Note: The installer instructions for the Linux server and Booster are also located on the same page of the web site. Server installation instructions are covered in [FileWave Server Installation](https://kb.filewave.com/books/filewave-server/chapter/filewave-server-installation-upgrade "FileWave Server Installation"). There is no Linux client.
## Installing the FileWave client Client installers for both macOS and Windows use the same general dialogs. You will need to read and accept the license agreement, and you will be presented with a dialog window asking you for specific information to connect your client. Note: on some Windows computers, the FileWave Client Installer Assistant window is positioned directly behind the installer window, which you need to move to get to the Installer Assistant to complete the installation.   ## Installation Settings - ***Server address / port*** - Enter the IP address or FQDN of your FileWave server. Enter the TCP port number for the client to communicate with the server (default is 20015) - ***Booster address / port*** - If your client is going to get its Filesets from a Booster, enter the IP address or FQDN of the FileWave Booster. Enter the TCP port number for the client to communicate with the Booster (20013) Note: More on working with FileWave Boosters in [Boosters](https://kb.filewave.com/books/boosters "Boosters"). - ***Use Computer Name for Client Name*** - this box allows you to use the device's computer name as its FileWave client name. - ***Client Name*** - enter a valid name based on any criteria you have for your deployment. It is recommended that you do not use special characters in the client name. Dashes, underscores, and slashes are ok. - ***Client Password / Confirm****…* - enter a password used by FileWave administrative connections to the client. This does not need to be a local administrator password for that device. **Note: You must provide a password in order for the Remote Control/VNC relay to function.** ## Edit Custom Data…  The custom fields consist of a series of optional Inventory data fields that can be used to provide more detailed information on any Client. This information cannot be set in the automated installer, and must be applied manually. The information provided will be displayed as part of **Client Info** in the **Clients** pane of FileWave Central by right-clicking any client and selecting **Client Info…**, and it can also appear in **Inventory Reports (formerly Queries)**.  ## Automating installation with a custom client installer Manual installation works for small deployments. For larger rollouts, build a customized client installer with the connection settings already filled in: For macOS: [https://custom.filewave.com/py/custom\_client\_mac.py](https://custom.filewave.com/py/custom_client_mac.py) For Windows: [https://custom.filewave.com/py/custom\_client\_win.py](https://custom.filewave.com/py/custom_client_win.py)The customized macOS client is required for MDM/ADE support and must be uploaded in FileWave Central under Mobile preferences.
The form is shown on the next page.  Many fields are required.Note: The default port setting is 20015. However, SSL is now required, and the system will automatically use port 20017 instead when 20015 is entered. **Do not manually set the port to 20017**. Always enter 20015, and the system will handle the SSL port change for you.
## Advanced Options  The custom installer does not ask the user for any device specific information, and can be distributed through several means: - Apple's Automated Device Enrollment (ADE) uses the custom installer to enroll institutionally purchased devices automatically with your FileWave Server. - Add the custom installer to an image set when doing direct or network mass imaging. - Use a remote installation tool, such as Apple Remote Desktop, to distribute the custom installer to large numbers of existing devices. - Use a 3rd party imaging tool, such as DeployStudio, to build a custom client set.Note: FileWave provides "recipes" of possible deployment workflows for the custom installer in the KB.
# Enrolling Computer Clients into FileWave Click the **New Client** toolbar icon to open the **Create New Client** window. Click **Desktop clients** to open **New Client From Server**, where computer clients appear after the FileWave Client on the device checks in with the FileWave Server specified in the client settings. Those settings are either entered manually during client installation or included when a custom client installer is built from the FileWave Support webpage. For Text File see [Importing Computer Clients from a File](https://kb.filewave.com/books/filewave-client/page/importing-computer-clients-from-a-file "Importing Computer Clients from a File") |
| Column Name | Notes | |
| Name | The Client Name the computer is attempting to connect with (see Sync Computer Name) | |
| Address | The IP address the client is connecting from. This may be the device's internal address or a NAT address if the computer is connecting from the internet. | |
| Platform | The OS of the client; macOS or Windows | |
| Last Connect | The last time the FileWave Client attempted to check in with the server. The default check-in interval is every 2 minutes. | |
| Status | You will see one of three options:
- **New Client** - A new device with a valid certificate.
- **Invalid Certificate** - The device has no certificate, has a pre-13.1 client certificate, or has an invalid or damaged certificate.
- **Valid Certificate but a new Enrollment happened** - The certificate is valid, but the client's identity has changed.
All three status states can be approved by selecting and adding the client.
|
| **Code:** |
| set serverName=no.server.set set serverAddress="no.server.address" set clientPassword="filewave" set booster1="no.booster.set" set booster1Port="0" ::: set clientName="" |
| **Code:** |
| set serverAddress="[fwserver.filewave.us](http://fwserver.filewave.us)" set clientPassword="jelly" set booster1IP="[fwbooster.filewave.us](http://fwbooster.filewave.us)" set booster1Port="20013" ::: set clientName="" |
| ##### [FWClientPrefsWriter.zip](https://kb.filewave.com/attachments/109) | 668 B |
| Hosts | Ports | Protocol | OS | Description | Supports proxies |
| 17.248.128.0/18 | 443 | TCP | macOS only | Ticket delivery | — |
| 17.250.64.0/18 | 443 | TCP | macOS only | Ticket delivery | — |
| 17.248.192.0/19 | 443 | TCP | macOS only | Ticket delivery | — |
**Custom PKG Version 13.2.2** Version 13.2.2 Custom PKGs created prior to 4th March 2020 will not be notarised and will require re-creating if notarisation is required
Starting in FileWave 16.3, current FileWave binaries and applications are signed as **FileWave (USA), Inc.** (`UWMR88SA8G`) instead of **FileWave (Europe) Gmbh** (`83S2TRZ3CS`). The `spctl` examples below use an older FileWave Client 13.2.2 package, so they still show the previous signing identity. On current 16.3.x builds, expect the signer name and team identifier to reflect the newer FileWave (USA), Inc. identity.
## Confirmation The PKG may be tested for notarisation. On macOS 10.15.x you may observe the following: Before notarisation has been completed by Apple: ##### **Unnotarised** ```bash % spctl -a -vvv -t install FileWaveClient_13.2.2-fw.filewave.com-20-Feb-2020.pkg FileWaveClient_13.2.2-fw.filewave.com-20-Feb-2020.pkg: rejected source=Unnotarized Developer ID origin=Developer ID Installer: FileWave (Europe) Gmbh (83S2TRZ3CS) ``` After notarisation has been completed by Apple: ##### **Notarised** ```bash % spctl -a -vvv -t install FileWaveClient_13.2.2-fw.filewave.com-20-Feb-2020.pkg FileWaveClient_13.2.2-fw.filewave.com-20-Feb-2020.pkg: accepted source=Notarized Developer ID origin=Developer ID Installer: FileWave (Europe) Gmbh (83S2TRZ3CS) ``` # Apple MDM Enrolment Methods ## Description| Enrolling Apple devices involves the installation of an MDM Enrolment Profile. Installation may be initiated by either the user or the device. This same distinction also applies to the linking of the enrolment. | [](https://kb.filewave.com/uploads/images/gallery/2024-09/5OqlXf681tYfdH5E-image.png) |
Although definitions exist for all enrolment methods above, as of iOS18 and macOS15 Apple will no longer support profile-based user enrolment. This impacts the first described BYOD enrolment method, meaning BYOD with personal devices must action account-driven user enrolment.
### Account-Driven User Enrolment Although these are personal devices, this enrolment method requires the user to add credentials into Settings which must be a Managed Apple ID. Federated Authentication links a supported IdP with Apple, matching Managed Apples IDs with IdP usernames and passwords. [Federated Authentication](https://support.apple.com/en-gb/guide/apple-business-manager/axmb19317543/web)Initial support for Account-driven user enrolment is currently targeted for FileWave 15.5. Confirmation of inclusion should be available closer to release.
