Pre-configuration documentation

The Pre-configuration feature allows administrators to deploy Workspace desktop app with pre-configured settings and data sources (Devolutions Server and Devolutions Hub Business instances) across an organization. This eliminates the need for end-users to manually configure the application after installation.

Key benefits

  • Zero-touch deployment: Users start with fully configured applications

  • Consistency: Ensure all users have the same data sources and settings

  • Time savings: Eliminate manual configuration steps

  • Flexibility: Multiple deployment methods to fit different IT infrastructures

  • Scalability: Deploy to hundreds or thousands of endpoints efficiently

Supported platforms

  • Windows: Full support via MSI parameters and configuration files

  • macOS: Configuration files and MDM/Jamf managed preferences

Deployment methods

Three primary deployment methods are available.

Method 1: MSI Installer parameters

Pass configuration parameters directly to the Windows installer during deployment. You can combine data source parameters with application settings.

Use Case: Enterprise deployment tools (SCCM, Intune, PDQ Deploy, etc.)

Basic Example (data sources only):

msiexec /i Workspace.msi DVLS_SERVER_URL="https://server.com" HUB_NAME="mycompany"

With settings (data sources + application settings):

msiexec /i Workspace.msi ^
  DVLS_SERVER_URL="https://server.com" ^
  HUB_NAME="mycompany" ^
  ORGANIZATION_ID="guid-here" ^
  LANGUAGE="fr"

See MSI Installer parameters section for complete list of available settings.

Deploy a pre-created .cfg file to target systems.

Use Case: Scripted deployments, Intune, SCCM, when using the Configuration Creator UI

Two Deployment Options:

msiexec /i Workspace.msi DEPLOY_CONFIG="C:\path\to\Config.cfg"

Target: %ProgramData%\net.devolutions\Workspace\DefaultConfig.cfg

How it works:

  1. MSI writes config to ProgramData during installation.

  2. When any user launches Workspace desktop app, it detects system-wide config.

  3. Config automatically copies to user's Roaming profile.

  4. User has configured application.

Why DEPLOY_CONFIG for enterprise

  • Reliable: Works regardless of user context (no "Default user" issues)

  • Consistent: All users on machine get same configuration

  • Automation-friendly: Perfect for Intune, SCCM, silent installs

  • Multi-user support: Applies to all existing and future users

Best for: Intune, SCCM, silent installs, multi-user machines, shared workstations

Option B: Per-user deployment (USER_CONFIG)

msiexec /i Workspace.msi USER_CONFIG="C:\path\to\Config.cfg"

Target: %LOCALAPPDATA%\net.devolutions\Workspace\Config.cfg

How it works

  1. MSI writes config to installing user's Local AppData.

  2. User launches Workspace desktop app.

  3. Config copies to user's Roaming profile.

  4. Only that user has configured application.

Limitations

  • Only configures the user who ran the installer.

  • May fail in automated deployments (user context issues).

  • Not suitable for multi-user machines.

Best for: Interactive installations by end users, single-user devices

Method 3: MDM/Managed preferences (macOS)

Deploy configuration via Mobile Device Management (MDM) solutions for managed macOS environments.

Use Case: Jamf Pro, Microsoft Intune for macOS, other MDM solutions

Priority: Highest (overrides all file-based configurations)

Preference Domain: net.devolutions.workspace

Jamf Pro Schema File

For Jamf Pro Administrators: Import this JSON schema into Jamf Pro under Computers – Configuration Profiles – Application & Custom Settings to get a user-friendly GUI for configuring all Workspace desktop app settings.

