CUVENA 56.0.0 - WINDOWS INSTALLATION, UNINSTALL AND SCCM

INTERACTIVE INSTALL / UPGRADE
Run the desktop or headless Setup.exe from the extracted agent ZIP.
Setup requires administrator approval. It registers the product in Windows
Settings > Apps and Control Panel > Programs and Features.
Setup closes this installation's manager before file replacement, waits for
its launcher and service processes to exit, and recovers leftover windowless
managers from older releases. It never force-stops script execution workers.
A visible manager that is busy must finish or cancel its operation first.
The service restarts only if it was running when setup began. A service you
stopped manually stays stopped. Choose Start service after the upgrade if needed.
To repair an older uninstaller, install this version over the SAME edition and
folder, then uninstall from Control Panel. Pairing and credentials are kept
through the repair. Close an already-open older setup/uninstaller before starting.

UNINSTALL CHOICE
Uninstall automatically closes this installation's manager, stops its worker,
waits for shutdown, removes its Windows service and removes installed files.
You are asked whether to KEEP settings and saved credentials (default) or
REMOVE them too. Cancel leaves the installation unchanged.

Remove data permanently deletes C:\ProgramData\Cuvena\Agent: its pairing,
settings, local execution journal, encrypted credentials and recipient key.
Reinstalling after this choice requires a fresh pairing and credential entry.
Keep data leaves that folder intact for reinstalling on this same machine.
Website registrations, scripts, tasks and run history are never deleted by
the Windows uninstaller. Retire the registration in Agent Management when
the computer will no longer be used. Legacy backups in other folders, such as
the former user's AppData\Local\Cuvena\AgentManager, are not deleted.
Uninstall fails safely if the service cannot stop, a folder is redirected,
another installation owns the service, or required data cannot be removed.
Drain the agent in Agent Management and let active work finish before removal.

INSTALLATION SCOPE
Desktop and Headless install machine-wide. Double-clicking Setup requests UAC
approval automatically. /CURRENTUSER is rejected. The manager shortcut is
available to all users; machine service/vault management requires elevation.

SCCM / INTUNE / OTHER SOFTWARE DEPLOYMENT
Run per machine as SYSTEM or administrator. Never select a per-user deployment.
Choose ONE Windows edition per computer; both use the same service and vault.
The following are executable arguments, not PowerShell expressions:

Desktop install:
  Cuvena-Agent-Desktop-Setup-v23.0.0.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /RESTARTEXITCODE=3010 /LOG="C:\Windows\Temp\Cuvena-install.log"
Headless install:
  Cuvena-Agent-Headless-Setup-v23.0.0.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /RESTARTEXITCODE=3010 /LOG="C:\Windows\Temp\Cuvena-install.log"

Uninstall and KEEP local data (also the silent default):
  "C:\Program Files\Cuvena\Agent\unins000.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /KEEPDATA /LOG="C:\Windows\Temp\Cuvena-uninstall.log"
Uninstall and explicitly REMOVE local data:
  "C:\Program Files\Cuvena\Agent\unins000.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /PURGEDATA /LOG="C:\Windows\Temp\Cuvena-uninstall.log"
Use the registered UninstallString for custom folders and the headless edition;
do not assume the desktop path. Never combine /KEEPDATA and /PURGEDATA.
Silent mode does not start the desktop manager and does not prompt for input.

Detection rules:
Desktop: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CuvenaAgentDesktop_is1
Headless: also inspect the 32-bit uninstall registry view for CuvenaAgentHeadless_is1.
Require DisplayVersion = 23.0.0. Verify the registered InstallLocation and worker
file exist; files alone are not sufficient evidence of a running, paired agent.
Worker: Cuvena-Agent.exe --version. Health: Cuvena-Agent.exe status --config
"C:\ProgramData\Cuvena\Agent\agent.json" (local checks, not a network test).

Exit codes:
Setup: 0 success; 3010 successful install requiring restart when requested above;
20 installed but the previously running worker did not restart; other nonzero
codes mean setup failed or was canceled. Never report code 20 as success.
Uninstaller: 0 completed; any nonzero means failure/cancellation. /NORESTART
prevents automatic reboot. An uninstaller success code does not itself prove
no reboot is needed; inspect the log and normal deployment reboot policy.
PowerShell bootstrap and uninstall helper: 0 success, 1 failure.
Configure the deployment platform to wait for the executable to finish and
use its exit code. Read the log if an operation fails; do not repeatedly enroll.

UNATTENDED PAIRING (OPTIONAL, AFTER INSTALL)
In the installed directory, use elevated PowerShell:
  .\install-windows.ps1 -NonInteractive -Url https://app.cuvena.com -EnrollmentCodeFile "C:\SecureStaging\cuvena-enrollment.txt"
For an existing pairing:
  .\install-windows.ps1 -NonInteractive -Resume
Provision a DIFFERENT unexpired one-use code per machine. Restrict the code
file to SYSTEM/administrators and remove it through your deployment system
after successful enrollment. Never embed a code or password in command-line
arguments or shared deployment logs. The helper feeds the code over stdin;
it does not log its contents. --token-stdin is also available on the worker's
enroll command. No task-account passwords are needed to install the service.
Pairing starts the service with no permitted targets. Configure exact targets
and explicit execution accounts before dispatching work. This installation
does not open WinRM, change certificates, or grant remote account permissions.

DOMAIN ACCOUNTS AND DESKTOP WINDOWS
The Windows service runs as Local Service. A prior agent running as a signed-in
domain user may have used that user's current token without a saved password.
Those are different authentication paths. A saved domain account can be used
when the remote Windows endpoint accepts its authentication and authorization.
Check the target's WinRM events and account permissions for error 5; repeatedly
changing a correct password does not repair an endpoint authorization failure.
WinRM and Windows services execute outside the signed-in interactive desktop.
A script showing Windows Forms or Notepad is not a visible-desktop test. Use
Write-Output or write/read a file in the execution account's temporary folder.
Showing UI to a signed-in user requires a separate, explicitly designed
interactive execution feature; it is not provided by these service packages.

Official installer switch reference:
https://jrsoftware.org/ishelp/topic_setupcmdline.htm
https://jrsoftware.org/ishelp/topic_uninstcmdline.htm

WINDOWS TARGET READINESS AFTER REBOOT
The Cuvena agent service and the target Windows WinRM service are separate.
For targets using WinRM HTTPS, verify the existing WinRM service is running,
starts automatically under your organization's policy, and its configured HTTPS
listener remains reachable on TCP 5986 after reboot. An administrator can use:
  Get-Service WinRM
  Set-Service -Name WinRM -StartupType Automatic
  Start-Service -Name WinRM
Version 43 configures automatic WinRM startup and Cuvena-owned localhost HTTPS
certificate maintenance. External listeners, firewall and authentication rules
remain administrator-managed. See localhost-certificate-maintenance.txt.
A running agent alone does not prove the target can receive scripts. Run the
Cuvena connection test to verify reachability, authentication and task sign-in.
Version 42 includes reachability failures in bounded automatic connection checks;
business scripts stay held until the diagnostic succeeds. Script-started and
uncertain outcomes still require review before an automatic repeat.