## Related Content - [Account-Driven User Enrolment for i(Pad)OS](https://kb.filewave.com/books/ios-ipados/page/account-driven-user-enrollment-for-iosipados-byod-devices-v150) - [Apple Automated Device Enrolment](https://kb.filewave.com/books/apple-school-business-manager/chapter/automated-device-enrollment-ade) - [Apple Manual Enrolment](https://kb.filewave.com/books/evaluation-guide/page/apple-manual-enrollment) # User Approved MDM Enrollment (macOS) ## Description Apple has introduced a new concept with macOS High Sierra, User Approved MDM Enrolment. This will only affect the management of settings that Apple deemed to be considered ‘security-sensitive. All other non-sensitive settings will continue to work, as previously, without User Approved Enrolment. This does not affect devices enrolled through DEP. There are two aspects to this. - User Approved MDM Enrolment - Configuration Profile payloads that will require User Approved MDM Enrolment. The first payload Apple has announced that will use these features is the Kernel Extensions payload. [**https://support.apple.com/en-us/HT208019**](https://support.apple.com/en-us/HT208019) Unlike other payloads, any ‘security-sensitive’ payload will be deliverable only by MDM and will rely on the MDM enrolment being User Approved. ## User Approved MDM Enrolment Currently, User Approved MDM Enrolment relies on the device being enrolled; the method of enrolment does not matter yet but will do in future releases. At this point, the enrolment must be either: - DEP enrolment (user approval not required) - User installing the enrolment profile manually - User accepts the enrolment profile through System Preferences > Profiles: [](https://kb.filewave.com/uploads/images/gallery/2023-07/FWKkqX97VsRxoFhs-image.png) You will notice this approval box in 10.13.2, if the method of enrolment was hidden from the user, e.g. scripted. Devices enrolled on earlier versions and then upgraded will automatically be MDM enrolled as User Approved. ## Kernel Extensions Apple introduced a halfway house with the release of 10.13. Apple has now released version 10.13.4 which has full implementation of this feature. #### How does this affect kernel extensions? Attempts to install a Kernel Extension with a device that is not enrolled into MDM will be greeted with the following message: [](https://kb.filewave.com/uploads/images/gallery/2023-07/4Csm3CC95e4jf0zq-image.png) To approve the Kernel Extension will either require MDM enrolment or the user allowing the blocked Extension to run, via System Preferences > Security & Privacy > General: [](https://kb.filewave.com/uploads/images/gallery/2023-07/0vcxbRw70vqDSXYZ-image.png) #### **What happens if I already have kernel extensions installed?** Any extension installed prior to upgrading to 10.13 High Sierra will continue to work, only newly installed kernel extensions will be affected. Once a particular kernel extension is approved, subsequent upgrades to that kernel extension will automatically be user-approved. #### **Managing Kernel Extensions through MDM** Prior to version 10.13.4, there is no management beyond having the device enrolled into MDM. However, with 10.13.4, management is now available through the Kernel Extension Policy payload, allowing extension loading without user consent when enrolled appropriately; the payload can only be delivered with MDM, to devices that are User Approved MDM Enrolled. This could result in apps relying on kernel extensions to stop functioning properly (e.g. VPN clients, antivirus software). As of FileWave version 12.7.0, the Kernel Extensions payload was introduced. To allow Kernel Extensions requires either: 1. 'Team Identifier' 2. Individually using the 'Kernel Extension bundle ID'. These values are stored locally on a device after installation. Therefore, to find these values involves installing them on a device and then reading these values from a file, e.g., for a machine that has VMware Tools installed. One machine could have all Extensions installed prior to running the command to list all necessary Kernel Extensions. ```bash $ sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy 'select team_id,bundle_id from kext_policy;' EG7KH642X6|com.vmware.kext.VMwareGfx EG7KH642X6|com.vmware.kext.vmhgfs ``` This lists the Team Identifier followed by the Bundle ID for two Kernel Extensions that have been added with the installation of VMware Tools. Both have the same Team Identifier, but have differing Bundle IDs. 1. To just use Team Identifier, add the returned Team Identifier from the command for the Kernel Extensions you wish to approve, to the 'Allowed Team Identifiers' whtielist. All Kernel Extensions with this Team Identifier will be whitelisted. 2. To only allow certain Kernel Extensions, instead use the 'Allowed Kernel Extensions' whitelist and add both Team Identifier and Bundle ID. Note, legacy Extensions may not have a Team Identifier. For those that don't, just supply the Bundle ID and leave the Team Identifier empty. There is also a community of users that are adding Identifiers and Bundle IDs which could save you having to instal in advance. ### Community Kernel Extensions List Data in this list is not checked in any way. As this is in place for security reasons and anyone can add information to this file, use with care: [Community Kernel Extensions List](https://docs.google.com/spreadsheets/d/1IWrbE8xiau4rU2mtXYji9vSPWDqb56luh0OhD5XS0AM/edit#gid=0) #### **Can I use User Approved Kernel Extension loading without MDM?** Yes. This however involves booting the computer into recovery mode and using the following command: > $ spctl See the man page for required options: [https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man8/spctl.8.html](https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man8/spctl.8.html) N.B. This is stored in NVRAM. If you reset the NVRAM, you will lose the ability to use User Approved Kernel Extension loading with this method until the steps are retraced. A firmware password could be set to prevent unauthorized NVRAM resets. #### Extensions Payload The Extensions payload should not be confused with the Kernel Extensions payload. [https://help.apple.com/profilemanager/mac/5.4/#/apd58550e429](https://help.apple.com/profilemanager/mac/5.4/#/apd58550e429) The Extensions payload controls those extensions visible through the Extensions System Preferences and will not affect Kernel Extensions # macOS MDM Enrollment State ## DESCRIPTION macOS devices are unique, in as much as they may be managed by both the FileWave Client and Apple's MDM process. The MDM Enrollment State is an inventory item which shows the current state of MDM enrollment.FileWave requires the FileWave Client for basic management of macOS devices. MDM is an additional extra to expand the management options, as provided by Apple. There is no MDM only option for macOS devices.
## INFORMATION ### MDM Enrollment State The state is a live report of the current status of the device's enrollment; imagine if a device was initially MDM enrolled, but the enrollment profile has been subsequently removed from the device. Status values include: - **Full Enrolled** – Device was MDM enrolled and all is good. This would be usual for DEP or OTA - **Server only** – Devices was MDM enrolled, but the device no longer has an enrollment profile installed - **Device only** – Device has an MDM enrollment profile installed, yet the database has no reference of this - **Undefined** – Device is running a version of FileWave older than 14.3.0 or has not yet reported back its state - **Not Enrolled** – Device has never been MDM enrolled and is managed purely by the FileWave Client ### Preliminary troubleshooting Before contacting FileWave Support, use the state value to narrow where the mismatch is happening: - **Server only**: FileWave has a server-side MDM record, but the Mac no longer has the FileWave MDM enrollment profile. Check Profiles/System Settings on the Mac for the FileWave MDM profile and note whether the device was recently archived, retired, wiped, migrated, or manually modified. Removing the MDM profile normally requires an MDM command, such as when a device is archived. - **Device only**: The Mac still has an MDM enrollment profile, but FileWave does not have the matching server-side record. This usually means enrollment did not complete or the server record no longer matches the device. Check the profile install date, APNs topic, and the custom fields below, then re-enroll the device if the server cannot match it. - **Logs**: On the FileWave Server, `/usr/local/filewave/log/filewave_django.log` includes MDM communication that can help explain enrollment and profile-removal behavior. DEBUG logging only helps for future actions after it is enabled, so collect the existing server log, the profile install time from the Mac, and any recent archive/re-enrollment actions before escalating. ### DIRECTIONS A query may be used to identify devices that are not in an expected state, for example, identify devices that no longer have an Enrollment Profile installed An example query could look something like:  Add, edit or remove criteria to meet desired reporting. ### ADDITIONAL INFORMATION To assist identifying why a device may show as 'Device Only', the following Custom Fields may be added, reporting the Server Root Cert Name and the APNs of the enrollment profile: #### MDM Server Root Certificate Name| ↓ macOS |
| [](https://kb.filewave.com/attachments/157) |
| ↓ macOS |
| [](https://kb.filewave.com/attachments/158) |
Note: You cannot use the same VPP account token you are using on your FileWave server to distribute content!
 ### App Store account You can sign in to the App Store using the following: *Volume Purchase Program (VPP) account:* You log in with the Apple ID associated with your VPP account or the Apple ID associated with a purchaser you specify *Your personal account:* This is the iTunes account you use to purchase personal apps**WARNING:** If your VPP account is already associated with another instance of Apple Configurator 2 or an MDM solution, all app assignments from those previous associations will be revoked.
 Once you have enrolled your mobile devices, and added them as clients in FileWave, you should see a set of installed profiles like the ones below.  Using AC2 for direct assignment of applications allows you to preload your iOS devices with core applications without requiring user interaction. The workflow would create a layer in your deployment model that lets you preconfigure devices that will become FileWave Clients for all day-to-day operations and management; but come equipped with a starting set of tools. ## Mass Enrollment for iOS You can set up Apple Configurator for bulk enrollment of preconfigured iOS devices by using this option in the **Enroll iOS Device** assistant. The device **must** be connected to Wi-Fi already before this process will work. If not, then make sure you add a Wi-Fi profile to your Apple Configurator setup. This process is built into AC2 using the steps above, since it already supports setting up multiple devices simultaneously. [](https://kb.filewave.com/uploads/images/gallery/2026-02/sRK8QueKPSdwcHVl-image.png) In this case, you would just download the MDM Enrollment profile, import it into Apple Configurator, and apply it to a set of iOS devices that were cloned with wireless settings, or a profile, already in place. ### FileWave Enterprise App Portal for iOS Starting with FileWave 8.5, iOS devices running iOS 7+ use a native iOS App Portal (Kiosk) instead of the web clip. iOS 8+ devices must use the App Portal. Instructions on how to deploy the App Portal are covered in Chapter **5** on mobile Filesets. When iOS devices are enrolled, they get the web clip version of the Kiosk. The new Enterprise App Portal automatically replaces the web clip and provides a more robust, responsive self-service tool. ### Activation Lock Bypass Since the introduction of iOS 7, device users have been able to enable a feature known as *Activation Lock* - which is linked to *Find My iPhone*. This feature ties a device to a specific Apple ID. In order to activate a device with an Activation Lock after a wipe or reset, the Apple ID credentials of the locking account are required. Where this can become problematical is having a 1:1 deployment where a user sets the Activation Lock on their device, then leaves without de-activating the lock. Prior to iOS 7.1, this issue was limited to unsupervised devices, since supervision inhibited the activation lock. Apple has provided a process now to supervise a device, yet still provide the activation lock - as well as a way to deactivate the lock when necessary. FileWave Admin contains a new Assistant labeled **Activation Lock Management.** When an iOS device is enrolled in the FileWave MDM, its activation lock is stored in the FileWave Server.  If a device is sent a remote wipe command, the activation lock can be disabled at the same time.  These lock bypass codes are stored in the FileWave server, and remain even when the device has been un-enrolled. The information concerning devices with bypass codes is even provided in Inventory queries. Best practice is to maintain the codes for institutional devices, regardless of the device's enrollment status, as a safety measure. If the device is no longer used, or taken offline, do **NOT** delete the device from your FileWave database, just archive the device. Once the device has been deleted, the activation lock information is deleted also.Note: In order to access the Activation Lock Bypass controls in FileWave Admin, you must login as the superuser (fwadmin).
You can also configure Activation lock in the ADE profile: [Working with Apple’s Automated Device Enrollment (ADE)](https://kb.filewave.com/books/apple-school-business-manager/page/working-with-apples-automated-device-enrollment-ade "Working with Apple’s Automated Device Enrollment (ADE)") |
| See [Placeholders](https://kb.filewave.com/books/filewave-client/page/placeholders "Placeholders") for what can be done with the imported devices |
Newer Apple Configurator versions may change individual dialogs, but the overall process remains similar.