Preference Domain: net.devolutions.authenticator

Click to expand: Complete Jamf Pro JSON Schema (net.devolutions.authenticator.json)
{
  "title": "Devolutions Workspace Configuration (net.devolutions.authenticator)",
  "description": "Configuration settings for Devolutions Workspace application deployed via Jamf Pro. These settings are deployed as managed preferences to managed devices.",
  "__version": "1.0",
  "__preferencedomain": "net.devolutions.authenticator",
  "options": {
    "remove_empty_properties": true
  },
  "properties": {
    "dvls": {
      "title": "DVLS Configuration",
      "description": "Devolutions Server connection settings",
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "name": {
            "title": "Server Name",
            "description": "Display name for the DVLS server",
            "type": "string",
            "default": "Devolutions Server"
          },
          "serverUrl": {
            "title": "Server URL",
            "description": "Full URL to the DVLS server (e.g., https://server.company.com)",
            "type": "string",
            "pattern": "^https?://.*"
          },
          "serverVersion": {
            "title": "Server Version",
            "description": "DVLS server version (optional)",
            "type": "string",
            "default": ""
          }
        },
        "required": ["serverUrl"]
      },
      "default": []
    },
    "hubs": {
      "title": "Hub Business Configuration",
      "description": "Devolutions Hub Business connection settings",
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "url": {
            "title": "Hub URL",
            "description": "Full Hub URL (e.g., https://yourcompany.devolutions.app)",
            "type": "string",
            "pattern": "^https://.*\\.devolutions\\.app$"
          },
          "organizationId": {
            "title": "Organization ID",
            "description": "Organization identifier for Hub Business",
            "type": "string"
          },
          "type": {
            "title": "Hub Type",
            "description": "Hub connection type (optional)",
            "type": "string"
          },
          "version": {
            "title": "Hub Version",
            "description": "Hub version compatibility",
            "type": "string",
            "default": "2020"
          }
        },
        "required": ["url"]
      },
      "default": []
    },
    "configs": {
      "title": "Application Settings",
      "description": "User preferences and application behavior settings",
      "type": "object",
      "properties": {
        "language": {
          "title": "Language",
          "description": "Default language for Workspace interface",
          "type": "string",
          "enum": [
            "en-US", "fr", "de", "es", "cs", "hu", "it", "nl", "pl", "ru", "sv", "tr", "uk", "zh-CHS", "zh-TW"
          ],
          "default": "en-US",
          "options": {
            "enum_titles": [
              "English", "Français", "Deutsch", "Español", "Čeština", "Magyar", "Italiano",
              "Nederlands", "Polski", "Русский", "Svenska", "Türkçe", "Українська", "简体中文", "繁體中文"
            ]
          }
        },
        "reduceToTrayOnClose": {
          "title": "Minimize to Tray on Close",
          "description": "When enabled, closing the window minimizes to system tray instead of quitting",
          "type": "boolean",
          "default": false
        },
        "clearClipboardSensitiveData": {
          "title": "Clear Clipboard Sensitive Data",
          "description": "Automatically clear sensitive data from clipboard after a specified timeout",
          "type": "boolean",
          "default": false
        },
        "clipboardTimer": {
          "title": "Clipboard Timeout (seconds)",
          "description": "Duration in seconds before clearing clipboard when sensitive data clearing is enabled",
          "type": "integer",
          "enum": [30, 60, 120, 180, 240, 300, 0],
          "default": 30,
          "options": {
            "enum_titles": ["30 seconds", "1 minute", "2 minutes", "3 minutes", "4 minutes", "5 minutes", "Never"]
          }
        },
        "useFavicon": {
          "title": "Use Favicons",
          "description": "Download and display website favicons for entries",
          "type": "boolean",
          "default": false
        },
        "useEntriesSyncOnDatasourceAccess": {
          "title": "Sync Entries on Data Source Access",
          "description": "Automatically synchronize entries when accessing a data source",
          "type": "boolean",
          "default": false
        },
        "useHubEmbeddedBrowser": {
          "title": "Use Hub Embedded Browser",
          "description": "Open Hub connections in embedded browser (disable if using credential providers)",
          "type": "boolean",
          "default": true
        },
        "lockingOption": {
          "title": "Locking Method",
          "description": "Authentication method used when locking/unlocking Workspace. Leave empty for no locking method.",
          "type": "string",
          "enum": ["", "password", "biometric", "windowsCredentials"],
          "default": "",
          "options": {
            "enum_titles": ["None", "Password/PIN", "Biometric (Touch ID/Face ID/Windows Hello)", "Windows Credentials"]
          }
        },
        "useBackgroundLock": {
          "title": "Lock When Backgrounded",
          "description": "Automatically lock the application when minimized or sent to system tray",
          "type": "boolean",
          "default": false
        },
        "useLockWhenInactive": {
          "title": "Auto-Lock When Inactive",
          "description": "Automatically lock the application after a period of inactivity",
          "type": "boolean",
          "default": false
        },
        "lockInactivityDelay": {
          "title": "Inactivity Lock Delay (seconds)",
          "description": "Time in seconds before locking due to inactivity (requires Auto-Lock to be enabled)",
          "type": "integer",
          "enum": [30, 60, 120, 180, 240, 300],
          "default": 30,
          "options": {
            "enum_titles": ["30 seconds", "1 minute", "2 minutes", "3 minutes", "4 minutes", "5 minutes"]
          }
        }
      }
    },
    "preventStartup": {
      "title": "Prevent Startup",
      "description": "When true, prevents Workspace from starting automatically after configuration deployment",
      "type": "boolean",
      "default": true
    }
  }
}

How to use

  1. Download or copy the JSON schema above.

  2. In Jamf Pro, navigate to: Computers – Configuration Profiles – Application & Custom Settings.

  3. Click Configure and upload the JSON file.

  4. Configure your desired settings using the GUI interface.

  5. Scope the profile to your target computers.

Manual configuration profile (alternative)

If you are not using Jamf Pro, you can create a standard macOS configuration profile:

