Installation and Setup Customization

ActivClient can be installed locally on individual machines or deployed remotely across multiple users or computers, streamlining the process and helping reduce the total cost of ownership.

In addition, the ActivClient setup can be extensively customized to meet your organization's specific requirements.

Warning!

Configuring WDAC or AppLocker to use PowerShell Constrained Language Mode may prevent the PowerShell scripts included in the ActivClient MSI installer from running. As a result, you may be unable to install a new version of ActivClient or uninstall or update an existing installation.

Until a solution is available, temporarily disable this mode before installing, updating, or uninstalling ActivClient. We are working on an installer update that will support this security mechanism.

Note: Installing ActivClient requires administrator privileges on the workstation. For more information about prerequisites, see Installation Prerequisites.
Note: You can also edit the ActivClient MSI file directly using Orca; however, this method is not recommended as it invalidates the file's digital signature.

Before installing ActivClient, ensure your system meets the following minimum requirements:

The system must meet the minimum requirements:

  • One of the supported ClosedOperating Systems

    • Microsoft Windows 10 (64-bit edition) 22H2

    • Microsoft Windows 11, starting from version 23H2 and up to version 25H2 (inclusive)

    • Microsoft Windows Server 2019 including Server Core

    • Microsoft Windows Server 2022 including Server Core

    • Microsoft Windows Server 2025 including Server Core

  • Up to 210 MB (ActivClient x64 with all features installed) of free disk space

For full details, see System Requirements and Operating Systems.

ActivClient is signed by a DigiCert code-signing certificate which may not be pre-installed on all Windows workstations. If your environment automatically receives the latest root certificates from Microsoft (most common scenario), the DigiCert code-signing certificate is likely already trusted.

  • To verify trust:

    Open the Certificate Store and confirm the presence of DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 under Trusted Root Certification Authorities. Ensure it includes the “code signing” property.

  • Automatic download:

    If the workstation has internet access, the DigiCert root certificate will be downloaded automatically, and the trust will be verified.

  • Manual installation:

    If the workstation has no internet connection or if ActivClient is deployed via push mechanism, the administrator must manually install the DigiCert root certificate on the workstation prior to installing ActivClient.

Tip!

The ActivClient installer (MSI package) must be accessible from a local drive.

Alternatively, installation from a network location can be enabled by marking the location as a source of installation media in Active Directory.

Note: OneDrive shared folders are considered network locations, and installation from them may not be possible.

Installation requires administrator privileges on the workstation.

Important: Make sure no smart card or key is connected to the workstation before installing ActivClient on it.

The ActivClient setup consists of several components that you can enable or disable for installation, depending on the scope of your deployment.

  • By default, i.e., when you choose the Typical setup type, the components marked withyes icon in the "Typical Installation" column of the table below will be installed.

  • You can also customize the installation by selecting which components to install.

The following table provides complete details of the available ActivClient components:

ActivClient Components Typical Installation Feature Name*
ActivClient Minidriver

  • Provides smart card support for applications relying on Microsoft cryptographic framework (such as Windows Login, browsers, EFS, or Outlook).

 yes icon MiniDriver
ActivClient Console

  • Provides a management GUI for your security devices and credentials.

 yes icon UserConsole
Microsoft Outlook Usability Enhancements

  • Eases the configuration and use of digital certificates in Microsoft Outlook.

 yes icon If Microsoft Outlook 2019 or 2021 is detected. Outlook
PKCS#11 Support

  • Provides smart card support for applications relying on the PKCS#11 API.

  • When you install the ActivClient PKCS#11 library, for compliance with the US Government GSC-IS specifications, ActivClient records the location of the PKCS#11 library in a standard registry:

    HKEY_LOCAL_MACHINE\Software\GSC\Cryptography\PKCS#11\HID

yes icon PKCS
ActivClient BSI

  • Used by legacy applications to access the services provided by applets stored on supported tokens.

  • For compliance with the US Government GSC-IS specifications, ActivClient registers the BSI library modules and vendor information in a standard registry:

    HKEY_LOCAL_MACHINE\Software\GSC\BSI\2.1\HID

yes icon Always installed; cannot be excluded. N/A
Card Auto-Update service with HID CMS yes icon Always installed; cannot be excluded. N/A
US Department of Defense configuration

  • ActivClient Closedconfiguration for US Department of Defense Common Access Cards (CAC).

