Customize Windows Installation of Cisco Secure Client

You can customize the installation of the Cisco Secure Client with various modules and features on Windows. The Cisco Secure Client deployment packages support several MSI properties that you can change during installation, including lockdown and disabling the display of the VPN module in the client's GUI.

Contents

• Procedure
  • Deploy the Cisco Secure Client VPN Module
  • Deploy the Cisco Secure Client Umbrella Roaming Security Module
  • (Optional) Deploy the Cisco Secure Client DART Module
  • Hide Cisco Secure Client from Add/Remove Programs List
• Optional OrgInfo.json Configurations

Procedure

You can deploy the Cisco Secure Client for Windows using several options including:

• Hide the VPN module in the Cisco Secure Client GUI.
• Hide the Secure Client installation from the Add/Remove Windows programs list.
• Enable Lockdown mode to prevent users from stopping or disabling Secure Client services, for more information , see Configure AnyConnect Lockdown For Windows.

Deploy the Cisco Secure Client VPN Module

Run the Windows installer to deploy the Cisco Secure Client VPN package with the PRE_DEPLOY_DISABLE_VPN=1 option. This option hides the VPN module Secure Client 's GUI, but is not disabled. Set the MSI property to PRE_DEPLOY_DISABLE_VPN=1.

👍

Note:

If the VPN module is hidden in the client's GUI, you can manage the VPN module through the Cisco Secure Client's CLI.

The following command disables the VPN functionality by copying the VPNDisable_ServiceProfile.xml file embedded in the MSI to the directory specified to the endpoints VPN profiles directory.

Example:

msiexec /package cisco-secure-client-win-<version>-core-vpn-predeploy-k9.msi /norestart /passive PRE_DEPLOY_DISABLE_VPN=1 /lvx* c:\\output.log

Deploy the Cisco Secure Client Umbrella Roaming Security Module

1. Run the Windows installer to deploy the Cisco Secure Client Umbrella Roaming Security package.

msiexec /package cisco-secure-client-win-<version>-umbrella-predeploy-k9.msi /norestart /passive /lvx* c:\\output.log

2. To enable lockdown, add LOCKDOWN=1 in the CLI.

msiexec /package cisco-secure-client-win-<version>-umbrella-predeploy-k9.msi /passive LOCKDOWN=1 /lvx* c:\\output.log

(Optional) Deploy Cisco Secure Client DART

Run the Windows installer to deploy the Secure Client DART package.

msiexec /package cisco-secure-client-win-<version>-dart-predeploy-k9.msi /norestart /passive /lvx* c:\\dart.log

Hide Cisco Secure Client Modules from Add/Remove Programs List

You can hide the installed Cisco Secure Client modules from users who have permission to view the Windows Add/Remove Programs list.

Run the Windows installer for the Cisco Secure Client package using ARPSYSTEMCOMPONENT=1.
You can apply this option to all the modules at the time of deployment.

Example:

msiexec /package cisco-secure-client-win-<version>-umbrella-predeploy-k9.msi /passive ARPSYSTEMCOMPONENT=1 /lvx* c:\\output.log

Optional OrgInfo.json Parameter Configurations

When deploying the Umbrella Roaming Security module in Cisco Secure Client, you have the flexibility to add and configure various parameters directly within the Umbrella OrgInfo.json file. Unlike the LOCKDOWN parameter, these settings are applied directly to the OrgInfo.json profile rather than during the installation process using an msiexec parameter. The following information is not applicable if executed at the time of installation.

👍

Note:

Modify the correct Orginfo.json file with the following %ProgramData%\Cisco\Cisco Secure Client\Umbrella\datapath.

Mass Deployment (Windows)< Customize Windows Installation of Cisco Secure Client > Mass Deployment (macOS)