Example Profile (com.devolutions.workspace.mobileconfig):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>net.devolutions.authenticator</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PayloadIdentifier</key>
            <string>net.devolutions.authenticator.config</string>
            <key>PayloadUUID</key>
            <string>GENERATE-UUID-HERE</string>
            <key>PayloadDisplayName</key>
            <string>Workspace Configuration</string>
            <key>language</key>
            <string>en-US</string>
            <key>reduceToTrayOnClose</key>
            <true/>
            <key>lockingOption</key>
            <string>biometric</string>
        </dict>
    </array>
</dict>
</plist>

Deploy via

  • Jamf Pro: Configuration Profiles – Upload profile

  • Microsoft Intune: Device Configuration – Custom profile

  • Other MDMs: Custom configuration profile upload

Manual deployment (defaults command)

For manual configuration or scripting:

# Set language
defaults write net.devolutions.workspace language -string "en-US"

# Enable tray minimize
defaults write net.devolutions.workspace reduceToTrayOnClose -bool true

# Set locking option
defaults write net.devolutions.workspace lockingOption -string "biometric"

Advantages

  • Centralized Management: Configure from MDM console

  • Policy Enforcement: Can prevent users from changing settings

  • Highest Priority: Overrides local configuration files

  • Enterprise Standard: Recommended approach for managed macOS fleets

See Configuration settings reference for complete list of available preferences.

Method 4: UI-Based configuration creator

Use the desktop application to create configuration files and MSI commands.

Use Case: IT administrators preparing deployment packages

Access: Tools – Custom Installation (in the desktop application)

Choosing the right deployment method

Decision matrix

Scenario Platform Recommended Method Reason
Jamf/MDM managed Macs macOS Method 3: MDM Profiles Centralized, highest priority, enterprise standard
Intune/SCCM deployment Windows Method 2: DEPLOY_CONFIG System-wide, reliable in automated scenarios
Silent/unattended install Windows Method 2: DEPLOY_CONFIG Avoids user context issues
Multi-user machine Both DEPLOY_CONFIG or MDM All users get same configuration
Shared workstations/kiosks Both DEPLOY_CONFIG or MDM Consistent config for all users
Interactive manual install Windows Method 2: USER_CONFIG or DEPLOY_CONFIG Both work; USER_CONFIG for per-user
Simple deployments Windows Method 1: MSI Parameters Quick, inline configuration
Complex deployments Both Method 4: UI Creator Tool → then deploy Create config file visually
Testing/development Both Any Use what matches production scenario

Note: Detailed explanations for each method are in the Deployment Methods section above.

Configuration file structure

Configuration files use the .cfg extension and contain JSON-formatted data.

File format

{
  "hubs": [
    {
      "url": "https://mycompany.devolutions.app",
      "organizationId": "00000000-0000-0000-0000-000000000000",
      "type": "Business",
      "version": ""
    }
  ],
  "dvls": [
    {
      "name": "Production DVLS",
      "serverUrl": "https://dvls.company.com",
      "serverVersion": ""
    },
    {
      "name": "Development DVLS",
      "serverUrl": "https://dvls-dev.company.com",
      "serverVersion": ""
    }
  ],
  "configs": {
    "language": "en-US",
    "reduceToTrayOnClose": true,
    "clearClipboardSensitiveData": true,
    "clipboardTimer": 30,
    "useFavicon": true,
    "useEntriesSyncOnDatasourceAccess": false,
    "useHubEmbeddedBrowser": true,
    "shareUsageData": false,
    "lockingOption": "password",
    "useBackgroundLock": true,
    "useLockWhenInactive": true,
    "lockInactivityDelay": 300
  }
}

Schema components

hubs array (Optional)

Array of Devolutions Hub Business instances to configure.

Field Type Required Description
url string Yes Hub URL (e.g., https://mycompany.devolutions.app)
organizationId string Yes Organization GUID
type string No Always "Business" (auto-populated)
version string No Hub version (auto-populated on first connection)

dvls Array (Optional)

Array of Devolutions Server instances to configure.

Field Type Required Description
name string Yes Display name for the server
serverUrl string Yes DVLS server URL (e.g., https://dvls.company.com)
serverVersion string No Server version (auto-populated on first connection)

configs object (Optional)

Application settings to pre-configure. See Configuration Settings Reference for complete list.

Configuration file locations

Configuration files are loaded in priority order based on location.