 Click the **Prepare** icon.  The Prepare Devices dialog opens.  Click **Next**. Select **New server...** in the server selection box, then click **Next**.  Enter a server name and the URL for over-the-air enrollment, including the required port number at the end of the URL, then click **Next**. The server name is only for identification in Apple Configurator and does not need to match DNS.  If Apple Configurator can connect to the FileWave Server, it shows the trust profile and FileWave Root Certificate. For the required enrollment profile, use FileWave Admin's **Enroll iOS Device** assistant and download the profile from the **Apple TV** tab.  Click **Choose...** and select the enrollment profile you downloaded from FileWave Admin.   After the enrollment profile is selected, click **Next**. In FileWave, create a Wi-Fi profile with the SSID and password the Apple TV needs to join the wireless network. Add that Wi-Fi profile to the blueprint with **Choose...**.  Click **Next**.  Select the language and diagnostic/usage-data options you want to use, then click **Prepare**.  The blueprint now has the required pieces and can be applied to a connected Apple TV.  ## Related Content - [Enrolling Devices](https://kb.filewave.com/books/filewave-client/chapter/enrolling-devices "Enrolling Devices") - [Conflict Resolution](https://kb.filewave.com/books/filewave-central-anywhere/chapter/conflict-resolution "Conflict Resolution") # Importing Computer Clients from a File You can import a "tab-delimited" text file (not a CSV file). See [Placeholders](https://kb.filewave.com/books/filewave-client/page/placeholders "Placeholders") for more workflow information. Can be useful for - [Network Imaging Guide](https://kb.filewave.com/books/network-imaging-ivs "Network Imaging / IVS") - [Automated Device Enrollment (ADE)](https://kb.filewave.com/books/apple-school-business-manager/chapter/automated-device-enrollment-ade "Automated Device Enrollment (ADE)") - [Enrolling Mobile Devices into FileWave](https://kb.filewave.com/books/filewave-client/page/enrolling-mobile-devices-into-filewave "Enrolling Mobile Devices into FileWave") - [Working with FileWave Clients](https://kb.filewave.com/books/filewave-central-anywhere/page/working-with-filewave-clients "Working with FileWave Clients") The import location is in the **Create** **New Client** pane:  The new format looks like this: ``` Client NameIf the optional `Comment` field is blank, keep the trailing tab at the end of the row. Without that final delimiter, Central may not parse the last empty column as expected.
[](https://kb.filewave.com/uploads/images/gallery/2025-07/OkT3PKH0M98NJo41-screenshot-2025-07-31-at-12-46-15-pm.png) When creating your own file, remember to include a header row on the first line to define the column names, just like in the template. # FileWave Client Configuration Essential so devices can contact the FileWave Server, with optional entries, but may require altering. # FileWave Custom Installer ## Why When installing the FileWave client on computers, it is necessary for the client to know certain information, for example, the FileWave Server address, whilst other information may also be useful to include: Boosters, Booster Routing, Enabling/Disabling Remote Connections, etc. Similarly, when installing Boosters, they also require essential information including the FieWave Server and ports. For this reason, the FileWave Custom Builder allows details to be entered and then for Clients download an MSI or PKG ready for provisioning devices or with Boosters there is the addition of creating a Debian custom installer. ## When Each of the installers could be used manually on devices, but the custom MSI is particularly useful when imaging Windows onto devices, whilst the custom PKG achieves the zero-touch enrolment for macOS and DEP. ## Information The FilleWave Custom Installer is available via two URLs: - [https://custom.filewave.com](https://custom.filewave.com) - [https://custom.filewave.ch](https://custom.filewave.ch) Enter the details to match the FileWave Environment, e.g server's FQDN, Client or Booster version, etc. Once completed, hit the 'Build' button and FileWave will create the custom installer. # Superprefs Fileset ## What When you create a Custom Client installer, the FileWave Client preferences are packaged into that installer: server name, ports, Boosters, and related client settings. That is useful for the base configuration, but one preference set is not always right for every device. A Superprefs file lets you deploy selected FileWave Client preference changes to macOS or Windows devices after the client is installed. You can use one Superprefs Fileset for a broad change, or multiple Superprefs Filesets for different groups of devices.Only the settings included in the Superprefs file are changed. Settings that are not included remain untouched on the client.
## When to use this - Changing client logging level for troubleshooting - Adjusting Booster or communication preferences for a specific group of devices - Applying a new client preference without rebuilding and redeploying the Custom Client installer - Returning temporary troubleshooting settings back to standard values after testing ## Ingredients - FileWave Clients on macOS or Windows - FileWave Superprefs Editor - FileWave Central Admin App ## Create the Superprefs plist The Superprefs Editor is installed with the FileWave Central Admin App:| macOS | /Applications/FileWave/Superprefs Editor.app |
| Windows | C:\\Program Files (x86)\\FileWave\\FileWaveSuperPrefsEditor.exe |
When the editor opens, it may ask you to open an existing plist. Cancel that window if you are creating a new Superprefs file.
Only settings that you add or edit in the Superprefs Editor are written into the plist. This keeps the deployment focused and avoids overwriting unrelated client preferences. ### Example: set Debug Level to 99 Debug Level has three common values:| 10 | Standard logging (default) |
| 99 | Debug logging |
| 101 | Trace logging |
The file must be named **fwcld.newprefs.plist**.
[](https://kb.filewave.com/uploads/images/gallery/2024-11/SPAlw4crnUZBmFQ0-image.png) The saved plist should contain only the changed key: ``` Dict { debugLevel = 99 } ``` ## Package the plist in a Fileset The **fwcld.newprefs.plist** file can be placed in any reasonable path inside the Fileset. A dedicated Superprefs folder makes the purpose clear and lets you keep separate folders for different preference sets.| macOS | /usr/local/etc/Superprefs/debug/fwcld.newprefs.plist |
| Windows | C:\\ProgramData\\FileWave\\Superprefs\\debug\\fwcld.newprefs.plist |
Always test with one device or a small pilot group before associating the Superprefs Fileset more broadly.
For temporary troubleshooting, create a matching Superprefs Fileset that returns Debug Level to the standard value of 10 when analysis is complete.
## GUI observation Some Superprefs Editor entries are Boolean values, such as Booster Routing. Boolean entries can be set to **True**, set to **False**, or left unset. A dash means the value is not included in the Superprefs file. [](https://kb.filewave.com/uploads/images/gallery/2024-11/twDU0dMYgYJFzi8o-image.png) The three states appear as:| [](https://kb.filewave.com/uploads/images/gallery/2024-11/xPsuDQILYmx5k9uq-image.png) | False |
| [](https://kb.filewave.com/uploads/images/gallery/2024-11/IoAX5eEP8d5VABk5-image.png) | True |
| [](https://kb.filewave.com/uploads/images/gallery/2024-11/Tw6Jzp8HSZsC3NoQ-image.png) | Unset |
| server = "no.server.set" | FileWave server IP or DNS |
| primaryPort = 20015 | FileWave Server Port |
| fwPassword = "" | Encrypted FileWave Client Password - used for remote configuration through client monitor |
| fwUser = my.filewave.client.name | FileWave Client name (visible in FileWave Admin) |
Note: The default port setting above is 20015. However, SSL is now required, and the system will automatically use port 20017 instead when 20015 is entered. Do not manually set the port to 20017. Always enter 20015, and the system will handle the SSL port change for you.
### Booster configuration| booster1 = "no.booster.set" | Booster 1 IP or DNS Address - When clearing the value it should be "no.booster.set" |
| booster1Port = 20013 | Booster 1 Port - Should be 20013 by default when defining a booster |
| booster2 = "no.booster.set" | Booster 2 IP or DNS Address - When clearing the value it should be "no.booster.set" |
| booster2Port = 0 | Booster 2 Port - Should be 20013 by default when defining a booster |
| booster3 = "no.booster.set" | Booster 3 IP or DNS Address - When clearing the value it should be "no.booster.set" |
| booster3Port = 0 | Booster 3 Port - Should be 20013 by default when defining a booster |
| booster4 = "no.booster.set" | Booster 4 IP or DNS Address - When clearing the value it should be "no.booster.set" |
| booster4Port = 0 | Booster 4 Port - Should be 20013 by default when defining a booster |
| booster5 = "no.booster.set" | Booster 5 IP or DNS Address - When clearing the value it should be "no.booster.set" |
| booster5Port = 0 | Booster 5 Port - Should be 20013 by default when defining a booster |
| boosterRouting = 0 | When set as 1, client connects to server through boosters, only for non HTTPS traffic (e.g. except for inventory / profile deployment ) - 1 is recommended. |
| connectorProbeAttemptDelay = 3 | Number of Seconds the client waits between trying to reach boosters |
| connectorProbeAttempts = 10 | Number of unsuccessful connections that lead to booster being marked "offline" |
| vncManaged = 0 | Controls whether remote connection is allowed: \* Teamviewer – FileWave 14.7+ \* FileWave Client (fwcld) prior to 14.8 |
| vncPromptClient = 1 | Controls whether end user is prompted to allow remote connection: \* Teamviewer – FileWave 14.7+ \* FileWave Client (fwcld) prior to 14.8 |
| monitorPort = 20010 | Client Monitor connects here, over the network \* Only on Filewave 15.5.x or lower |
| kioskPort = 20020 | Kiosk / Reboot Dialog connects here, from localhost |
| debugLevel = 10 | Controls fwcld log verbosity; 10(normal),99(debug),101(trace) |
| fileCheckInterval = 86400 | Number of seconds between verification cycles (default once every 24 hours after launch) |
| freeSpaceMargin = 2147483648 | Minimum Number of free bytes left on disk so filesets can be deployed |
| setUsersFilesOwner = 1 | Set ownership of Users files/folders to appropriate user |
| syncComputerName = 0 | If set to 1, fwcld will query OS to retrieve computer name at startup, and use that as fwUser value |
| tickleInterval = 120 | Number of seconds between attempts to contact FileWave Server for new Commands |
| locationRefreshInterval = 0 | If set to >0, number of seconds between querying the OS for location data |
| deviceState = 3 | Client State, e.g.: Missing, Tracked, Untracked |
| denyPersonalDataCollection = 0 | If set to 1, disables Location Services |
| testMode | |
| desktopOwner | |
| currentFileWaveClientName | |
| niceTime | |
| priority | |
| useSSL | |
| srvPublishPort = 20005 | ZeroMQ messaging port (Deprecated from FileWave 14.8+. Removed from FileWave server 15.0 and notifications from earlier clients (pre 14.8) will no longer work at this point) |
| vncRelayPort = 20030 | Port used to connect towards the filewave server to forward VNC Data (Deprecated from FileWave 14.8+) |
| vncServerPort = 20031 | Local Port VNC Data is relayed to/from (set to 5900 to use builtin VNC service) (Deprecated from FileWave 14.8+) |
| booster1PublishPort = 20003 | Booster 1 ZeroMQ prior to 14.8 |
| booster2PublishPort = 0 | Booster 2 ZeroMQ prior to 14.8 |
| booster3PublishPort = 0 | Booster 3 ZeroMQ prior to 14.8 |
| booster4PublishPort = 0 | Booster 4 ZeroMQ prior to 14.8 |
| booster5PublishPort = 0 | Booster 5 ZeroMQ prior to 14.8 |
FileWave 15.5 added these firewall changes to the normal client upgrade process. The script remains here as an example and as a fallback if the upgrade Fileset did not add the rule.