    • Installs the Credential Management Client in the following directory:

      C:\Program Files\HID Global

no-icon DeptOfDefenseConfiguration
Configuration Management

  • Provides the ActivClient administrative templates to configure policy settings.

 no-icon SettingsManagement

* Used in msiexec command line arguments.

Note:

  • OTP configuration is available through the ActivClient Console component for tokens that support OTP.

  • If the ActivClient Minidriver is installed, its code-signing certificate is automatically added to the Trusted Publishers store on the workstation.

You can install ActivClient interactively through a graphical user interface (GUI).

To install ActivClient with the Installation Wizard:

  1. Locate the ActivClient MSI installer in the ActivClient product folder of the distribution package and double-click it.

    Alternatively, you can Closedrun the MSI installer from the command line or PowerShell.

    Copy 
    msiexec.exe  /i "<path>\<ActivClient_setup>"

    where:

    • <path> is the path to the ActivClient product folder which contains the MSI installer.

    • <ActivClient_setup> is the ActivClient setup MSI file name.

    Note: Quotation marks in the commands are required if the path or file name contains spaces. They are optional otherwise but recommended for consistency.

  2. On the Welcome page of the ActivClient Installation Wizard, click Next.

  3. Accept the license agreement and click Next.

  4. In the Choose Setup Type dialog:

    Choose Setup Type dialog

    • Leave the setup type as Typical (default setting) and click Next for a typical installation.

    • Select Custom and click Next Closedto choose manually which features you wish to install.

      1. The Custom Setup dialog is displayed.

      2. Select the program features you want to install from the list using the appropriate option from the right-click menu:

        • To add (install) a component that is not selected, click the "Not Available" icon The "Not available" install state icon. for the component and then click the appropriate installation option in the displayed list.

        • To remove a component, click the The "Available" install state icon icon for the component and then click the "Not Available" icon The "Not available" install state icon. in the displayed list.

      For the complete list of available components and sub-components, see ActivClient Components.

      Note: The Microsoft Outlook Usability Enhancements component requires Microsoft Outlook 2019 or 2021.

    • Select Complete for installing all available program features.

  5. Click Install.

  6. The Setup Progress page is displayed. The progress might take several minutes.

  7. If the required Visual C++ Redistributable packages are not already installed, the ActivClient installer will prompt for User Account Control (UAC) and install them automatically.

  8. Once the setup is complete, click Finish.

  • Restart Workstation:

    It is recommended to restart your workstation after successful installation of ActivClient to make sure all the services are active.

  • Smart Card Readers:

    • The security device reader that you use requires a reader driver. This driver might be present in your Microsoft Windows system, or you might need to install it. Contact your reader vendor for information.

    • If you use an HID Global OMNIKEY® reader, and if the reader is not recognized automatically, or if the driver is not installed by Microsoft Windows Update, the drivers are available for download from HID Global’s website.

  • Using ActivClient With Microsoft Outlook:

    In order to use ActivClient with Microsoft Outlook installed after ActivClient, you must register ActivClient to the application using the Add/Remove or Repair action on the Microsoft Outlook Usability Enhancements component. See Modifying an Existing Installation.

After installing ActivClient, you can modify the ActivClient installation by adding or removing components.

  1. Run the ActivClient MSI installer from the ActivClient product folder of the distribution package.

    Alternatively, go to the program or app management feature on your system, select ActivClient from the list and click Change.

  2. In the Program Maintenance window, select the Modify icon.

    Modify, Repair or Remove installation dialog

  3. Select the ActivClient components you want to install from the list using the appropriate option from the right-click menu:

    • To add (install) a component, click the The "Not available" install state icon. icon for the component and then click the appropriate installation option in the displayed list.

    • To remove a component, click the The "Available" install state icon icon for the component and then click The "Not available" install state icon. in the displayed list.

    For the complete list of available components and sub-components, see ActivClient Components.

    Note: The Microsoft Outlook Usability Enhancements component requires Microsoft Outlook 2019 or 2021.

  4. Click Next to proceed. The Ready to Install the Program page is displayed.

  5. Click Install.

  6. When the InstallShield Wizard Completed page is displayed, click Finish.

  7. To benefit from all ActivClient services immediately, it is recommended to restart your workstation after the installation is completed.

Installing ActivClient via the command line or PowerShell enables automation of the installation process and provides more extensive customization options than the interactive Installation Wizard.

Note: In all command line examples provided in the following sections:
  • <path> refers to the path to the folder containing the ActivClient setup MSI file.