Windows

Window 1: %APPDATA%\net.devolutions\Workspace\ with Config.cfg

Window 2: %LOCALAPPDATA%\net.devolutions\Workspace\ with Config.cfg

Window 3: %ProgramData%\net.devolutions\Workspace\ with DefaultConfig.cfg and config.ready

User-level configuration

  • Roaming AppData: %APPDATA%\net.devolutions\Workspace\Config.cfg

    • Default: C:\Users\[Username]\AppData\Roaming\net.devolutions\Workspace\Config.cfg

    • Syncs across domain-joined computers

    • Highest priority (user-specific)

  • Local AppData: %LOCALAPPDATA%\net.devolutions\Workspace\Config.cfg

    • Default: C:\Users\[Username]\AppData\Local\net.devolutions\Workspace\Config.cfg

    • Machine-specific, not synced

    • Used during MSI installation, then copied to Roaming

System-wide configuration

  • ProgramData: %ProgramData%\net.devolutions\Workspace\DefaultConfig.cfg

    • Default: C:\ProgramData\net.devolutions\Workspace\DefaultConfig.cfg

    • Applies to all users on the system

    • Requires config.ready indicator file in same directory

    • Copied to user Roaming location on first launch (if user config doesn't exist)

Indicator file

  • File: config.ready

  • Location: Same directory as DefaultConfig.cfg

  • Purpose: Signals that system-wide config is ready for deployment

  • Content: Empty file, presence is checked only

macOS

  • User library path ~/Library/Application Support/Workspace/Config.cfg

  • System library path /Library/Application Support/Devolutions/Workspace/DefaultConfig.cfg

User-level configuration

  • Path: ~/Library/Application Support/Workspace/Config.cfg

  • Priority: Highest for user-specific configs

System-wide configuration

  • Path: /Library/Application Support/Devolutions/Workspace/DefaultConfig.cfg

  • Priority: Applied if user config doesn't exist

Managed preferences (MDM/Jamf)

  • Priority: Highest (overrides all file-based configs)

  • Preference Domain: net.devolutions.workspace

  • Keys: Same as configs object in JSON format

  • Configuration: Via MDM profile or defaults command

Priority order

Configuration sources are checked in the following order:

  1. macOS managed preferences (macOS only) - MDM/Jamf policies.

  2. User configuration file – User-specific config.

  3. System configuration file – System-wide default (copied to user location).

Configuration priority

  1. Check for macOS MDM preferences (highest priority). If found, use these.

  2. Check for User Config file. If found, use this.

  3. Check for System Config file. If found, copy to user location and use.

MSI Installer parameters

The Windows MSI installer accepts the following parameters for pre-configuration.

Data source parameters

Devolutions Server configuration

Parameter Type Description Example
DVLS_SERVER_URL String DVLS server URL https://dvls.company.com

Note: Only one Devolutions Server can be configured via MSI parameters. For multiple servers, use a configuration file.

Devolutions Hub Business configuration

Parameter Type Description Example
HUB_NAME String Hub subdomain name mycompany
ORGANIZATION_ID String Organization GUID 00000000-0000-0000-0000-000000000000

Note: The full Hub URL is constructed as https://{HUB_NAME}.devolutions.app

Configuration file deployment parameters

Parameter Type Description Target Location
DEPLOY_CONFIG String System-wide config (recommended) %ProgramData%\net.devolutions\Workspace\DefaultConfig.cfg
USER_CONFIG String Per-user config (interactive installs) %LOCALAPPDATA%\net.devolutions\Workspace\Config.cfg

See Method 2: Configuration file deployment for detailed comparison and usage guidelines.

Application settings parameters

General settings

Parameter Type Values Default Description
TARGET_LOCATION String roaming, local, system roaming Where to save configuration
LANGUAGE String Language code en-US Application language

User interface settings

Parameter Type Values Default Description
REDUCE_TO_TRAY_ON_CLOSE String true, false false Minimize to system tray instead of closing
USE_FAVICON String true, false false Download and display website favicons
USE_HUB_EMBEDDED_BROWSER String true, false true Use embedded browser for Hub authentication

Security settings

Parameter Type Values Default Description
CLEAR_CLIPBOARD_SENSITIVE_DATA String true, false false Auto-clear clipboard after copying passwords
CLIPBOARD_TIMER Number Seconds (1-999) 30 Seconds before clearing clipboard
LOCKING_OPTION String password, biometric, windowsCredentials (none) Method to lock application
USE_BACKGROUND_LOCK String true, false false Lock when minimized to tray
USE_LOCK_WHEN_INACTIVE String true, false false Lock after period of inactivity
LOCK_INACTIVITY_DELAY Number Seconds (30-3600) 30 Seconds before auto-lock

Synchronization settings

Parameter Type Values Default Description
USE_ENTRIES_SYNC_ON_DATASOURCE_ACCESS String true, false false Auto-sync entries when accessing data source

Privacy settings

Parameter Type Values Default Description
SHARE_USAGE_DATA String true, false true Share anonymous usage statistics

Target location options

The TARGET_LOCATION parameter determines where the configuration is saved:

  • roaming (Default): %APPDATA%\net.devolutions\Workspace\Config.cfg

    • Syncs across domain-joined computers

    • Per-user configuration

    • Recommended for domain environments

  • local: %LOCALAPPDATA%\net.devolutions\Workspace\Config.cfg

    • Machine-specific, does not sync

    • Per-user configuration

    • Recommended for standalone machines

  • system: %ProgramData%\net.devolutions\Workspace\DefaultConfig.cfg

    • System-wide configuration for all users

    • Requires administrative privileges

    • Recommended for shared computers

Configuration file creator (UI)

The desktop application includes a visual tool for creating configuration files.