FileWave 16.0.0 removed the need for this rule. Use this article only for historical 15.5 firewall remediation or as an example of how to manage Windows Firewall rules with a script.
## Procedure Use the attached .bat file for FileWave 15.4.2 or earlier, or the Fileset for FileWave 15.5.x, to open the firewall for the matching executable at its standard install location. If you installed a FileWave component to a nonstandard path, update the path inside the script first. - Script for FileWave 15.4.2 or lower: [fwcld-ports-15.4.2.bat](https://kb.filewave.com/attachments/50) - Fileset for FileWave 15.5.x: [FileWave Firewall Settings 15.5.fileset.zip](https://kb.filewave.com/attachments/406) The scripts allow inbound and outbound connections for the installed FileWave executables and use this basic syntax: **Windows 10 and beyond running FileWave 15.5.x:** ``` netsh advfirewall firewall add rule name="FileWave Client" \ action=allow program="C:\Program Files\FileWave\client\fwcld.exe" \ enable=yes dir=in description="FileWave Client Inbound Access, usually only port 20010 is needed for client monitor connections" ``` ##### Custom Fields The following download contains two Custom Fields to report the firewall status of the FileWave Client, for example: [](https://kb.filewave.com/uploads/images/gallery/2023-07/HctoQyHgZvuMX8YQ-image.png) Custom Fields download: [](https://kb.filewave.com/attachments/181) ## Related Content - [Default TCP and UDP Port Usage](https://kb.filewave.com/books/filewave-general-info/page/default-tcp-and-udp-port-usage "Default TCP and UDP Port Usage") # Upgrading FileWave Clients ## What FileWave 16.4 provides an integrated upgrade workflow for supported macOS and Windows FileWave Clients that are already running **FileWave Client 16.3.0 or later**.| Current client version | Visibility in Client Upgrades | Required path |
|---|---|---|
| **16.3.0 or later** | Eligible for the integrated workflow and shown when an applicable upgrade is available. | Use **Software Updates > Client Upgrades**. |
| **Earlier than 16.3.0** | **Not shown** in Client Upgrades. | Deploy the applicable macOS or Windows Client Upgrade Fileset to reach at least 16.3.0, then use the integrated workflow for later upgrades. |
| **Unsupported operating system or failed requirements** | May not qualify for the target client version. | Review the target release’s platform requirements and the Upgrade Fileset result before assuming the client can be upgraded. |
| Serial or MAC address | Name | Barcode | Location | Use |
| AS5D64AS65D4 | Lab-A-comp1 | 321654987 | North Campus | Student |
| Q32WE1WQ3E21 | Lab-A-comp2 | 321654988 | North Campus | Student |
| X9C87ZX9C87ZC | Front-Desk-1 | 321654989 | Main Office | Admin |
| DF9H51DF95H1 | BreakRoom-A | 321654990 | Break Room | Faculty |
For more see: [Importing and Exporting Custom Field Files](https://kb.filewave.com/books/custom-fields/page/importing-and-exporting-custom-field-files "Importing and Exporting Custom Field Files")
#### Create Custom Fields Create any needed custom fields and assign them to all devices, or specific devices. 1. Open the custom field UI 2. Create Custom fields for Use, Location, barcode; 1. **Use**: Provided: Admin, Type: string, Restricted: True, Values: None (DEFAULT), Faculty, Student, Administration 2. **Location**: Provided: Admin, Type: string, Restricted: True, Values: None (Default), Site A, Site B 3. **Barcode**: Provided: Admin, Type: string, Restricted: False, Use Default Values: True (Default: None) 4. Take note of the "Internal Name" from the custom fields (I.E: barcode, location, use) More detailed instructions: [Custom Fields](https://kb.filewave.com/books/custom-fields/page/custom-fields "Custom Fields") ### Import Custom Field Values Once the fields are created and assigned to the proper devices we need to import your file again in the custom fields UI. This time with the serial, barcode, location, use column. You can actually have FileWave to create a sample CSV file with the proper headings by going to 1. (Assistance → Custom Fields → ) "Import Custom Fields" UI 2. Press "Download Template" 3. Select the values you want to import (barcode, location and use in our case) 4. Specify the field to identify clients (for example Serial Number or Client Name) 5. Save Edit in a spreadsheet app (excel, numbers, etc) and add the needed vales and bring it back inNote that you can also set custom field values for placeholders manually by right-clicking if you have only a few to update
# Locking Devices ## What is it? Use this article to distinguish **Lock / Unlock** from **Lock Device**. They sound similar, but they control different behavior.The locking behavior is the same for macOS, Windows, iOS, and non-EMM Android.
## Answer ### Lock / Unlock **Lock** binds a FileWave Client to its current model number. During a migration or update, a locked client ignores new manifests from the server until it is unlocked. See [Upgrading your On-Premise FileWave Server](https://kb.filewave.com/books/filewave-server/page/upgrading-your-on-premise-filewave-server "Upgrading your On-Premise FileWave Server"). **Unlock** allows the device to update to the latest model. ### Lock Device **Lock Device** locks the device screen. The user cannot use the device again until the required passcode, if present, is entered. ## Additional information When a client is locked to the current model, Kiosk is not available to the user. Kiosk can still open, but it displays a message that the user is blocked. A locked client shows a lock icon or lock text in Client View, Device Info, and Client Monitor:   # Location Tracking # Location Tracking Technologies ## **FileWave Location Tracking** The location reporting feature in FileWave is disabled by default. It is recommended that you; verify that this feature is per your organization’s policies and AUP (Acceptable Use Policy). Notify your end users before activating location reporting, as enabling the feature will prompt for permission to access location information. For details on how this works, look here: [Location Tracking](https://kb.filewave.com/books/filewave-client/chapter/location-tracking "/wiki/spaces/KB/pages/4329472") ### **Technologies used for Location Tracking** Location tracking technologies used will differ from client platform to client platform. ### **Maps used:** - ThunderForest - [https://www.thunderforest.com/](https://www.thunderforest.com/ "https://www.thunderforest.com/") ### **Client location detection methods:** - On macOS/Windows - [https://doc.qt.io/qt-5/location-positioning-cpp.html](https://doc.qt.io/qt-5/location-positioning-cpp.html "https://doc.qt.io/qt-5/location-positioning-cpp.html") which tries different sources. - On Windows specifically - [https://learn.microsoft.com/en-gb/windows/win32/api/locationapi/nf-locationapi-ilocation-getreportstatus](https://learn.microsoft.com/en-gb/windows/win32/api/locationapi/nf-locationapi-ilocation-getreportstatus "https://learn.microsoft.com/en-gb/windows/win32/api/locationapi/nf-locationapi-ilocation-getreportstatus") - On iOS - The iOS API for location from Apple. - On ChromeOS - The Google API for location from Google. ## Related Content - [Location Tracking](https://kb.filewave.com/books/filewave-client/chapter/location-tracking "Location Tracking") # Location Tracking Setup ## FileWave Location Tracking The location reporting feature in FileWave is disabled by default. It is recommended that you; verify that this feature is in accordance with your organization’s policies and AUP (Acceptable Use Policy). Notify your end users before activating location reporting, as enabling the feature will prompt permission for access location information. ### Requirements: - FileWave version 10.1+ - Location Tracking Enabled - Server/Client - iOS devices require the [FileWave IPA App Portal](https://kb.filewave.com/books/kiosk/page/filewave-app-portal-for-ios-ipa-install "FileWave App Portal for iOS (IPA Install)") for passive tracking - All devices you want to track are already enrolled into FileWave and currently communicating properly ### Supported Operating Systems: - APK Android: 4.1+ - iOS 9+ - macOS 10.9+ - Windows 10+ - ChromeOS 43+ ### Things to consider: Client State. For the items: Tracked, Missing and Untracked, the item greyed out is the active state: [](https://kb.filewave.com/uploads/images/gallery/2024-05/Kb3HODX5spuYNrIo-image.png) - Different States of Tracking - **Tracked** - Tracking is enabled and will update the location at different intervals - **Missing** - Tracking is enabled and will be updated around every two minutes. The client also sends the location immediately and does not wait for other scans to finish. For supervised iOS devices this option puts the device in Lost mode, has a message/footnote that can set in the FileWave Preferences under the Organization Info tab, and locks the iOS device. The device will become usable again once the missing mode is switched off. - **Not Tracked** (DEFAULT)- No location is gathered at any time. - The FileWave IPA App Portal needs to be sent out and opened at least once before you will be prompted and allowed to gather location from the iOS device. Once it is sent out, the old FileWave App Portal that gets installed automatically with enrollment will be removed and the new one will be installed. - For any updated location from your iOS devices, the FileWave App Portal needs to be open, whether that be in the background or the currently active app. There are two types of location tracking in FileWave, Passive Tracking, and Lost Mode. macOS, Windows, Chromebooks, and Android devices use Passive tracking to gather the location of the device without locking it down. Supervised iOS devices set to Missing mode will put the device in Lost mode, which locks down the device, making it unusable by the end user. ## Lost Mode Setup (iOS macOS): 1. Right Click on your Supervised iOS or MDM-enrolled macOS device(s) 2. Select Missing from the Client State menu  3. Update Model  4. Once the device checks in it will be in lost mode and report location.  5. To take it out of lost mode, select "Not Tracked" in the Client State menu*When the iOS device is in Lost Mode, do not reboot it. If the device losses Wifi, you will no longer be able to take the device out of Lost Mode since it will no longer be connecting to FileWave.*
When the device is in Lost Mode, a new option in the tools menu is available, "Play Lost Mode Sound (iOS 10.3+)"  ### Passive Tracking Setup This is receiving tracking data continuously. 1. Check your server license to be sure you have "Allows collection of personal data:" set to Yes.  2. Make sure Location Services is enabled. On macOS, confirm **fwGUI** is allowed in Location Services before troubleshooting FileWave tracking.| iOS | macOS |
|---|---|
|  |  |
| Windows | Android |
|---|---|
|  |  |
Client Monitor is no longer a separate app. Use FileWave Central for one-device changes to "Disable personal data collection", or create a Superprefs ([Creating a Superprefs Fileset](https://kb.filewave.com/books/filewave-client/page/superprefs-fileset "Creating a Superprefs Fileset")) to change it in bulk.
