolment Profile

What

At times, MDM may appear slow or even worse, the MDM Enrolment Profile no longer seems to be apparent, preventing MDM management until re-enrolled. 

Why

Apple observed that osquery can cause such issues, depending upon configuration.

osquery is a tool to describe a device based upon SQL and can be used by management tools or similar, e.g. Malware detection software.  It is a popular tool, as highlighted by a couple of example applications that use osquery: CrowdStrike and Microsoft Defender.

If you use ADE/DEP to enroll the macOS systems you may find that the following command restores the device's belief that it is supervised and in MDM. To run the command you must be logged in on the device as it will launch a notification to click on to re-confirm that the device should be in MDM;

sudo profiles renew -type enrollment

Information

FileWave does not use osquery, so that may appear as if devices managed by FileWave could be immune, however, since other 3rd party software may do so, FileWave device management, as with any MDM, could be impacted.

Consider testing for devices running osquery, where MDM issues may arise or MDM Enrolment Profile is no longer present.  If so, it would be recommended to communicate with the software vendor utilising osquery.  Details imply a reduction in the aggressiveness of osquery should prevent this.  Additionally, Apple were looking into mitigating against this issue.

Related Content

• https://www.osquery.io/ 

Clearing FileWave Client Certs

In some situations, you may want to explicitly make the server clear and revoke a client certificate without deleting the client from FileWave, for instance if you are wiping a macOS client or reinstalling an IVS client.

From FileWave Central

For desktop clients, you can right-click the client and choose "Clear Certificate(s)".

Note that the current administrator needs to have write permissions on the clients, and will need to enter credentials.

From the Client

The first way is to use the client (13.1.1) certificate itself to authenticate, which is only possible if the certificate and its private key still exist on the client: 

fwcld -clearCertificate [-serverHost <fwserver_address> -serverPort 20445]

This is the equivalent of the following command using curl (replace <fwserver_address> with the address of your FileWave server):

sudo curl --key /private/var/FileWave/client.key --cert /private/var/FileWave/client.crt -X POST https://<fwserver_adress>:20445/auth/client/clear_certificate

The client will then be unable to communicate with the server (until a new CSR is created). This command can be used in the activation script of a macOS reinstall fileset to make the server properly clear the old client certificate.

Note that the command above uses the client certificate itself to identify the client. In case the certificate's private key is already lost, there is an alternative where you can authenticate with an administrator's token rather than with the client certificate: 

fwcld -clearCertificate -token <application_token> [-serverHost <fwserver_address> -serverPort <fwserver_port>]

• <fwserver_address>: The FileWave server address (optional)
• <fwserver_port> : 20445 by default
• <application_token>: An administrator application token, with write permissions on this client. Can be found in the Application Tokens tab of the Manage Administrators dialog (example: {1ca3fe82-a41d-8866-bd4d-f83f9f1a8dd5}).

Alternatively, you can also clear certificates en masse using the inventory superadmin token. In this case, you are allowed to clear the certificate of any client (obviously use with caution):   

curl -X POST https://<fwserver_address>:20445/auth/client/clear_certificates -H 'Authorization: <application_token>' -H 'Content-Type: application/json' -d '["<serial_1>", "<serial_2>", ...]'

Included in 13.1.1 and above are the options to clear with 'MAC address' or 'Device ID':

curl -X POST https://<fwserver_address>:20445/auth/client/clear_certificates?identifier=mac -H 'Authorization: <application_token_base64>' -H 'Content-Type: application/json' -d '["<mac_address_1>", "<mac_address_2>", ...]'

curl -X POST https://<fwserver_address>:20445/auth/client/clear_certificates?identifier=device_id -H 'Authorization: <application_token_base64>' -H 'Content-Type: application/json' -d '["<device_id_1>", "<device_id_2>", ...]'

The identifier parameter is optional, its default value is serial_number.

• <fwserver_address>: The FileWave server address.
• <serial_1>, ...: serial numbers of clients to revoke. Must match the serial_number field from inventory.
• <mac_address_1>, ...:  MAC addresses or clients to revoke.
• <device_id_1>, ...: device ids of clients to revoke.
• <application_token_base64>: base64-encoded value of an administrator application token, with write permission on this client. Can be found in the Application Tokens tab of the Manage Administrators dialog (example: ezFjYTNmZTgyLWE0MWQtODg2Ni1iZDRkLWY4M2Y5ZjFhOGRkNX0=_).

A dict of lists of clients for: SUCCESS, NOT_FOUND and ERROR statuses is returned.

• SUCCESS: the client certificate was successfully revoked.
• NOT_FOUND: no certificate was found on the server for this client, or no such client was found. Maybe the certificate was already revoked, or the client had no certificate yet, or the client had not reported its MAC address or serial number yet, if you passed a MAC address or a serial number.
• ERROR: an unexpected error occurred. Please check server logs for details.

Potential log entries

2019-06-12 7:12:02.481|main|FATAL|CLIENT|Unable to retrieve the contents of the cached custom field values: Error decrypting data
2019-06-12 7:12:02.833|main|INFO|CLIENT|CRL updated
2019-06-12 7:12:02.834|main|INFO|CLIENT|No certificate private key yet. Sending a certificate signing request to server my.FQDN.com.
2019-06-12 7:12:03.235|main|FATAL|CLIENT|Failed to send enrollment request (and CSR): error 400 a CSR for this client was already sent.
2019-06-12 7:12:03.235|main|INFO|CLIENT|Falling back to no certificate.

FileWave Client notification for zsh running in the background

What

When I upgraded my FileWave Client to 15.3.0 or newer I saw a popup saying "zsh is now running in the background". 

When/Why

This happens once when first going to version 15.3.0 or higher of the client on macOS. There is nothing to do. This popup is because the FileWave client needs permission to run zsh for scripting. It can be ignored and development is going to look at ways to suppress it so that in the future it should not show, but it should only happen 1 time on each machine and then even on newer versions of the clients you should not see it because it should already have the permission.