Accessing the tool

  1. Launch Workspace desktop app.

  2. Navigate to ToolsCustom installation

Features

Export tab (Create configuration)

  1. Data source selection

    • View all configured Devolutions Server and Devolutions Hub Business instances

    • Select which data sources to include via checkboxes

    • Multiple data sources supported

  2. Settings configuration

    • Enable/disable individual application settings

    • Settings grouped by category:

      • General (Language, Tray behavior)

      • Security (Clipboard, Locking)

      • Synchronization

      • Privacy (Usage statistics)

  3. Live preview

    • Real-time JSON preview of configuration

    • Copy JSON to clipboard

    • Preview updates as selections change

  4. Export options

    • Generate .cfg file: Save configuration to .cfg file

    • Copy MSI command: Generate complete MSI command with all parameters

Import Tab (Load Configuration)

  1. File selection

    • Browse for .cfg files

    • File validation and parsing

  2. Preview before import

    • View data sources and settings before applying

    • Duplicate detection (warns if data source already exists)

  3. Import actions

    • Applies configuration to current application

    • Creates new data sources if they don't exist

    • Updates settings immediately

Use case: Creating enterprise deployment package

  1. Prepare: Configure one "template" installation with desired data sources

  2. Export: Use Custom Installation tool to generate .cfg file

  3. Distribute: Deploy .cfg file via:

    • MSI parameter: DEPLOY_CONFIG="\\server\share\Config.cfg"

    • Manual copy to system location: %ProgramData%\net.devolutions\Workspace\DefaultConfig.cfg


Configuration settings reference

Complete reference of all configurable settings.

Settings key mapping

Configuration files and MSI parameters use "export keys" that map to internal SharedPreferences keys.

Export Key (Config/MSI) Internal Key Type Default Description
language languageCode String en-US Application UI language
reduceToTrayOnClose minimizeOnClose Boolean false Minimize to tray instead of exiting
clearClipboardSensitiveData removeSensitiveFromKeyboard Boolean false Auto-clear clipboard timer
clipboardTimer clipboardTimer Integer 30 Seconds before clearing clipboard (1-999)
useFavicon useRichIcons Boolean false Download website favicons for entries
useEntriesSyncOnDatasourceAccess useEntriesSyncSpaceAccess Boolean false Auto-sync entries when accessing data source
useHubEmbeddedBrowser hubEmbeddedBrowser Boolean true Use embedded browser for Hub authentication
shareUsageData shareAnonymousData Boolean true Share anonymous usage statistics
lockingOption lockingOption String (none) Lock method: password, biometric, windowsCredentials
useBackgroundLock useBackgroundLock Boolean false Lock when minimized to tray
useLockWhenInactive useLockWhenInactive Boolean false Lock after period of inactivity
lockInactivityDelay lockInactivityDelay Integer 30 Seconds before auto-lock (30-3600)

Supported Languages

Code Language
en-US English (United States)
fr French
de German
es Spanish
cs Czech
hu Hungarian
it Italian
nl Dutch
pl Polish
ru Russian
sv Swedish
tr Turkish
uk Ukrainian
zh-CHS Chinese (Simplified)
zh-TW Chinese (Traditional)

Locking Options

Value Description Requirements
password Master password User sets password on first lock
biometric Fingerprint/Face ID Biometric hardware required
windowsCredentials Windows Hello Windows 10/11 with Windows Hello

Note: If biometric/Windows Hello is not available, falls back to password.

Command-line examples

Basic scenarios

Example 1: Deploy with single Devolutions Server

msiexec /i Workspace.msi /quiet DVLS_SERVER_URL="https://dvls.company.com"

Example 2: Deploy with Devolutions Hub Business

msiexec /i Workspace.msi /quiet ^
  HUB_NAME="mycompany" ^
  ORGANIZATION_ID="12345678-1234-1234-1234-123456789abc"

Example 3: Deploy with Devolutions Server, Devolutions Hub Business, and settings

msiexec /i Workspace.msi /quiet ^
  DVLS_SERVER_URL="https://dvls.company.com" ^
  HUB_NAME="mycompany" ^
  ORGANIZATION_ID="12345678-1234-1234-1234-123456789abc" ^
  LANGUAGE="en-US" ^
  REDUCE_TO_TRAY_ON_CLOSE="true" ^
  CLEAR_CLIPBOARD_SENSITIVE_DATA="true" ^
  CLIPBOARD_TIMER="60" ^
  USE_FAVICON="true" ^
  LOCKING_OPTION="windowsCredentials" ^
  USE_BACKGROUND_LOCK="true" ^
  USE_LOCK_WHEN_INACTIVE="true" ^
  LOCK_INACTIVITY_DELAY="300" ^
  SHARE_USAGE_DATA="false"

Example 4: Deploy pre-Created config file

msiexec /i Workspace.msi /quiet DEPLOY_CONFIG="\\fileserver\IT\Workspace\Config.cfg"

Best for: Enterprise deployments, Intune, SCCM, multi-user machines.