2. **iOS** - The FileWave IPA App Portal automatically deploys to your iOS devices. This used to be manual.FileWave 15.3+ will auto instal the latest App for you on qualifying devices. If the App is already open, when configuring the device for tracking, it may be necessary to close and re-open the App after the device has receive the subsequent MDM commands from the Model Update.
3. **Chromebook** - Be sure the Chrome Extension is installed and configured (See [Quick Start Guide for Chromebooks](https://kb.filewave.com/books/evaluation-guide/page/chromebook-client-pre-requisites "Quick Start Guide for Chromebooks")) 4. **Android (EMM)** 1. Force enable location tracking server sideBy force enabling EMM tracking you are ignoring "Allows collection of personal data" in your license. Even is the license is set to false, this will collect data.
1. Edit ``` /usr/local/filewave/django/filewave/settings_custom.py ``` 2. add ``` settings.EMM['FWCLIENT_FORCE_ALL_DEVICES_TRACKING_ENABLED'] = True ``` 3. Restart apache ``` /usr/local/filewave/apache/bin/apachectl restart ``` 4. Update Model 2. Force enable location services on devices (See: [Force Location for EMM Android Devices](https://kb.filewave.com/books/android/page/force-location-for-emm-android-devices "Force Location for EMM Android Devices")) 4. Change the state to Normal 1. Right click on your macOS, Windows, Chromebook, and Android device(s)For multiple devices use the filter options at the top of the client view, then select all
2. Select Normal from the "Client State" option.  5. Update the model  6. Accept any device prompts| iOS | macOS |
|---|---|
|  |  |
**Warning:** In order to avoid legal issues concerning user location tracking, it is highly recommended that you enable location tracking only on devices when a unique user may authorize the service. Privacy Policies: [Apple/iOS and macOS](http://www.apple.com/legal/privacy/) – [Microsoft/Windows](http://go.microsoft.com/fwlink/?LinkId=521839) – [Google/Android](http://www.google.com/intl/en/policies/)
# Additional OS Specific Considerations ### macOS Any user can agree to tracking, admin or not. Only an administrator can disable location services and/or FileWave's rights to location, as per [Apple Inc. policy.](https://www.apple.com/legal/privacy/en-ww/). ### iOS Any user can agree to tracking, can disable location services, and revoke FileWave's right to location, as per [Apple Inc. policy.](https://www.apple.com/legal/privacy/en-ww/) ### Windows The Windows operating system does not prompt the local user for access to location. Windows 10+ does have a location service that can be turned off. ### Android (APK Client) Upon installing or upgrading the Android FileWave Client to version 10.1 or greater, the user is requested to approve all rights an application needs. This includes location services, running in the background and several other rights. ### Android (EMM Client) A user can turn off their location tracking at anytime, but you can make a policy fileset that will [Force Location for EMM Android Devices](https://kb.filewave.com/books/android/page/force-location-for-emm-android-devices "Force Location for EMM Android Devices") ## Order of operation It is important to note the way a client verifies it is able to ask the system for location information. For example setting the state to "Missing" but it has a Superprefs file telling it the refresh interval is 0 See the flowchart for reference: [](https://kb.filewave.com/uploads/images/gallery/2026-07/dqfB1qwlTfsO908Y-location-tracking-flowchart-fwgui-location-services.png) ### Global Location Reporting Disable If there are any reasons, legal or otherwise, that you do not wish to enable tracking on a global level within your organization, your FileWave license can be adjusted to enable personal mode. This will disable devices from sending application usage as well as location information. To verify the current status of personal data collection. From FileWave Admin: Server Menu → "Activation Code..." → There you will see "Allow collection of personal data:" with Yes or No after it. To have personal data enabled or disabled on your license, please submit a support ticket with "Personal data License" in the subject.Only tickets from authorized support agents whose names are on the support contract will be accepted to adjust license personal data settings.
# How the FileWave Client Communicates # What This article explains how the FileWave Client securely communicates with FileWave infrastructure components during enrollment and ongoing operations. It covers certificate-based authentication, transport mechanisms, and platform-specific communication flows so administrators understand *what* talks to *what*, *how*, and *why*. A key design principle of FileWave communication is **mutual TLS (mTLS)**, where both client and server authenticate each other using certificates issued by the FileWave Certificate Authority (CA). # When / Why Understanding FileWave client communication is important when: - Designing network topology (firewalls, proxies, NAT, boosters, NATS) - Troubleshooting enrollment or check-in failures - Auditing security posture (certificate usage, authentication, encryption) - Explaining FileWave behavior to security or infrastructure teams This knowledge is especially critical in modern deployments where communication is brokered through **NATS** rather than direct point-to-point HTTP(S) connections. # How ## Enrollment At this point, you have either installed the FileWave client onto a device manually, or the device has received the client automatically (for example via Automated Device Enrollment). 1. The client uses the configured server address to initiate a connection to the FileWave server. 2. The client downloads the FileWave CA certificate from the server. 3. The client generates a unique Client ID. 4. The client generates a **Certificate Signing Request (CSR)** and securely stores the **private key locally**. 5. The client sends the Client ID, device name, and CSR to the server. 1. The client polls the server on the tickle/heartbeat interval until a certificate is issued. 2. The server signs the CSR and returns a client certificate. 3. The client validates the returned certificate against: - Its locally stored private key - The FileWave CA certificate 6. The client record is created in FileWave Central: 1. **Auto-add**: The client is automatically approved and placed into the configured auto-add group. 2. **Upgraded client**: The client is automatically approved and resumes normal operation. 3. **Manual vetting**: The client remains pending in *Client View → New Clients* until approved. > FileWave uses **mutual TLS (mTLS)** from this point forward. All subsequent communication requires both the client and server to present valid certificates signed by the FileWave CA. > There is **no longer a compatibility mode**. Legacy documentation such as [What is Compatibility Mode?](https://kb.filewave.com/books/filewave-general-info/page/what-is-compatibility-mode) applies only to historical versions and should not be used for modern deployments. ## Daily Communication The FileWave server continuously recalculates models and smart groups. As a result, a client check-in may result in new manifests even when the assigned model itself has not changed. Modern FileWave deployments use **NATS** as the primary communication transport for tickle and command signaling. ### macOS and Windows #### Tickle (Check-in) 1. The tickle interval expires (configurable via Superprefs). 2. The client initiates communication via **NATS**. 3. A mutual TLS handshake occurs: - The server validates the client certificate. - The client validates the server certificate. 4. The server responds with the current model number. 1. If the model number matches, no model manifest is downloaded. 2. If the model number differs, the client downloads the updated manifest. 5. The client processes the manifest(s). 6. The client downloads required Filesets: 1. From the server directly **or** via a Booster. 2. The client validates the Booster certificate against the same FileWave CA. 3. The Booster validates the client certificate and checks revocation status (CRL). 4. If certificate validation fails at any stage, the TLS handshake fails and **no data is transferred**. The failure is reported back to the FileWave server. #### Verify 1. A verification check-in occurs (default: every 24 hours, configurable via Superprefs). 2. After successful mTLS authentication: - The client verifies Fileset state - Inventory is refreshed - Files are healed according to Fileset [verification](https://kb.filewave.com/books/filesets-payloads/page/verification) settings > Verification also occurs when the client service starts (for example after a reboot) and can be triggered manually via Client Monitor, Client Info, or command line. ### Android EMM FileWave Android EMM communication is mediated through Google’s Android Management API (AMAPI).As of FileWave 16.3, this communication follows Google's recommended API rate limit settings. This is an internal behavior change that reduces the risk of throttling and improves stability for larger Android Enterprise deployments. No administrative action or configuration change is required.