Related Content

• FileWave Version 15.3.1

FileWave Client Rename Behavior

Renaming a desktop client in the admin console will now change the Client Name inventory field to match the new name entered and also change the client name "sync" setting in the client's preferences. This ensures that the device is able to connect properly with FileWave instance without duplicated entries.  (The Device Name inventory filed is not modified)

So, when a client is renamed, the "Sync Computer Name" settings is turned off:

Further Details

• The FileWave Client uses its name as part of the identity of the client (see: How the FileWave Client Communicates for more)
• The FileWave Client has a configuration (FileWave Client Configuration Settings) to "Sync Computer Name" that can be changed one at a time (Via Client Monitor) or en masse (Creating a Superprefs Fileset).
• Renaming devices in the FW Admin (r-click → rename) has a different behavior depending on the device (see below)

FileWave Client Status Check: How to ask the client what it is doing on macOS and Windows

What

The FileWave client, available for both macOS and Windows, allows administrators to verify its status and understand the tasks it's currently handling. This can be accomplished by executing a specific command in the Terminal application on macOS, or the Command Prompt on Windows. This article provides instructions on how to use this feature for troubleshooting purposes.

When/Why

This feature is especially useful when you have direct access to the device and need to determine what the FileWave client is currently working on. It enables you to view the current status of the FileWave client, the filesets in inventory, and other crucial information.

You might find this feature beneficial when:

• You're diagnosing issues related to the application of filesets or profiles.

• The FileWave client is behaving unpredictably and you want to determine its current state.

How

Follow the steps below to check the status of the FileWave client:

macOS

1. Open the Terminal application on the macOS device.

2. Execute the following command: /usr/local/sbin/FileWave.app/Contents/MacOS/fwcld -s

Windows

1. Open the Command Prompt on the Windows device.

2. Depending on the architecture of your Windows OS, execute the appropriate command:

   • For Windows using FileWave 15.5 or higher run: "C:\Program Files\FileWave\client\fwcld.exe" -s
     

After running the command, you will see output similar to the example below:

**************************
**FileWave Client Status**
**************************
User ID: 11354
Current Model Number: 660

Filesets in Inventory:

1. Fileset Mac MDM OS Update - macOS Monterey 12.6.3 12.6.3, revision ID 10148, ID 10148, revision ID 10148, version 1 - Apple MDM OS Update is not supported (0)
2. Fileset Mac MDM OS Update - Safari 16.3, revision ID 10149, ID 10149, revision ID 10149, version 1 - Apple MDM OS Update is not supported (0)
3. Fileset FileWave_macOS_Client_14.10.2_df52a47c77, revision ID 10169, ID 10169, revision ID 10169, version 1 - Active (0)
4. Fileset Profile - TeamViewerHost Allow Standard User, revision ID 10173, ID 10173, revision ID 10173, version 1 - Handled via MDM (0)
5. Fileset Profile - Microsoft  Defender - Kernel Extension, revision ID 10190, ID 10190, revision ID 10190, version 1 - Handled via MDM (0)
6. Fileset Profile - Microsoft Defender - Notifications, revision ID 10191, ID 10191, revision ID 10191, version 1 - Handled via MDM (0)
7. Fileset Profile - Microsoft Defender - Web Content Filter, revision ID 10192, ID 10192, revision ID 10192, version 1 - Handled via MDM (0)
8. Fileset Profile - Microsoft Defender - TCC, revision ID 10193, ID 10193, revision ID 10193, version 1 - Handled via MDM (0)
9. Fileset Profile - Microsoft Defender - Data Acceptance, revision ID 10194, ID 10194, revision ID 10194, version 1 - Handled via MDM (0)
10. Fileset Profile - Microsoft  Defender - System Extension, revision ID 10195, ID 10195, revision ID 10195, version 1 - Handled via MDM (0)
11. Fileset Profile - Microsoft  - Background Service, revision ID 10196, ID 10196, revision ID 10196, version 1 - Handled via MDM (0)
12. Fileset MS Defender macOS, revision ID 10197, ID 10197, revision ID 10197, version 1 - Active (0)
Filesets not meeting requirements:


Worklist:

The output provides the following information:

• User ID and Current Model Number where User ID is really the ID number of the device in FileWave

• Filesets currently in the device's inventory, along with their status

• Filesets not meeting requirements

• Current worklist

This information can assist you in understanding the tasks that the FileWave client is processing and aid in troubleshooting any issues.

Related Content

• FileWave Log File Locations
• Using PowerShell to Remotely Check the Windows FileWave Client Status

FileWave Windows Network Sweeper

What

FileWave Windows Network Sweeper is a troubleshooting bundle for finding Windows clients that are online but not communicating correctly with the FileWave Server, then attempting a targeted repair. Typical causes include misconfiguration, user intervention, or a previously failed client upgrade.

When/Why

Run this during a normal peak-online window when you want to identify Windows devices that have recently checked in but have since gone quiet. A Group Policy deployment can enforce enrollment and check-in for many environments; the Client Deployment via GPO training gives one example of that approach, and the same general pattern can support other compliance checks.

How

Start with a small test group before running the process against a large exported list.

Prerequisites

• Run PowerShell as a user with administrative rights on the target Windows devices, usually a domain admin or an equivalent delegated admin account.
• The devices you are trying to catch must be online and reachable on the network.
• The process assumes the C$ admin share is reachable and that device names resolve correctly. Dynamic DNS needs to be working if you are relying on names instead of IP addresses.
• Know the FileWave Server FQDN and have a valid FileWave API token available.
• Download and unzip the Windows Network Sweeper bundle:

Windows Network Sweeper

PSTools is included in the download for convenience. You can also download the current PSTools package directly from Microsoft: PSTools download.

Before using the repair script broadly, confirm that the bundled FileWaveClient.msi is the client version you intend to install, or replace it with the correct installer for your environment. Also review the expected client version in 3_Check_Status.ps1 before treating its status output as authoritative.

Process Overview

1. Create an inventory query for Windows devices that have not checked in recently. A common starting point is OS Type = Windows and Last Connected within the past 30 days but not within the past 7 days. Adjust both date ranges for your environment.

2. Set the query output to include Device Name only. You can export IP addresses from the client view, but avoid using IP addresses from an inventory query in DHCP-heavy environments because the address may no longer belong to the same device.