Example 5: Microsoft Intune deployment (complete guide)

Important: Use DEPLOY_CONFIG for enterprise deployments. See Method 2 for details.

Step 1: Prepare Files

Create a working folder (e.g., C:\IntuneApps\Workspace\) and place these files:

  • Workspace.msi

  • config.cfg (created via Tools – Custom Installation or manually)

  • Install-Workspace.ps1 (PowerShell script below)

Step 2: PowerShell Installation Script

Create Install-Workspace.ps1:

# Install-Workspace.ps1
# Source files in the Intune package
$ConfigSource = "$PSScriptRoot\config.cfg"
$ConfigTarget = "C:\Program Files\config.cfg"
$MsiPath = "$PSScriptRoot\Workspace.msi"

# Copy config.cfg to Program Files
try {
    Copy-Item -Path $ConfigSource -Destination $ConfigTarget -Force
} catch {
    Write-Host "Error copying config file: $($_.Exception.Message)"
    exit 1
}

# Install MSI silently with DEPLOY_CONFIG parameter
$Arguments = "/i `"$MsiPath`" /qn /norestart DEPLOY_CONFIG=`"C:\Program Files\config.cfg`""
$Process = Start-Process "msiexec.exe" -ArgumentList $Arguments -Wait -PassThru

# Return exit code to Intune
exit $Process.ExitCode

Why this approach?

  • Config file is packaged with the application

  • Automatically placed in correct location

  • MSI receives correct DEPLOY_CONFIG path

  • Works reliably in Intune's SYSTEM context

  • Source config file is automatically deleted after successful copy (by Configure.ps1)

Step 3: Create .intunewin Package

Use the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe):

IntuneWinAppUtil.exe -c C:\IntuneApps\Workspace -s Install-Workspace.ps1 -o C:\IntuneApps\Output

Parameters:

  • -c : Source folder containing all files

  • -s : Setup file (the PowerShell script)

  • -o : Output folder for the .intunewin package

Result: Workspace.intunewin package ready for upload.

Step 4: Configure Intune Application

In Microsoft Intune Portal:

  1. Navigate to: AppsWindowsAddWindows app (Win32)

  2. App Package File: Upload Workspace.intunewin

  3. App Information:

    • Name: Devolutions Workspace

    • Description: Password manager and remote connection tool

    • Publisher: Devolutions

  4. Program Configuration:

    • Install command:

      powershell.exe -ExecutionPolicy Bypass -File .\Install-Workspace.ps1
      
    • Uninstall command:

      msiexec.exe /x {PRODUCT-CODE-GUID} /qn /norestart
      
    • Install behavior: System

    • Device restart behavior: Determine behavior based on return codes

  5. Requirements:

    • Operating system architecture: 64-bit

    • Minimum operating system: Windows 10 1607+

  6. Detection Rules:

    • Rule type: MSI

    • MSI product code: (Auto-detected from package)

    Alternative - File detection:

    • Path: C:\Program Files\Devolutions\Workspace

    • File or folder: Workspace.exe

    • Detection method: File or folder exists

  7. Assignments: Assign to target groups (users or devices)

Step 5: Deployment Flow

When Intune installs the application:

  1. Package extraction: Intune extracts Workspace.intunewin to a temporary directory

  2. Script execution: Install-Workspace.ps1 runs as SYSTEM

  3. Config deployment: Script copies config.cfg to C:\Program Files\config.cfg

  4. MSI installation: MSI installs with DEPLOY_CONFIG="C:\Program Files\config.cfg"

  5. Config processing: MSI's Configure.ps1 copies config to:

    • %ProgramData%\net.devolutions\Workspace\DefaultConfig.cfg

    • Creates config.ready indicator file

    • Deletes source file C:\Program Files\config.cfg (cleanup)

  6. First launch: When any user launches Workspace:

    • App detects DefaultConfig.cfg + config.ready

    • Copies config to user's Roaming profile

    • User has fully configured application

SCCM deployment (Alternative)

Install Command:

msiexec /i Workspace.msi /quiet /norestart DEPLOY_CONFIG="%~dp0Config.cfg"

Uninstall Command:

msiexec /x {PRODUCT-CODE} /qn /norestart

Detection Method:

  • Registry key: HKLM\SOFTWARE\Devolutions\Workspace\Version

Note: Package both Workspace.msi and Config.cfg together. The %~dp0 variable references the extraction directory.

Platform-specific considerations

Windows

Group policy vs Configuration files

  • Configuration files: Recommended for initial deployment and default settings

  • Group policy: Use for enforcing policies that users cannot change

Configuration files apply at startup, Group Policy can override settings.