#### At Model Update 1. A single manifest is generated from all Android Policy Filesets assigned to the device. 2. Application assignments and permissions are included. 3. The manifest is sent to Google via AMAPI. 4. The Android device retrieves updates from Google. #### Ongoing Operation 1. FileWave polls Google approximately every 5 minutes for device status updates. 2. Smart group changes trigger regeneration of manifests and updates via AMAPI. ### iOS / iPadOS FileWave communicates with Apple devices using standard MDM push and check-in mechanisms. #### At Model Update 1. A push notification is sent to the device via Apple Push Notification service (APNs). 2. The device initiates a connection to the FileWave MDM server. 3. Updated manifest data is delivered to the device. #### Ongoing Operation 1. The inventory interval is reached (default: 24 hours). 2. FileWave sends an APNs push requesting the device to check in. 3. The device connects to the FileWave MDM server. 4. Any updated manifests are delivered. # Related Content - [Creating a Superprefs Fileset](https://kb.filewave.com/books/filewave-client/page/superprefs-fileset) - [Default TCP and UDP Port Usage](https://kb.filewave.com/books/filewave-general-info/page/default-tcp-and-udp-port-usage) - [Configuring Inventory Preferences](https://kb.filewave.com/books/filewave-central-anywhere/page/configuring-inventory-preferences) - [Android EMM Known Issues](https://kb.filewave.com/books/android/page/android-emm-known-issues) # Digging Deeper FileWave’s use of **mutual TLS** ensures that: - Only trusted clients can communicate with the server - Clients are protected from impersonation or man-in-the-middle attacks - Boosters cannot serve unauthorized devices The introduction of **NATS** improves scalability and resilience by decoupling client signaling from traditional request/response patterns. This allows FileWave to efficiently handle large device fleets while maintaining strong security guarantees. From a security perspective, FileWave’s communication model aligns well with modern Zero Trust principles: authenticate everything, encrypt everything, and assume the network is hostile by default. # Executing a Client-Side Script-Based Verification ## What The "verify" option of the fwGUI client application allows you to run a "verify" from the client programmatically. ## When/Why We are going to use this option whenever we want to get "immediate" feedback from a client. For instance, as a post-installation script, calling a verify would immediately make the client report updated inventory rather than waiting (up to 24 hours, default) for the next "regular" verify. ## How The verification is called as a command-line option to the fwcld app on either a Windows or macOS client as follows. The first table is for FileWave 16.0.4+ and the second table is for 15.5.x and below. Please note that 16.0.0 through 16.0.3 did not have this command.| **Windows Client** | **macOS Client** | |
| **Path to FileWaveKiosk:** | "C:\\Program Files\\FileWave\\client\\" | /usr/local/sbin/FileWave.app/Contents/MacOS/ |
| **App to call:** | fwcld.exe | fwcld |
| **Command Line options:** | --verify *Sends a verification w/o user notification* | --verify *Sends a verification w/o user notification* |
| **Script examples:** | **Windows Batch Example** ```powershell @echo off "C:\Program Files\FileWave\client\fwcld.exe" --verify exit 0 ``` | **macOS Bash Example** ```shell #!/bin/bash /usr/local/bin/FileWave.app/Contents/MacOS/fwcld --verify exit 0 ``` |
| **Windows Client** | **macOS Client** | |
| **Path to fwGUI** | "C:\\Program Files\\FileWave\\client\\kiosk\\" | /usr/local/sbin/FileWave.app/Contents/Resources/ |
| **App to call:** | fwGUI.exe | fwGUI.app |
| **Command Line options:** | --verify *Sends a verification (w/dialog by default...useful for troubleshooting)* | --verify *Sends a verification (w/dialog by default...useful for troubleshooting)* |
| --silent *Used with --verify, sends verification without user dialog* | --silent *Used with --verify, sends verification without user dialog* | |
| **Script examples:** | **Windows Batch Example (FW 15.5.x)** ```powershell @echo off "C:\Program Files\FileWave\client\fwGUI.exe" --verify --silent exit 0 ``` | **macOS Bash Example** ```shell #!/bin/bash /usr/local/sbin/FileWave.app/Contents/Resources/fwGUI.app/Contents/MacOS/fwGUI --verify --silent exit 0 ``` |
On macOS, the FileWave Client binary is normally located at `/usr/local/bin/fwcld`. The examples below use the full path so they can be copied into scripts more reliably.
```bash /usr/local/bin/fwcld -clearCertificate [-serverHost**What happens next:** Clearing the certificate revokes the existing client identity. It does not reinstall or repair the client by itself. The device must run the FileWave Client again and create a new certificate request before it can communicate with the server. In wipe or reinstall workflows, clear the old certificate before or during the reinstall; if an existing device still cannot check in after clearing, verify the server address and trust settings, then restart or reinstall the client so it can generate and submit a new certificate request.
Note that the command above uses the client certificate itself to identify the client. In case the certificate's private key is already lost, there is an alternative where you can authenticate with an administrator's token rather than with the client certificate: ```bash /usr/local/bin/fwcld -clearCertificate -token| **Windows Network Sweeper** |
| [](https://kb.filewave.com/attachments/388 "Network Sweeper") |
PSTools is included in the download for convenience. You can also download the current PSTools package directly from Microsoft: [PSTools download](https://learn.microsoft.com/en-us/sysinternals/downloads/pstools).
Before using the repair script broadly, confirm that the bundled `FileWaveClient.msi` is the client version you intend to install, or replace it with the correct installer for your environment. Also review the expected client version in `3_Check_Status.ps1` before treating its status output as authoritative.
#### Process Overview 1. Create an inventory query for Windows devices that have not checked in recently. A common starting point is **OS Type = Windows** and **Last Connected** within the past 30 days but not within the past 7 days. Adjust both date ranges for your environment. [](https://kb.filewave.com/uploads/images/gallery/2024-09/iIIhBsjbl4PaK1FT-image.png) 2. Set the query output to include **Device Name** only. You can export IP addresses from the client view, but avoid using IP addresses from an inventory query in DHCP-heavy environments because the address may no longer belong to the same device. [](https://kb.filewave.com/uploads/images/gallery/2024-09/AoBkCX6WmijN9VN4-image.png) 3. Export the query results into the `offline.txt` file included in the ZIP. **View > Export Current View** is useful for this. Remove the header line that says `Device Name`. 4. Run `1_get_online.ps1` to test which exported devices are currently reachable. Reachable devices are written to `online.txt`. 5. If devices are found, run `2_repair_clients.ps1` to attempt the repair. This script uses PSExec to copy and run `fix_fwclient.bat` on the target device. 6. Run `3_Check_Status.ps1` to double-check repaired devices and identify anything that still needs manual remediation. ## Related Content - [Client Deployment via GPO](https://foundry.filewave.com/mod/scorm/view.php?id=10) - [Creating a Superprefs Fileset](https://kb.filewave.com/books/filewave-client/page/superprefs-fileset "Creating a Superprefs Fileset") - [Inventory Queries (Reports)](https://kb.filewave.com/books/filewave-central-anywhere/chapter/inventory-queries-reports "Inventory Queries (Reports)") ## Digging Deeper The download contains the scripts used in this workflow. Review them before running the bundle in your environment, test against a small set of known devices first, and keep the generated `online.txt`, `output.txt`, `double_check.txt`, and `still_bad.txt` files as your working record for follow-up remediation. # PSExec as a Helper in Troubleshooting ## What Microsoft PsTools includes **PsExec**, a remote command-line tool that can help troubleshoot a Windows device when the FileWave Client is not responding through normal FileWave channels. ## When/Why Use PsExec when you need an interactive command prompt on a Windows client to inspect services, logs, processes, network state, or user sessions. The examples below focus on FileWave Client troubleshooting, but the same approach is useful for other Windows service issues. ## How**Assumptions for the examples below:** 1) You downloaded PsTools and unzipped it. 2) You launched Command Prompt as a domain admin or another account with the needed rights on the remote device. 3) You changed into the directory where PsTools is located.
Connect to the remote computer by name in an interactive PsExec shell: ``` psexec64 \\computername -h cmd ``` You should end up in a shell like the one below. Type `exit` to leave the remote shell. [](https://kb.filewave.com/uploads/images/gallery/2024-05/CwfTGWcpSghoTMos-image.png) From that shell, you can run normal Windows command-line tools on the remote device. These examples are useful when a Windows client is not reporting correctly. 1. Check the FileWave Client service: - ``` sc query filewavewinclient ``` [](https://kb.filewave.com/uploads/images/gallery/2024-05/EFH8hn8CF60dOUD2-image.png) 2. Stop the FileWave Client service: - --- ``` sc stop filewavewinclient ``` 3. Start the FileWave Client service: - --- ``` sc start filewavewinclient ``` 4. If the service will not start or stop, identify and stop the process directly: 1. Find the FileWave Client process. - ``` tasklist | findstr fwcld ``` - [](https://kb.filewave.com/uploads/images/gallery/2024-05/ahddHIXSHiUMjOuZ-image.png) 2. Kill the process by PID. - ``` taskkill /PID 16264 /F ``` -The same pattern can help with a stuck Windows Update agent. When Windows Update hangs and the service will not stop, `tasklist /svc | findstr wuauserv` identifies the process that owns the service. A reboot can also clear the condition, but it interrupts whoever is using the device.