3. Export the query results into the offline.txt file included in the ZIP. View > Export Current View is useful for this. Remove the header line that says Device Name.
4. Run 1_get_online.ps1 to test which exported devices are currently reachable. Reachable devices are written to online.txt.
5. If devices are found, run 2_repair_clients.ps1 to attempt the repair. This script uses PSExec to copy and run fix_fwclient.bat on the target device.
6. Run 3_Check_Status.ps1 to double-check repaired devices and identify anything that still needs manual remediation.

Related Content

• Client Deployment via GPO
• Creating a Superprefs Fileset
• Inventory Queries (Reports)

Digging Deeper

The download contains the scripts used in this workflow. Review them before running the bundle in your environment, test against a small set of known devices first, and keep the generated online.txt, output.txt, double_check.txt, and still_bad.txt files as your working record for follow-up remediation.

PSExec as a Helper in Troubleshooting

What

The PS Tools from Microsoft (from SysInternals)  are a terrifically powerful tool to help you troubleshoot when all else fails.  In this article we'll look at how you can use PSExec to help troubleshoot an ill-behaving FileWave Client.

When/Why

From time to time, things don't work right.  None of us would be employed if this weren't the case, so let's look on the bright-side of that!  But what to do if a FileWave client on a Windows device is misbehaving, and you can't communicate through normal FileWave channels?  PSEXEC to the rescue.

How

Assumptions made in the following:
1) You have download PSTools, and unzipped
2) That you launched a cmd prompt as a domain admin user (makes credentials issue easier to deal with)
3) That you have changed directory into the directory where PSTools is located

We'll start by simply connecting to the remote computer by name in an interactive PSEXEC shell:

psexec64 \\computername -h cmd

You'll end up in a shell like the below ('exit' will allow you to leave that shell)

Now, what's remarkable about this is that shell is running as your domain admin account, and you can do anything on it you can do from the command line.  This article isn't meant to be a Windows CLI primer, but the following are some examples of things we could do if we assume we have a device that isn't reporting in correctly:

1. Check the FileWave Client Service:

   • sc query filewavewinclient

     
2. Stop the FW Client Service

   • ---

     sc stop filewavewinclient

3. Restart the FW Client Service

   • ---

     sc start filewavewinclient

4. If the service won't start or stop, maybe we need to kill it forcefully by:
   1. Looking for the client process

      • tasklist | findstr fwcld

      • 

        
        

   2. And then killing it by PID

      • taskkill /PID 16264 /F

      • Note that this same procedure can be very helpful to clear up a misbehaving Windows Update agent.  When Windows Update hangs, the service itself usually won't stop.  Taskkill /SVC | find wuauserv will identify the proper task to stop to correct this.  (A reboot is also corrective for this, but onviously impacts the use of the device)

5. Check the FW Client Log for entries from today

   • type c:\programdata\filewave\fwclient\fwcld.log | findstr mm-dd

   • (where mm-dd is today's date such as 05-16)
6. Get the IP of the workstation

   • ipconfig

7. Restart the device (which is obviously destructive to any existing user)

   • shutdown -r -t 0 -f

8. Determine if there are other users logged in

   • quser

   • 
9. Get the last boot time

   • Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object LastBootUpTime

   • 

Related Content

• PS Tools
• Great reference for Windows CLI commands (SS64)
• wmic deprecation

Troubleshooting Windows Client Upgrade Fileset Issues

What

The FileWave Windows Client upgrade fileset uses a more orchestrated process than a typical Windows software deployment.

For most Windows software deployments, the FileWaveWinClient service runs the installer as the local system account. A client upgrade has an extra challenge: it must remove the existing FileWave Client, install the updated one, and keep the process moving even though the service that normally performs installs has to be stopped and replaced.

To handle this, the upgrade fileset installs a temporary upgrade helper, creates a scheduled task, stops the existing FileWave Client service, runs the new client MSI, starts the upgraded service, and then removes the temporary upgrade pieces. This also helps the device continue the upgrade workflow and report back to FileWave when the upgrade completes.

The example above shows the main upgrade fileset components:

• FileWaveWinUpgradeClient.msi: installs the temporary upgrade helper.
• scheduleRestart.bat: creates the scheduled task that starts the upgrade process.
• upgradeClient.bat: handles most of the upgrade workflow.
• FileWaveClient.msi: installs the target FileWave Windows Client version.

When/Why

Use this article when a FileWave Windows Client upgrade fileset does not complete, the client version does not update in inventory, the Windows client service does not restart after an upgrade, or a device is left with a non-functional FileWave Client after an attempted upgrade.

If the issue is that the upgrade fileset did not import correctly, does not show the expected files, or was extracted incorrectly before deployment, start with Troubleshooting Deployment Issues with the FileWave Upgrade Fileset.

This article is also useful before a broad Windows Client upgrade rollout, because most upgrade issues are easier to find and fix during a small pilot than after the fileset has been deployed widely.

How

1. Understand the upgrade flow

The Windows Client upgrade fileset normally works in this order:

1. FileWaveWinUpgradeClient.msi runs first and installs a temporary upgrade helper.
2. scheduleRestart.bat creates the FileWave Client Upgrade scheduled task.
3. upgradeClient.bat checks the target version, disables automatic service restart during the upgrade, stops the existing FileWaveWinClient service, and starts the client installer.
4. FileWaveClient.msi installs the new FileWave Windows Client.
5. The upgrade process removes the scheduled task and temporary upgrade files after the installer completes.

If the old client service is hung, the upgrade script retries the stop process and may need to terminate the service process. That is expected behavior during this upgrade, but it can expose device-specific problems such as a stuck service, pending Windows Installer issue, or previous failed upgrade cleanup.

2. Collect the upgrade logs

Collect these logs before retrying the upgrade or manually cleaning up the device when possible. They are usually the fastest way to tell whether the issue is the upgrade workflow or the Windows MSI installer.

The primary logs are in C:\temp:

• UpgradeClient.log: shows the upgrade script flow, including version checks, scheduled task behavior, service stop attempts, and cleanup.
• FileWaveClientUpgraderUninstall.log: shows removal of the temporary upgrade helper.
• FileWaveClient.log: verbose MSI log for the new FileWave Windows Client installer.

Also check the Windows Application log in Event Viewer for Windows Installer errors, such as 1603 or 1638. The normal FileWave Client log may be less useful during the upgrade because the client service is intentionally stopped as part of the process.