Domain vs standalone

  • Domain-joined: Use Roaming AppData (TARGET_LOCATION="roaming") for profile sync

  • Standalone: Use Local AppData (TARGET_LOCATION="local") or System (TARGET_LOCATION="system")

Permissions

  • Per-user config: No special permissions required

  • System-wide config: Requires administrative privileges to write to %ProgramData%

Indicator file behavior

The config.ready file is required for system-wide configurations:

  • Must be in the same directory as DefaultConfig.cfg

  • Can be empty (presence is checked, content is ignored)

  • Without it, DefaultConfig.cfg is ignored

  • Automatically created by MSI installer and PowerShell scripts

macOS

macOS configuration is primarily done via MDM/Managed Preferences. See Method 3: MDM/Managed Preferences for detailed instructions.

For file-based configuration (alternative to MDM), configuration files follow the same structure as Windows but with different paths. See Configuration File Locations for macOS-specific paths.


Use cases & scenarios

Scenario 1: Enterprise onboarding

Situation: New employees need Workspace with company Devolutions Server and Devolutions Hub pre-configured.

Solution:

  1. Create Config.cfg with IT Template installation using Custom installation tool

  2. Deploy via SCCM/Intune with DEPLOY_CONFIG parameter

  3. Users launch app, data sources already configured

Benefits: Eliminates helpdesk calls, ensures consistency

Scenario 2: Multiple Devolutions Server

Situation: Organization has Production, Development, and Test DVLS servers. Some users need all three.

Solution:

  1. Create Config.cfg with all three servers:

{
  "dvls": [
    {"name": "Production", "serverUrl": "https://dvls-prod.company.com"},
    {"name": "Development", "serverUrl": "https://dvls-dev.company.com"},
    {"name": "Test", "serverUrl": "https://dvls-test.company.com"}
  ]
}
  1. Deploy to developers/IT staff

Benefits: One-time configuration, users immediately productive

Scenario 3: Security-focused deployment

Situation: Security policy requires auto-lock after 5 minutes, clipboard clearing, and Windows Hello authentication.

Solution:

msiexec /i Workspace.msi /quiet ^
  DVLS_SERVER_URL="https://dvls.company.com" ^
  LOCKING_OPTION="windowsCredentials" ^
  USE_LOCK_WHEN_INACTIVE="true" ^
  LOCK_INACTIVITY_DELAY="300" ^
  CLEAR_CLIPBOARD_SENSITIVE_DATA="true" ^
  CLIPBOARD_TIMER="30" ^
  SHARE_USAGE_DATA="false"

Benefits: Enforces security policies from first launch

Scenario 4: Regional deployments

Situation: Global organization with regional Devolutions Server and language preferences.

Solution: Create regional configurations:

North America (Config-NA.cfg):

{
  "dvls": [{"name": "NA DVLS", "serverUrl": "https://dvls-na.company.com"}],
  "configs": {"language": "en-US"}
}

France (Config-FR.cfg):

{
  "dvls": [{"name": "DVLS France", "serverUrl": "https://dvls-fr.company.com"}],
  "configs": {"language": "fr"}
}

Germany (Config-DE.cfg):

{
  "dvls": [{"name": "DVLS Deutschland", "serverUrl": "https://dvls-de.company.com"}],
  "configs": {"language": "de"}
}

Deploy based on AD site or SCCM collection.

Benefits: Localized experience, regional server connectivity


Troubleshooting

Configuration not applied

Problem: Configuration file present but settings not applied.

Solutions:

  1. Check file location: Verify correct path for platform

  2. Check JSON validity: Validate JSON syntax (no trailing commas, proper quotes)

  3. Check permissions: User must have read access to config file

  4. Windows System Config: Verify config.ready file exists in same directory

  5. Check logs: Review application logs for parsing errors

Indicator file missing (Windows)

Problem: System-wide configuration ignored.

Solution: Create config.ready file:

type nul > "%ProgramData%\net.devolutions\Workspace\config.ready"

USER_CONFIG deploys to "Default"uUser profile

Problem: USER_CONFIG fails in silent/automated installs, config ends up in C:\Users\Default\AppData\Local.

Cause: USER_CONFIG requires active user session context, which isn't available during automated MSI installation.

Solution: Use DEPLOY_CONFIG for enterprise deployments.

# CORRECT for Intune/SCCM
msiexec /i Workspace.msi /qn /norestart DEPLOY_CONFIG="%~dp0Config.cfg"

See Method 2: Configuration File Deployment for complete comparison and guidelines.

Data source already exists

Problem: Import fails with "data source already exists" message.

Explanation: Configuration parser detects duplicates by normalized URL (case-insensitive, trailing slash removed).