5. Check the FileWave Client log for entries from today: - ``` type c:\programdata\filewave\fwclient\fwcld.log | findstr mm-dd ``` - Replace `mm-dd` with today's month and day, such as `05-16`. 6. Get the IP address of the workstation: - ``` ipconfig ``` 7. Restart the device immediately. This interrupts any active user session, so check before running it on a device in use. - ``` shutdown -r -t 0 -f ``` 8. Check whether other users are logged in: - ``` quser ``` - [](https://kb.filewave.com/uploads/images/gallery/2024-05/fbQGBi4UEdXl5b3a-image.png) 9. Get the last boot time: - ```powershell Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object LastBootUpTime ``` - [](https://kb.filewave.com/uploads/images/gallery/2024-05/elLO7EOAz4KuwdN1-image.png) ## Related Content - [PS Tools](https://learn.microsoft.com/en-us/sysinternals/downloads/pstools) - [Windows command-line reference (SS64)](https://ss64.com/nt/) - [wmic deprecation](https://techcommunity.microsoft.com/blog/windows-itpro-blog/wmi-command-line-wmic-utility-deprecation-next-steps/4039242) # Troubleshooting Windows Client Upgrade Fileset Issues ## What The FileWave Windows Client upgrade fileset uses a more orchestrated process than a typical Windows software deployment. For most Windows software deployments, the `FileWaveWinClient` service runs the installer as the local system account. A client upgrade has an extra challenge: it must remove the existing FileWave Client, install the updated one, and keep the process moving even though the service that normally performs installs has to be stopped and replaced. To handle this, the upgrade fileset installs a temporary upgrade helper, creates a scheduled task, stops the existing FileWave Client service, runs the new client MSI, starts the upgraded service, and then removes the temporary upgrade pieces. This also helps the device continue the upgrade workflow and report back to FileWave when the upgrade completes.  The example above shows the main upgrade fileset components: - `FileWaveWinUpgradeClient.msi`: installs the temporary upgrade helper. - `scheduleRestart.bat`: creates the scheduled task that starts the upgrade process. - `upgradeClient.bat`: handles most of the upgrade workflow. - `FileWaveClient.msi`: installs the target FileWave Windows Client version. ## When/Why Use this article when a FileWave Windows Client upgrade fileset does not complete, the client version does not update in inventory, the Windows client service does not restart after an upgrade, or a device is left with a non-functional FileWave Client after an attempted upgrade. If the issue is that the upgrade fileset did not import correctly, does not show the expected files, or was extracted incorrectly before deployment, start with [Troubleshooting Deployment Issues with the FileWave Upgrade Fileset](https://kb.filewave.com/books/filewave-client/page/troubleshooting-deployment-issues-with-the-filewave-upgrade-fileset). This article is also useful before a broad Windows Client upgrade rollout, because most upgrade issues are easier to find and fix during a small pilot than after the fileset has been deployed widely. ## How ### 1. Understand the upgrade flow The Windows Client upgrade fileset normally works in this order: 1. `FileWaveWinUpgradeClient.msi` runs first and installs a temporary upgrade helper. 2. `scheduleRestart.bat` creates the `FileWave Client Upgrade` scheduled task. 3. `upgradeClient.bat` checks the target version, disables automatic service restart during the upgrade, stops the existing `FileWaveWinClient` service, and starts the client installer. 4. `FileWaveClient.msi` installs the new FileWave Windows Client. 5. The upgrade process removes the scheduled task and temporary upgrade files after the installer completes. If the old client service is hung, the upgrade script retries the stop process and may need to terminate the service process. That is expected behavior during this upgrade, but it can expose device-specific problems such as a stuck service, pending Windows Installer issue, or previous failed upgrade cleanup. ### 2. Collect the upgrade logs Collect these logs before retrying the upgrade or manually cleaning up the device when possible. They are usually the fastest way to tell whether the issue is the upgrade workflow or the Windows MSI installer. The primary logs are in `C:\temp`: - `UpgradeClient.log`: shows the upgrade script flow, including version checks, scheduled task behavior, service stop attempts, and cleanup. - `FileWaveClientUpgraderUninstall.log`: shows removal of the temporary upgrade helper. - `FileWaveClient.log`: verbose MSI log for the new FileWave Windows Client installer. Also check the Windows Application log in Event Viewer for Windows Installer errors, such as `1603` or `1638`. The normal FileWave Client log may be less useful during the upgrade because the client service is intentionally stopped as part of the process. ### 3. Check the common failure points Most failed Windows Client upgrades fall into one of these categories: - The existing `FileWaveWinClient` service is hung and does not stop cleanly. - A previous failed upgrade left behind the scheduled task or temporary upgrade helper. - The new `FileWaveClient.msi` launched, but Windows Installer failed to complete the install. - The device has a local Windows issue that would also affect a manual client MSI install, such as a pending reboot, Windows Installer problem, security software interference, or an existing conflicting client install state. In some cases, Windows Installer blocks the new client install until the system restarts, and that condition is not always obvious before the upgrade starts. If `FileWaveClient.log` shows an MSI failure, troubleshoot it as a Windows Installer/client MSI issue first. In many cases, the same failure would happen if the MSI were run manually on the device. ### 4. Clean up leftovers from a previous failed upgrade Use these commands only when the logs or device state indicate that a previous failed upgrade left behind the scheduled task or temporary upgrade helper. Run them from an elevated Command Prompt. Delete the scheduled task: ```cmd schtasks /delete /f /tn "FileWave Client Upgrade" ``` Remove the temporary upgrade helper: ```cmd start /wait msiexec /l*v C:\temp\FileWaveClientUpgraderUninstall.log /qn /norestart /x "{E3DC560D-C698-41DF-8B6C-EEA0BEFC44EF}" ``` Start the FileWave Windows Client service if it is installed and should be running: ```cmd sc start filewavewinclient ``` After cleanup, retry the upgrade on the affected device or move the device back into a small test group before attempting broader deployment. ### 5. Isolate MSI installer issues On a device that has not yet completed the upgrade, run the full `FileWaveClient.msi` manually to test the installer outside of the upgrade fileset workflow. This removes the scheduled task, temporary helper, and service-stop logic from the test. If the manual MSI install fails the same way, focus on the MSI error, the Windows Application log, and the device state rather than the upgrade fileset. ### 6. Recover a non-functional client If the FileWave Client is no longer functional and cannot receive a normal fileset, use remote administrative tools to inspect the device, collect logs, restart services, or run cleanup commands. For one supported approach, see [PSExec as a Helper in Troubleshooting](https://kb.filewave.com/books/filewave-client/page/psexec-as-a-helper-in-troubleshooting). ### 7. Roll out upgrades in phasesDeployment warning: Do not deploy a Windows Client upgrade fileset globally as the first test.
Start with a small pilot group. After deployment, run a Verify and confirm that inventory reports the expected FileWave Client version. If that pilot succeeds, expand to a larger test group. Move to broad deployment only after the larger group is also successful. This takes more time up front, but it is much easier than recovering many Windows clients after a failed broad rollout. ## Related Content - [PSExec as a Helper in Troubleshooting](https://kb.filewave.com/books/filewave-client/page/psexec-as-a-helper-in-troubleshooting) - [Using PsExec to Remotely Restart the FileWaveWinClient Service](https://kb.filewave.com/books/filewave-client/page/using-psexec-to-remotely-restart-the-filewavewinclient-service) - [Troubleshooting Deployment Issues with the FileWave Upgrade Fileset](https://kb.filewave.com/books/filewave-client/page/troubleshooting-deployment-issues-with-the-filewave-upgrade-fileset) - [Using Native Windows Tools to Troubleshoot](https://kb.filewave.com/books/microsoft-general-info/page/using-native-windows-tools-to-troubleshoot) # Using PsExec to Remotely Restart the FileWaveWinClient Service ## **What** Using PsExec to remotely restart the "FileWaveWinClient" Windows service allows you to remotely manage the FileWave client on Windows devices. This can be useful in situations where the client is not functioning properly and needs to be restarted in order to resolve the issue. ## **When/Why** There may be a variety of reasons why you would need to remotely restart the FileWaveWinClient service on a Windows device. Some common reasons include: - The service has stopped functioning properly and needs to be restarted in order to resolve the issue - The service needs to be restarted in order to apply a configuration change - The service needs to be restarted as part of a troubleshooting process ## **How** To use PsExec to remotely restart the FileWaveWinClient service, you will first need to download and install PsExec on the device from which you will be initiating the restart. PsExec can be downloaded from the Microsoft TechNet website ([https://docs.microsoft.com/en-us/sysinternals/downloads/psexec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec) ). Once you have PsExec installed, you can use the following command to remotely restart the FileWaveWinClient service: psexec \\\[remote device\] -u \[username\] -p \[password\] net start "FileWaveWinClient" Replace \[remote device\] with the hostname or IP address of the remote device, and \[username\] and \[password\] with the appropriate credentials for the remote device. ## **Related Content** - Microsoft TechNet: PsExec ([https://docs.microsoft.com/en-us/sysinternals/downloads/psexec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec) ) ## **Digging Deeper** In addition to using PsExec to remotely restart the FileWaveWinClient service, you can also use the "net" and "sc" command-line tools to query and change Windows services. To query a service using "net", you can use the following command: net start \[service name\] This will display the status of the specified service. To start or stop a service using "net", you can use the following commands: net start \[service name\] net stop \[service name\] To change the startup type of a service using "net", you can use the following command: net start \[service name\] \[startup type\] Valid startup types include: boot, system, auto, demand, disabled To query a service using "sc", you can use the following command: sc query \[service name\] This will display detailed information about the specified service, including its status, startup type, and binary path. To start or stop a service using "sc", you can use the following commands: sc start \[service name\] sc stop \[service name\] To change the startup type of a service using "sc", you can use the following command: sc config \[service name\] start=\[startup type\] Valid startup types include: boot, system, auto, demand, disabled Keep in mind that you will need to have the appropriate permissions on the remote device in order to use these commands. You can also use PsExec to execute these commands remotely, as described in the previous section. # Network Proxy, Content Filter, and SSL Inspection Troubleshooting ## What FileWave components need reliable network access