3. Check the common failure points

Most failed Windows Client upgrades fall into one of these categories:

• The existing FileWaveWinClient service is hung and does not stop cleanly.
• A previous failed upgrade left behind the scheduled task or temporary upgrade helper.
• The new FileWaveClient.msi launched, but Windows Installer failed to complete the install.
• The device has a local Windows issue that would also affect a manual client MSI install, such as a pending reboot, Windows Installer problem, security software interference, or an existing conflicting client install state. In some cases, Windows Installer blocks the new client install until the system restarts, and that condition is not always obvious before the upgrade starts.

If FileWaveClient.log shows an MSI failure, troubleshoot it as a Windows Installer/client MSI issue first. In many cases, the same failure would happen if the MSI were run manually on the device.

4. Clean up leftovers from a previous failed upgrade

Use these commands only when the logs or device state indicate that a previous failed upgrade left behind the scheduled task or temporary upgrade helper. Run them from an elevated Command Prompt.

Delete the scheduled task:

schtasks /delete /f /tn "FileWave Client Upgrade"

Remove the temporary upgrade helper:

start /wait msiexec /l*v C:\temp\FileWaveClientUpgraderUninstall.log /qn /norestart /x "{E3DC560D-C698-41DF-8B6C-EEA0BEFC44EF}"

Start the FileWave Windows Client service if it is installed and should be running:

sc start filewavewinclient

After cleanup, retry the upgrade on the affected device or move the device back into a small test group before attempting broader deployment.

5. Isolate MSI installer issues

On a device that has not yet completed the upgrade, run the full FileWaveClient.msi manually to test the installer outside of the upgrade fileset workflow.

This removes the scheduled task, temporary helper, and service-stop logic from the test. If the manual MSI install fails the same way, focus on the MSI error, the Windows Application log, and the device state rather than the upgrade fileset.

6. Recover a non-functional client

If the FileWave Client is no longer functional and cannot receive a normal fileset, use remote administrative tools to inspect the device, collect logs, restart services, or run cleanup commands.

For one supported approach, see PSExec as a Helper in Troubleshooting.

7. Roll out upgrades in phases

Deployment warning: Do not deploy a Windows Client upgrade fileset globally as the first test.

Start with a small pilot group. After deployment, run a Verify and confirm that inventory reports the expected FileWave Client version. If that pilot succeeds, expand to a larger test group. Move to broad deployment only after the larger group is also successful.

This takes more time up front, but it is much easier than recovering many Windows clients after a failed broad rollout.

Related Content

• PSExec as a Helper in Troubleshooting
• Using PsExec to Remotely Restart the FileWaveWinClient Service
• Troubleshooting Deployment Issues with the FileWave Upgrade Fileset
• Using Native Windows Tools to Troubleshoot

Using PsExec to Remotely Restart the FileWaveWinClient Service

What

Using PsExec to remotely restart the "FileWaveWinClient" Windows service allows you to remotely manage the FileWave client on Windows devices. This can be useful in situations where the client is not functioning properly and needs to be restarted in order to resolve the issue.

When/Why

There may be a variety of reasons why you would need to remotely restart the FileWaveWinClient service on a Windows device. Some common reasons include:

• The service has stopped functioning properly and needs to be restarted in order to resolve the issue

• The service needs to be restarted in order to apply a configuration change

• The service needs to be restarted as part of a troubleshooting process

How

To use PsExec to remotely restart the FileWaveWinClient service, you will first need to download and install PsExec on the device from which you will be initiating the restart. PsExec can be downloaded from the Microsoft TechNet website (https://docs.microsoft.com/en-us/sysinternals/downloads/psexec ).

Once you have PsExec installed, you can use the following command to remotely restart the FileWaveWinClient service:

psexec \[remote device] -u [username] -p [password] net start "FileWaveWinClient"

Replace [remote device] with the hostname or IP address of the remote device, and [username] and [password] with the appropriate credentials for the remote device.

Related Content

• Microsoft TechNet: PsExec (https://docs.microsoft.com/en-us/sysinternals/downloads/psexec )

Digging Deeper

In addition to using PsExec to remotely restart the FileWaveWinClient service, you can also use the "net" and "sc" command-line tools to query and change Windows services.

To query a service using "net", you can use the following command:

net start [service name]

This will display the status of the specified service.

To start or stop a service using "net", you can use the following commands:

net start [service name] net stop [service name]

To change the startup type of a service using "net", you can use the following command:

net start [service name] [startup type]

Valid startup types include: boot, system, auto, demand, disabled

To query a service using "sc", you can use the following command:

sc query [service name]

This will display detailed information about the specified service, including its status, startup type, and binary path.

To start or stop a service using "sc", you can use the following commands:

sc start [service name] sc stop [service name]

To change the startup type of a service using "sc", you can use the following command:

sc config [service name] start=[startup type]

Valid startup types include: boot, system, auto, demand, disabled

Keep in mind that you will need to have the appropriate permissions on the remote device in order to use these commands. You can also use PsExec to execute these commands remotely, as described in the previous section.

Network Proxy, Content Filter, and SSL Inspection Troubleshooting

What

FileWave components need reliable network access to the destinations listed in Default TCP and UDP Port Usage. Depending on the workflow, that may include the FileWave Server, FileWave Boosters, FileWave cloud services, vendor services from Apple, Google, or Microsoft, licensing and notification services, remote-control services, cloud Fileset storage, or Kiosk/App Portal download locations. That traffic is encrypted. Proxies, web filters, secure web gateways, firewalls, and content filters can block or alter that traffic, which can cause the affected FileWave feature to fail even when the FileWave Server itself is working correctly.

This can happen with products such as Lightspeed Filter, GoGuardian Admin, Securly Filter, Linewize Filter, ContentKeeper, iboss, Cisco Umbrella, Zscaler Internet Access, Netskope, Fortinet/FortiGate, Palo Alto Networks, Sophos Firewall, WatchGuard, Check Point, and similar proxy or filtering systems. The exact product name is less important than the behavior: if the product blocks the required host, blocks an unknown or uncategorized URL, or performs SSL/TLS inspection on traffic that must remain end-to-end trusted, the FileWave feature that depends on that destination may not be able to communicate.

The Kiosk IPA URL https://fw-kiosk-v2-ipas.filewave.cloud/ is one example because blocking it can prevent Kiosk installation. The same principle applies to any FileWave address or vendor address required by the workflow and listed in the port usage article.