Solutions:

  1. Remove existing data source manually before importing

  2. Edit configuration file to remove duplicate entries

  3. Use Custom Installation tool to merge configurations

Settings not persisting

Problem: Settings revert to defaults after restart.

Solutions:

  1. User vs system config: System config only applies if user config doesn't exist. Once user modifies settings, they are saved to user config and override system defaults.

  2. Group policy override: Check if GPO is enforcing settings

  3. File Permissions: Verify write permissions to user config location

MSI Silent Install Not Applying Config

Problem: MSI parameters not creating configuration.

Solutions:

  1. Check parameter syntax: Ensure proper quoting (use "value", not 'value')

  2. Log MSI installation: Add /l*v install.log to see detailed errors

  3. Verify PowerShell execution: Check if execution policy blocks scripts

  4. Administrative rights: Some operations require elevation

Example with logging:

msiexec /i Workspace.msi /quiet /l*v C:\Temp\install.log DVLS_SERVER_URL="https://server.com"

Configuration file creator shows wrong data

Problem: Custom Installation tool shows unexpected data sources.

Explanation: Tool displays currently configured data sources in the running application.

Solution: This is expected behavior. To create a "clean" configuration:

  1. Export only the desired data sources (uncheck others)

  2. Or create JSON manually based on template

Locking option not working

Problem: Biometric or Windows Hello not activating.

Solutions:

  1. Hardware Check: Verify biometric hardware is available

  2. Windows Hello Setup: Ensure Windows Hello is configured in Windows Settings

  3. Fallback: System automatically falls back to password if hardware unavailable

  4. macOS Biometric: Requires Touch ID hardware

Import shows "Invalid Configuration"

Problem: Configuration file import fails validation.

Solutions:

  1. Check JSON syntax: Use JSON validator (e.g., jsonlint.com)

  2. Check required fields:

    • Hubs: url and organizationId required

    • DVLS: name and serverUrl required

  3. Check data types:

    • Booleans: true/false (not "true"/"false")

    • Numbers: 30 (not "30")

    • Strings: "value" (with quotes)

Valid Example:

{
  "hubs": [
    {
      "url": "https://company.devolutions.app",
      "organizationId": "guid-here"
    }
  ],
  "configs": {
    "clipboardTimer": 30,
    "clearClipboardSensitiveData": true,
    "language": "en-US"
  }
}

Additional Resources

  • Group Policy Configuration: See GPO documentation for enforcing policies

  • MDM Deployment (macOS): See Jamf/MDM deployment guide

  • Security Best Practices: See security hardening guide

  • DVLS Integration: See DVLS connection documentation

  • Hub Business Setup: See Hub Business getting started guide

Support

For technical support with pre-configuration:

Appendix A: Complete configuration template

{
  "hubs": [
    {
      "url": "https://mycompany.devolutions.app",
      "organizationId": "00000000-0000-0000-0000-000000000000",
      "type": "Business",
      "version": ""
    }
  ],
  "dvls": [
    {
      "name": "Production DVLS",
      "serverUrl": "https://dvls.company.com",
      "serverVersion": ""
    },
    {
      "name": "Development DVLS",
      "serverUrl": "https://dvls-dev.company.com",
      "serverVersion": ""
    }
  ],
  "configs": {
    "language": "en-US",
    "reduceToTrayOnClose": false,
    "clearClipboardSensitiveData": false,
    "clipboardTimer": 30,
    "useFavicon": false,
    "useEntriesSyncOnDatasourceAccess": false,
    "useHubEmbeddedBrowser": true,
    "shareUsageData": true,
    "lockingOption": null,
    "useBackgroundLock": false,
    "useLockWhenInactive": false,
    "lockInactivityDelay": 30
  }
}

Appendix B: Quick reference - MSI parameters

Category Parameter Example Value
DVLS DVLS_SERVER_URL https://dvls.company.com
Hub HUB_NAME mycompany
Hub ORGANIZATION_ID guid
File Deploy DEPLOY_CONFIG C:\Config\Workspace.cfg
File Deploy USER_CONFIG C:\Config\Workspace.cfg
General TARGET_LOCATION roaming, local, system
General LANGUAGE en-US, fr, de, etc.
UI REDUCE_TO_TRAY_ON_CLOSE true, false
UI USE_FAVICON true, false
UI USE_HUB_EMBEDDED_BROWSER true, false
Security CLEAR_CLIPBOARD_SENSITIVE_DATA true, false
Security CLIPBOARD_TIMER 30 (seconds)
Security LOCKING_OPTION password, biometric, windowsCredentials
Security USE_BACKGROUND_LOCK true, false
Security USE_LOCK_WHEN_INACTIVE true, false
Security LOCK_INACTIVITY_DELAY 300 (seconds)
Sync USE_ENTRIES_SYNC_ON_DATASOURCE_ACCESS true, false
Privacy SHARE_USAGE_DATA true, false
Devolutions Forum logo Share your feedback