to the destinations listed in [Default TCP and UDP Port Usage](https://kb.filewave.com/books/filewave-general-info/page/default-tcp-and-udp-port-usage). Depending on the workflow, that may include the FileWave Server, FileWave Boosters, FileWave cloud services, vendor services from Apple, Google, or Microsoft, licensing and notification services, remote-control services, cloud Fileset storage, or Kiosk/App Portal download locations. That traffic is encrypted. Proxies, web filters, secure web gateways, firewalls, and content filters can block or alter that traffic, which can cause the affected FileWave feature to fail even when the FileWave Server itself is working correctly. This can happen with products such as Lightspeed Filter, GoGuardian Admin, Securly Filter, Linewize Filter, ContentKeeper, iboss, Cisco Umbrella, Zscaler Internet Access, Netskope, Fortinet/FortiGate, Palo Alto Networks, Sophos Firewall, WatchGuard, Check Point, and similar proxy or filtering systems. The exact product name is less important than the behavior: if the product blocks the required host, blocks an unknown or uncategorized URL, or performs SSL/TLS inspection on traffic that must remain end-to-end trusted, the FileWave feature that depends on that destination may not be able to communicate. The Kiosk IPA URL `https://fw-kiosk-v2-ipas.filewave.cloud/` is one example because blocking it can prevent Kiosk installation. The same principle applies to any FileWave address or vendor address required by the workflow and listed in the port usage article. ## When/Why Use this article when FileWave behavior changes depending on the network, filtering policy, or proxy path. Common examples include: - The FileWave Client checks in on one network but not another. - Devices stop reporting inventory or processing manifests. - The FileWave Kiosk or App Portal does not appear or does not install. - iOS/iPadOS Kiosk installation fails with an error like: ``` Could not validate manifest..An SSL error has occurred and a secure connection to the server cannot be made. ``` - A content filter shows FileWave URLs as blocked, uncategorized, unknown, newly seen, or unclassified. - Security logs show a FileWave destination from [Default TCP and UDP Port Usage](https://kb.filewave.com/books/filewave-general-info/page/default-tcp-and-udp-port-usage) being blocked or inspected, such as the FileWave Server hostname, `*.filewave.cloud`, `fw-kiosk-v2-ipas.filewave.cloud`, cloud Fileset storage, notification services, or Apple/Google/Microsoft service endpoints. FileWave communication relies on encrypted, certificate-based connections. On macOS and Windows, modern FileWave Client communication uses mutual TLS for client/server trust. Apple, Google, Microsoft, and FileWave cloud services also expect valid TLS connections. If a filtering product performs SSL inspection, HTTPS inspection, TLS inspection, SSL decryption, certificate inspection, deep packet inspection, DPI, or a similar feature that replaces the remote certificate with a filtering certificate, the connection may fail because the device is no longer seeing the certificate it expects. This is not limited to one vendor. Lightspeed is a common example in schools, and Lightspeed environments that block `Unknown` or `Uncategorized` sites may block a FileWave cloud URL until it is recategorized or explicitly allowed. Other web filters and secure web gateways can create the same symptom under different names. ## How ### 1. Map the symptom to the FileWave feature Before changing proxy or firewall rules, identify which FileWave feature is failing. Then use [Default TCP and UDP Port Usage](https://kb.filewave.com/books/filewave-general-info/page/default-tcp-and-udp-port-usage) to find the destinations and ports used by that feature.| Symptom | Destinations to check first |
|---|---|
| Client does not check in, inventory is stale, or manifests do not process | FileWave Client, Server, and Booster destinations/ports. Make sure the device can reach the configured FileWave Server and any Booster it is expected to use. |
| Kiosk/App Portal does not appear or fails to install | Kiosk/App Portal destinations, the FileWave Server, `*.filewave.cloud`, and any specific Kiosk download host listed or referenced for the installed FileWave version. |
| Filesets do not download or install | Server/Booster traffic and, for hosted customers using cloud Filesets, the cloud Fileset storage destinations in the port article. |
| Remote control, notifications, license checks, version checks, AutoPkg, or Central/Anywhere features fail | The service-specific outbound destinations listed for those features in the port article. |
| Apple, Android, Chromebook, or Windows MDM/EMM workflows fail | The FileWave MDM/EMM ports plus the Apple, Google, or Microsoft service endpoints required by that platform. |
**Assumptions made in the above code:** 1. A text file named computers.txt exists in the same folder as the PowerShell script. 2. computers.txt contains one computer name or IP address per line. Names are better when DNS is dynamic. 3. The PowerShell session runs with domain administrator rights or equivalent remote-service and admin-share access. 4. WinRM is not enabled. If WinRM is available in your environment, you may prefer a remoting-based version of this check.
You can adapt this script to check other services, use a different authentication method, or add remediation. As written, it reports the device name, FileWave service status, FileWave Client version, and assigned FileWave Server address. For corrective action, use your approved remote-management tool; PsExec is one common option in Windows environments. ## Related Content - [Script Best Practices](https://kb.filewave.com/books/filewave-general-info/page/script-best-practices "Script Best Practices") - [Using PsExec to Remotely Restart the FileWaveWinClient Service](https://kb.filewave.com/books/filewave-client/page/using-psexec-to-remotely-restart-the-filewavewinclient-service "Using PsExec to Remotely Restart the FileWaveWinClient Service") - [FileWave Client Status Check: How to ask the client what it is doing on macOS and Windows](https://kb.filewave.com/books/filewave-client/page/filewave-client-status-check-how-to-ask-the-client-what-it-is-doing-on-macos-and-windows "FileWave Client Status Check: How to ask the client what it is doing on macOS and Windows") ## Digging Deeper If you want to pre-check which devices are online before running the main script, use this shorter example. A filtered list makes the service-status check run faster. ```powershell #Let's just look for a list of devices online #import a list of computers $mypath=$MyInvocation.MyCommand.Path $mypath=Split-Path $mypath -Parent $computers=Get-Content $mypath\online_test.txt foreach ($computer in $computers) { $online=$false try{ #try to resolve $online = Resolve-DnsName $computer -quicktimeout -ErrorAction Stop $online = $true write-host $computer }catch{ #Catching errors...machine offline $online= $false } } ``` # When does the inventory client run scans? ## Inventory The FileWave Client runs an inventory scan at startup, every time you execute a verify on the client, and every 24 hours.**Scope:** This article covers upgrade fileset deployment, redeploy, and Windows import/extraction issues. If the Windows upgrade fileset imports and deploys but the client upgrade itself does not complete, the client version does not update in inventory, or the service does not restart, see [Troubleshooting Windows Client Upgrade Fileset Issues](https://kb.filewave.com/books/filewave-client/page/troubleshooting-windows-client-upgrade-fileset-issues).
## macOS Deployment ##### Issue: Devices show that the latest FileWave Client is not installed despite deploying the Fileset. ##### Solutions:| Device or scenario | Primary cleanup path | Use these articles |
|---|---|---|
| macOS computer with FileWave Client | Uninstall the FileWave Client if the Mac should stop checking in. If the Mac is also MDM enrolled, remove the MDM profile or wipe the device as appropriate. | [Uninstall the FileWave Client on macOS](https://kb.filewave.com/link/666), [Archiving Clients](https://kb.filewave.com/link/923), [Wipe Device for macOS](https://kb.filewave.com/books/macos/page/wipe-device-for-macos) |
| Windows computer with FileWave Client | Uninstall the FileWave Client while the device can still receive Filesets, then delete or archive the record after the uninstall has run. | [Uninstall the FileWave Client on Windows](https://kb.filewave.com/link/472) |
| iPhone, iPad, or Apple TV | Remove MDM enrollment or wipe the device. If the device is leaving the organization and is assigned through Apple Business Manager or Apple School Manager, release it from Apple. | [Archiving Clients](https://kb.filewave.com/link/923), Apple release links below |
| Android Enterprise device | Use the Android wipe/removal path and wait for the Google synchronization state before deleting the FileWave record. | [Removing Android Devices](https://kb.filewave.com/link/924) |
| ChromeOS / Chromebook | Handle the device in Google Admin Console first. FileWave syncs Chromebook records from Google Admin, so Chromebook offboarding is not a normal FileWave Client uninstall/delete workflow. | [Removing ChromeOS / Chromebook devices](https://kb.filewave.com/link/1166) |
| Inactive record you may need later | Archive the client instead of deleting it. Archived clients do not consume a FileWave license and are hidden from normal views. | [Archiving Clients](https://kb.filewave.com/link/923) |
| Option | Download | Use when |
|---|---|---|
| Fileset | [FileWaveUninstallermacOSv4.1.2-kiosk-process-fix-fileset.zip](https://kb.filewave.com/attachments/529) | You can still deploy Filesets to the Macs being removed. |
| Standalone script | [FileWaveUninstallermacOSv4.1.2.sh.zip](https://kb.filewave.com/attachments/530) | You need to run the uninstaller locally or through another tool. |
| Situation | Recommended path |
|---|---|
| Device is being retired, sold, disposed of, or fully reset | Send the wipe command, wait for the next Google sync/state change, then delete the device from FileWave and run Update Model. |
| Device was erased locally or disappeared before FileWave sent a wipe | Do not rely on deleting the FileWave record alone. Google may add it back during synchronization. Resolve the managed device state in Google/FileWave first, then delete it. |
| Device is being reassigned inside the organization | Wipe/reset the device as appropriate, but keep the management path active if the device should remain managed. |
For standard FileWave Client retirement, see [Retiring a device from FileWave](https://kb.filewave.com/link/239). For Android Enterprise devices, see [Removing Android Devices](https://kb.filewave.com/link/924).
## Choose the right ChromeOS removal path| **Situation** | **Use this path** |
| Reassign a Chromebook to another student, staff member, or loaner user | Use [Wipe Users](https://kb.filewave.com/link/834) when the device should stay enrolled. Use Powerwash / Wipe Device when you need a full reset. |
| Retire, sell, dispose of, or permanently remove a Chromebook from management | Handle the device in Google Admin Console first, including [deprovisioning](https://support.google.com/chrome/a/answer/3523633) when it will no longer be managed. FileWave syncs Chromebook records from Google Admin, so do not rely on deleting the record in FileWave alone. |
| Wipe a device but keep it managed after reset | Review [Forcing wiped ChromeOS devices to re-enroll](https://kb.filewave.com/link/794) so the Google Admin enrollment setting matches your intent. |
| Stop ChromeOS management for the whole FileWave environment | Use [Disable Chrome OS in FileWave](https://kb.filewave.com/link/168). That removes the Google OAuth token and disables the ChromeOS integration for the environment. |