When/Why

Use this article when FileWave behavior changes depending on the network, filtering policy, or proxy path. Common examples include:

• The FileWave Client checks in on one network but not another.
• Devices stop reporting inventory or processing manifests.
• The FileWave Kiosk or App Portal does not appear or does not install.
• iOS/iPadOS Kiosk installation fails with an error like:

Could not validate manifest..An SSL error has occurred and a secure connection to the server cannot be made.

• A content filter shows FileWave URLs as blocked, uncategorized, unknown, newly seen, or unclassified.
• Security logs show a FileWave destination from Default TCP and UDP Port Usage being blocked or inspected, such as the FileWave Server hostname, *.filewave.cloud, fw-kiosk-v2-ipas.filewave.cloud, cloud Fileset storage, notification services, or Apple/Google/Microsoft service endpoints.

FileWave communication relies on encrypted, certificate-based connections. On macOS and Windows, modern FileWave Client communication uses mutual TLS for client/server trust. Apple, Google, Microsoft, and FileWave cloud services also expect valid TLS connections. If a filtering product performs SSL inspection, HTTPS inspection, TLS inspection, SSL decryption, certificate inspection, deep packet inspection, DPI, or a similar feature that replaces the remote certificate with a filtering certificate, the connection may fail because the device is no longer seeing the certificate it expects.

This is not limited to one vendor. Lightspeed is a common example in schools, and Lightspeed environments that block Unknown or Uncategorized sites may block a FileWave cloud URL until it is recategorized or explicitly allowed. Other web filters and secure web gateways can create the same symptom under different names.

How

1. Map the symptom to the FileWave feature

Before changing proxy or firewall rules, identify which FileWave feature is failing. Then use Default TCP and UDP Port Usage to find the destinations and ports used by that feature.

A browser test is useful, but it is not the whole test. FileWave background services may run outside the user’s browser session, may not be able to answer a proxy authentication prompt, and may use ports or TLS behavior that a browser test does not exercise.

2. Confirm whether the filter or proxy is involved

Start by comparing a working and failing path.

• Test the affected device on a network that does not use the same proxy or content filter, such as a known-good test VLAN or temporary hotspot.
• Check the proxy, firewall, or web-filter logs for the affected device at the time of failure.
• Look for blocked or inspected traffic to the FileWave Server hostname, FileWave Booster hostname, FileWave cloud URLs, Apple services, Google services, or Microsoft services used by the platform.
• If only one network or policy fails, the issue is likely in the network path rather than the FileWave Server itself.

3. Allow the required FileWave destinations

Use Default TCP and UDP Port Usage as the source of truth. Identify which FileWave component, platform, or workflow is failing, then verify every destination and port listed for that area. A blocked Kiosk download host breaks Kiosk installation, but a blocked license, notification, remote-control, cloud Fileset, Apple, Google, Microsoft, Server, or Booster destination can break the feature that depends on that traffic.

Common destinations to review include:

• The customer’s FileWave Server hostname or FQDN used by clients and enrolled devices.
• Any FileWave Booster hostnames used by clients.
• *.filewave.cloud
• https://fw-kiosk-v2-ipas.filewave.cloud/
• Hosted-customer cloud Fileset storage destinations listed in Default TCP and UDP Port Usage, when applicable.
• Apple, Google, and Microsoft endpoints required for the platform being managed.

Do not rely only on a port being open. Category-based filtering can still block an allowed port if the destination is classified as unknown, uncategorized, newly registered, or otherwise not allowed by policy.

Examples: blocking the FileWave Server or Booster can break check-in, inventory, manifests, or Fileset downloads; blocking *.filewave.cloud or fw-kiosk-v2-ipas.filewave.cloud can break Kiosk/App Portal downloads; blocking cloud Fileset storage can break hosted Fileset delivery; blocking licensing, notification, TeamViewer/remote-control, AutoPkg, or version-check destinations can break those specific services; and blocking Apple, Google, or Microsoft endpoints can break platform enrollment, app management, software updates, or MDM/EMM workflows.

4. Check common proxy/filter failure patterns

Proxies and filters can break FileWave traffic in several different ways. Check for all of these, not just a simple block/allow result:

• Category or reputation blocking: the destination is marked unknown, uncategorized, newly seen, or not in an allowed category.
• SSL/TLS interception: the filter replaces the real certificate with its own certificate so the device no longer trusts the connection.
• Authenticated proxy or captive portal requirements: browser traffic works after a user signs in, but FileWave background services cannot answer the prompt.
• Transparent proxy behavior: the proxy handles normal web browsing but not FileWave service traffic, NATS, Booster traffic, or other non-browser connections.
• DNS or SNI filtering: the device resolves or reaches a different path than expected, or the filter blocks based on hostname before the connection is established.
• Different rules by network, VLAN, device type, user group, time, or off-site/on-site policy.

5. Bypass SSL/TLS inspection for FileWave management traffic

For FileWave Client, Kiosk, MDM, Booster, and FileWave cloud traffic, allow the traffic without certificate replacement or HTTPS decryption. For Apple, Google, and Microsoft services used by managed-device workflows, follow the vendor network guidance and avoid inspection where the vendor requires direct TLS trust.

Depending on the product, this setting may be called:

• SSL inspection
• SSL decryption
• TLS inspection
• HTTPS inspection
• HTTPS proxy/content inspection
• Certificate inspection
• Deep packet inspection or DPI
• Secure web gateway inspection
• Man-in-the-middle inspection

The goal is the same: FileWave-managed devices must see the real certificate presented by the FileWave Server or cloud service, not a substitute certificate generated by the filtering product.

6. Lightspeed-specific example: Unknown or Uncategorized destinations

In Lightspeed environments, check whether the affected URL is listed as Unknown or blocked by an Unknown / Uncategorized category rule. Apply that check to the FileWave and vendor destinations required by the failing workflow. For FileWave Kiosk 15.3.1 and later, one known example is:

https://fw-kiosk-v2-ipas.filewave.cloud/

If Lightspeed is blocking this URL, the Kiosk installation may fail with a manifest validation or SSL error even though other FileWave functions appear normal. If a different FileWave feature is failing, check the corresponding destinations from the port usage article instead of focusing only on the Kiosk URL.

7. Test from the affected network

From macOS or Windows on the same filtered network, test the specific destination that matches the failing workflow. For the Kiosk IPA host, for example:

curl -Iv https://fw-kiosk-v2-ipas.filewave.cloud/

A successful connection should complete a TLS handshake and return an HTTP response from the destination. A failure may show certificate validation errors, proxy-generated certificates, connection resets, block pages, authentication prompts, or timeouts.

For iOS/iPadOS, use the filter logs and a browser test from the same network or policy where possible. The device may not expose the same command-line testing tools, so the proxy/filter logs are often the best evidence.

8. Retest FileWave behavior

After updating allow/bypass rules:

• Retry the FileWave Kiosk or App Portal installation.
• Force or wait for the FileWave Client to check in.
• Confirm inventory, manifests, and Fileset downloads behave normally.
• Review filter logs again to verify the FileWave traffic is allowed and not being decrypted.

9. If it still fails, collect evidence before escalating

If the traffic still fails after allow and inspection-bypass rules are updated, collect enough detail to show where the failure occurs:

• The affected FileWave feature, platform, and device name or serial number.
• The network, VLAN, proxy/filter policy, and whether the same device works on another network.
• The timestamp of the failure and the corresponding proxy/firewall log entry.
• The blocked destination, category, action, and whether SSL/TLS inspection was applied.
• Any command output, such as curl -Iv, showing the connection, certificate, block page, reset, timeout, or proxy-generated response.
• Relevant FileWave Client, Kiosk/App Portal, or MDM logs for the same time window.

Related Content

• Default TCP and UDP Port Usage
• How the FileWave Client Communicates
• Resolving SSL and Manifest Validation Errors with FileWave Kiosk Installation (15.3+)
• Bypassing DPI for Apple Traffic in MDM Communication
• Customer Technical Support

Using PowerShell to Remotely Check the Windows FileWave Client Status

What

The FileWave Client on Windows is like any other software service...the service can be impacted by computer uptime, user interference, crashes, etc.  This article gives you a way to INDEPENDENTLY check that a list of devices has the FileWave Client, and it is in working order (or not).

When/Why

Will you need this frequently?  Unlikely, but all the same, it is a great tool for sweeping a network to look for devices and confirm the FileWave client (for Windows only).  The code here does make some assumptions about your environment, but those are called out below.

How

So, you think the FileWave client may be broken or missing on some endpoints?  Wouldn't it be great if you could verify that remotely rather than having to confirm the devices by hand.  The following allows you to do just that.

#import a list of computers
$mypath=$MyInvocation.MyCommand.Path
$mypath=Split-Path $mypath -Parent
try {
    $computers=Get-Content $mypath\computers.txt -ErrorAction Stop
} catch {
    #no computers.txt file found
    write-host "`nTo use this utility, a text file called computers.txt must exist in the same location as the script.  The file should contain one computer name or IP per line"
    break
}

foreach ($computer in $computers) {
    $online=$false
    try{
        #try to resolve the name
        $online = Resolve-DnsName $computer -quicktimeout -ErrorAction Stop
        $online = $true
    }catch{
        #Catching errors...machine offline
        $online= $false
    }

    if (!$online) {
        #device not online...show it in UI so that we see progress, but don't write it to the results file since it isn't actionable
        write-host "$computer, Not online"
    } else {
        #device online, so let's just see if the service is there
        $fw_service=""
        try{
            #Getting service ...sometimes device might not allow collection (if RPC is unavailable for instance)
            $fw_service = Get-Service -ComputerName $computer  -Name 'FilewaveWinClient' -ErrorAction Stop
            $fw_service=$fw_service.Status
        }catch{
            #Catching errors...no filewave service
            $fw_service="no"
        }

        if ($fw_service -eq "no") {
            #no need to look further since we either can't talk to RPC, or there is no FW service
            write-host "$computer, No FW Service or RPC unavailable" 
            Add-Content -Path $mypath\output.txt -Value "$computer, FW Needs Installed or RPC Unavailable"

        } else {
            #fw is there as a service, so let's return status, version, and server address            
            try {
                #using C$ share, which won't require winrm
                $TargetPath = "\\$computer\C$\Program Files (x86)\FileWave\fwcld.exe"
                $fw_version = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($TargetPath)
                $fw_version = $fw_version.ProductVersion       
            } catch {
                #Catching errors
                $fw_version="version not readable"
            }

            #get fw server address from registry
            try {
                #read server address from registry
                #we need remote registry turned on to read, but we'll turn it back off
                #note this does not account for an environment where remote-registry is on by default...if so, comment out the remote registry lines
                Get-Service -ComputerName $computer -Name RemoteRegistry | Set-Service -StartupType Manual -PassThru| Start-Service

                $Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $computer)
                $RegKey= $Reg.OpenSubKey("SOFTWARE\\WOW6432Node\\FileWave\\WinClient")
                $fw_server = $RegKey.GetValue("Server")

                #turn remote registry back off
                Get-Service -ComputerName $computer -Name RemoteRegistry | Set-Service -StartupType Disabled -PassThru| Stop-Service
                
            } catch {
                #Catching errors...no registry
                $fw_server="server address not readable"
            }

            #write the output
            write-host "$computer, $fw_service, $fw_version, $fw_server"
            Add-Content -Path $mypath\output.txt -Value "$computer, $fw_service, $fw_version, $fw_server"
            
        }
    }
}

Assumptions made in the above code:
1.  There is a text file called computers.txt in the same location as the Powershell script
2.  That computers.txt file contains a computer name or IP per line (name is better if you have dynamic DNS)
3.  That the Powershell itself is running from a Domain Admin account...this avoids any credential related issues
4.  It is assumed that WinRM is not enabled in your environment (if it is this code could easily be made more elegant)

Note that this script could easily be modified to look at other services, to authenticate differently, and to take remediation.  As provided, it simply provides a list of results of device name, FW service status, FW client version, and FW server address assigned.  All very useful information for troubleshooting.  PSEXEC is highly recommended for taking corrective action.

Related Content

• Script Best Practices
• Using PsExec to Remotely Restart the FileWaveWinClient Service
• FileWave Client Status Check: How to ask the client what it is doing on macOS and Windows

Digging Deeper

If you want a resource to pre-sweep the device list for devices that are online separately, you can use the following.  A refined list will just make the above script run a bit faster.

#Let's just look for a list of devices online

#import a list of computers
$mypath=$MyInvocation.MyCommand.Path
$mypath=Split-Path $mypath -Parent
$computers=Get-Content $mypath\online_test.txt

foreach ($computer in $computers) {
    $online=$false
    try{
        #try to resolve 
        $online = Resolve-DnsName $computer -quicktimeout -ErrorAction Stop
        $online = $true
        write-host $computer
    }catch{
        #Catching errors...machine offline
        $online= $false
    }
}

When does the inventory client run scans?

Inventory

The FileWave Client runs an inventory scan at startup, every time you execute a verify on the client, and every 24 hours.

Troubleshooting Deployment Issues with the FileWave Upgrade Fileset

Scope: This article covers upgrade fileset deployment, redeploy, and Windows import/extraction issues. If the Windows upgrade fileset imports and deploys but the client upgrade itself does not complete, the client version does not update in inventory, or the service does not restart, see Troubleshooting Windows Client Upgrade Fileset Issues.

macOS Deployment

Issue: Devices show that the latest FileWave Client is not installed despite deploying the Fileset.

Solutions:

• Navigate to the Upgrade Fileset in FileWave Admin Central.
• Select Fileset Report from the top menu.
• Highlight all devices listed.
• Choose Reinstall on Selected Devices.

• Remove the Fileset Association from all devices, or remove targets from the Deployment.
• Perform model update after removing the association/deployment.
• Re-add to deployment or recreate association, Update Model.

Cause:

Windows Deployment

Issue: Errors occur when deploying the Fileset due to improper extraction during setup.

Solution:

• Remove the Fileset association from devices.
• Delete the current Fileset from FileWave.

• Download the Upgrade Fileset again.
• Right-click the downloaded file and select Extract All.
• Open the extracted folder, which should look like this: ~Upgrade_Fileset_for_Windows.fileset.
• Inside, you’ll find another folder with the same name. Drag and drop this inner folder into FileWave to create the new Fileset.

Verification:

Examples:

First FileWave Client 15.1.0+ Upgrade Requires Reboot on macOS 14+

What

This article explains why, on macOS 14.0 or higher, a FileWave Client upgrade from a version prior to 15.1.0 to 15.1.0 or higher does not appear to complete until after the next system reboot. This is due to new Apple privacy restrictions (TCC) that block the script responsible for restarting the FileWave Client as part of the upgrade process.

When/Why

This scenario occurs on the first upgrade to FileWave Client 15.1.0 or higher on any Mac running macOS 14.0 or later, if the device is upgrading from a version lower than 15.1.0.

• After the upgrade process runs, the previous FileWave Client version continues to operate and check in normally.

• The upgraded client is present on disk but will not run until the next reboot.

• Once the device is restarted, the new FileWave Client version launches, and—if the device is MDM-enrolled—the necessary TCC profile is deployed automatically. This resolves the restart issue for all future upgrades.

How

Recommended steps for best results:

• Upgrade the FileWave Client to 15.1.0 or newer before updating to macOS 14, if possible. This ensures full compatibility and a seamless upgrade experience.

• MDM-enroll your macOS devices. FileWave 15.1.0+ will automatically deploy the needed TCC profile through MDM, which allows future upgrades to restart and activate the new client version immediately, even on macOS 14 or higher.

• If you have already upgraded to macOS 14 before installing FileWave Client 15.1.0 or newer, no action is needed:

  • The older client will continue to run until the next system reboot.

  • After a reboot, the new client will be active, and upgrades going forward will complete as expected.

Related Content

• FileWave Release History

Offboarding Clients

Archiving Clients

One of the State options of FileWave is archiving clients.  Archived clients do not consume a FileWave licence.  Device records will continue to exist from the point of archive, but the device will no longer receive any communication with the FileWave Server.

Archived devices are known to be 'removed from the FileWave Model'.  Model Update changes will not apply.

Archived Clients are hidden from view by default, but there is the option to 'Show' them if desired:

Archiving, removes devices from the FileWave Model

A Model Update is required after making any state change.

Computer Clients

Once archived, computer clients will not be included in any model updates, nor will their inventory update with the server.  

At any point, the device may be removed back from archived using the Reinstate option.

Since the FileWave Client is not removed on archive, the device should continue to check back in as before, updating to the latest model.

Apple MDM enrolment is of concern when re-instating, as highlighted in the below section.

The following KB articles describe removing the FileWave Client.   If attempting to remove the client through FileWave, these Filesets should be pushed to devices prior to archiving:

Uninstall the FileWave Client on Windows

Uninstall the FileWave Client on macOS

Clearly, if the FileWave Client is removed from the device, a Reinstate will not cause the device to check back in.  The FileWave Client will requiring reinstalling.

Apple MDM

When archiving devices which are MDM enrolled, it is possible for the enrolment profile to be removed during the state change to archived.  Whether the enrolment profile removal is attempted is based upon either the type of enrolment or the FileWave Central Admin setting found in:

• Preferences > Mobile

Devices will not be able to report success of the profile removal, since once the profile is removed, there is no longer a mechanism to report back success.

Archiving a device enrolled using Automated Device Enrolment (also know as DEP) will even attempt to remove enrolment profiles which are configured to be non-removable.  Indeed, Apple only supply two official options for removing an enrolment profile configured as non-removable: MDM command to remove (as triggered by archiving) and wiping the device.

See the troubleshooting section below for further information on removing a non-removable profile.

Troubleshooting

Since MDM enrolment profiles may be configured to be non-removable, how can this be addressed if for some reason the command to remove the profile is not received, since it is not possible to re-instate and try another archive.

If the reason the below is being attempted is due to a device no longer appearing to be MDM enrolled despite it originally being otherwise, recommendation would be to try the below option for re-enrolment, before using the extreme method of disabling SIP and editing the OS.

Apple's SIP (System Integrity Protection) prevents certain folders and files being altered, enrolment profile and related files included.  Therefore, to remove a non-removable profile without wiping the device, involves disabling SIP, removing the related files and then reinstating SIP for security.

The below methods are not supported by Apple or FileWave and any unexpected behaviour from attempting any of the following is the sole responsibility of those actioning the commands.

Disabling SIP

• Boot into recovery (reboot the device and hold the two keys CMD and R when presented with the Apple Logo)
• Use the menu to open Terminal
• In Terminal, type the following:

# csrutil disable  && reboot

This should both disable SIP and cause the computer to reboot to finalise the process.

Removing Enrolment

Enrolment profile and matching files are found in the following directory:

# /var/db/ConfigurationProfiles/

Use the following commands to remove profiles and reinstate SIP:

# rm -rf /var/db/ConfigurationProfiles/Store/*
# csrutil clear
# reboot

Re-Enrolment

If it is deemed necessary to re-enrol the device, follow these final steps:

• Reinstate the device in FileWave (you cannot re-enrol an archived device - A Model Update is required afterwards)
• Log into the device with an Administrator account
• Trigger the below command via Terminal:

• # sudo profiles renew -type enrollment

• A macOS notification should appear, which will need to be accepted by entering the Administrators Password
• Another notification should appear, requesting the authentication (username and password) of the user to enrol the device

On completion the device should have re-enrolled.  Confirmation may be observed with the following command and similar output.  

Output may vary depending upon macOS version.  Server name will be the name of the server the device enrolled with.

# sudo profiles status -type enrollment
Enrolled via DEP: Yes
MDM enrollment: Yes (User Approved)
MDM server: https://demoserver.filewave.net:20443/ios/mdm

Retiring a device from FileWave

Whether selling or removing devices that no longer function or are beyond use, it may be necessary to remove them from FileWave.  The following steps should assist with this process.

The basics are:

• Ensure all enrolment configuration is removed from device or device is wiped
• Delete the device from within FileWave

Apple Business or School Manager Specific

Where devices are MDM enrolled through a Business or School Manager account, if the devices are no longer going to belong to the organisation, they should be released from Apple.  Please see Apple's documentation to action this process:

• Release devices in Apple Business Manager
• Release devices in Apple School Manager

After releasing a device, a subsequent synchronisation with DEP should remove the device from the DEP Associations Management view.

If devices are not released, after being wiped, they will force the user to re-enrol the device, if there is still an associated DEP Enrolment Profile

Pre-Deletion

There are two choices:

• Wipe devices
• Remove enrolment, e.g. selling devices to users, allowing them to keep data.

Wipe

Either locally trigger devices to be wiped or where possible, FileWave Central Admin App may send a command to wipe devices.  Update Model after actioning a Wipe command.

Not Wiping

If devices are not to be wiped, enrolment should be removed from the devices.

* Apple Enrolment Profile may be removable from Settings.

 If Apple devices are enrolled with a setting to prevent the MDM Enrolment Profile from being removed through Settings, Archiving a device sends a command to remove the Enrolment Profile from the device.

To Archive a device, open the FileWave Central Admin App, select device, right click and choose Client State > Archive, followed by an Update Model.

Uninstalling FileWave Client

macOS

Please follow the instructions on removing the FileWave Client

• Uninstall the FileWave Client on macOS

Windows

1. Click on the Start Menu button

2. Type remove in the search bar

3. Choose Add/Remove Programs

4. Scroll down to find the FileWave Client

5. Click Remove

6. Allow the FileWave Client to uninstall

Deletion

Once devices have been wiped or any enrolment has been removed, the devices may then be deleted from FileWave.

1. Open the FileWave Central Admin App

2. Select device(s) from the Clients view

3. Right click
4. Choose Delete
5. Update Model

Archived devices may be either deleted or left in FileWave.  Archived clients are merely fixed records, there is no further attempts to communicate with the device and they do not use up FileWave client licences.

If any enrolment configuration is not removed from the device prior to deletion, the device will attempt to check back and may recreate the device record.

Uninstall the FileWave Client on Windows

Description

The below Fileset can be used to uninstall the FileWave client on Windows machines. 

Ingredients

• FW Admin
• FileWave Client uninstall Fileset

Directions

1. Download the attached Fileset from the recipe.
2. Drag and drop the unzipped Fileset in to your Filesets tab. Please make sure to drag it in your root level of your Filesets structure so it is not accidentally deployed to devices. This Fileset will uninstall the client and break communication to your FileWave server.
3. Associate the Fileset to machines that you want to remove from FileWave.
4. Once the Fileset is sent out the devices will not check back in and can be deleted from FileWave.

Windows-ClientUninstaller.fileset.zip

Last tested successfully November 10th, 2021. 

Uninstall the FileWave Client on macOS

Description

The below methods can be used to uninstall the FileWave client on macOS machines. 

Updated with version 4.1.  Version 4 did not allow for the removal of the FileWave VNC client and as such will cause devices to reboot and not uninstall the FileWave Client.  Please update to version 4.1 to avoid this issue.  Version 4.1 will still work with older version of FileWave Client.

Ingredients

• FileWave Uninstall, Fileset or Stanadalone

Directions

Fileset

1. Download the attached Fileset and unzip
2. Drag and drop the unzipped Fileset in to your Filesets tab. Please make sure to drag it in your root level of your Filesets structure so it is not accidentally deployed to devices. This Fileset will uninstall the client and break communication to your FileWave server.
3. Associate the Fileset to machines that you want to remove from FileWave.
4. Once the Fileset is sent out the devices will not check back in and can be deleted from FileWave.

↓ macOS

Standalone

1. Download the attached script
2. Use Terminal to run the script locally as root

↓ macOS

This will uninstall the FileWave Client, but it will not remove an MDM enrolment profile if installed.  As such, the device may still be able to connect back to the FileWave Server over MDM, but will be unmanageable.  Additionally, if the Custom PKG is configured to instal beyond initial enrolment, MDM can reinstall the client onto the device again.  Ensure the MDM profile is also removed if removing the client from FileWave.

Removing Android Devices

Wipe Device

Send a wipe command to erase the device. On the next Google sync, the device should turn red in FileWave. You can then delete the device and update the model.

Removing a device without enrollment

If the device is erased locally or the FileWave Client is removed, FileWave and Google do not know that the device is gone. Deleting it from FileWave can look successful at first, but Google will add it back on the next synchronization.

Use the same cleanup path: send the Wipe command, wait for the next Google synchronization, then delete the device once it turns red in FileWave.