  • <ActivClient_setup> refers to the ActivClient setup MSI file name.

    ExampleClosedFor version 9.7.0, the setup file name is ActivClient-9.7.0.msi.

  • <FeatureName> refers to the name of the respective ActivClient feature to include in or exclude from the setup. For a list of features and their names, see ActivClient Components.

  • Quotation marks in the commands are required if the path or file name contains spaces. They are optional otherwise but recommended for consistency.

Tip! To start the ActivClient setup program in silent mode, i.e., as default features installation without any user interface displayed, see Running a Blind Setup (Silent Installation).

To install ActivClient using the Microsoft Installer (MSI) with the default configuration, run the following command:

Copy 
msiexec.exe  /i "<path>\<ActivClient_setup>"

This performs the same default installation as when double-clicking the setup file and selecting the Typical option in the Installation Wizard.

To exclude one or several features from the setup program, use the following command:

Copy 
msiexec /i "<path>\<ActivClient_setup>" AddLocal=ALL Remove=<FeatureName1>,<FeatureName2>

For a list of features and their names, see ActivClient Components.

To install all the features, excluding the PKCS#11 Support, use the following command:

Copy 
msiexec /i "<path>\<ActivClient_setup>" AddLocal=ALL Remove=PKCS

To force installation of one or several features from the setup program, use the following command:

Copy 
msiexec.exe /i "<path>\<ActivClient_setup>" AddLocal=<FeatureName1>,<FeatureName2>

When installing ActivClient with this command, you need to list all the features that you want to install.

For a list of features and their names, see ActivClient Components.

Tip! You can use AddLocal=ALL if you want to install all the ActivClient features.

To install only the MiniDriver and PKCS features, use the following command:

Copy 
msiexec.exe /i "<path>\<ActivClient_setup>" AddLocal=MiniDriver,PKCS

To remove one or several features from an existing installation, use the following command:

Copy 
msiexec.exe /i "<path>\<ActivClient_setup>" Remove=<FeatureName1>,<FeatureName2>

For a list of features and their names, see ActivClient Components.

 

To remove the ActivClient Console feature, use the following command:

Copy 
msiexec.exe /i "<path>\<ActivClient_setup>" Remove=UserConsole

When modifying an existing installation, you can use AddLocal to add only the features that you want to install.

To add one or several features to an existing installation, use the following command:

Copy 
msiexec.exe /i "<path>\<ActivClient_setup>" AddLocal=<FeatureName1>,<FeatureName2>

For a list of features and their names, see ActivClient Components.

To add the ActivClient Console and PKCS features, use the following command:

Copy 
msiexec.exe /i "<path>\<ActivClient_setup>" AddLocal=UserConsole,PKCS

To exclude specific tokens from Minidriver registration in the Calais registry–for example, when alternative middleware is required for such tokens—use the MSI installer with the CALAIS_EXCLUDE_LIST option.

In the example below, the command skips registration for any token whose name (as listed under Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\SmartCards) contains the case-insensitive string "token1" or "token2":

Copy 
msiexec.exe /i "<path>\<ActivClient_setup>" CALAIS_EXCLUDE_LIST="token1;token2"

In some cases, the ActivClient installer may require a system restart at the end of the installation process. To control this behavior, use the REBOOT property.

REBOOT value Description
Force Forces a restart unless an error occurs.
ForceAlways Always forces a restart, regardless of errors.
Suppress

Suppresses automatic restart, but prompts the user when ForceReboot is triggered. In a blind setup, the system restarts automatically.
ReallySuppress

Suppresses all restart actions and prompts, including those triggered by ForceReboot.

  • To force a restart:

    Copy 
    msiexec.exe  /i "<path>\<ActivClient_setup>" REBOOT=Force

  • To disable a restart:

    Copy 
    msiexec.exe /i "<path>\<ActivClient_setup>" REBOOT=ReallySuppress

To run the setup without any user interface (blind setup), use:

Copy 
msiexec.exe  /i "<path>\<ActivClient_setup>"  /q

Customizing the User Interface Level

You can customize the user interface level using additional /q options (see the Windows Installer documentation):

Parameter   Description

/quiet, /q , /qn

No UI.

/qb

Basic UI.

Use /qb! to hide the Wizard Cancel button.

/qr

Reduced UI with no modal dialog box displayed at the end of the installation.

/qf

Full UI and any authored FatalError, UserExit, or Exit modal dialog boxes at the end.

/qn+

No UI except for a modal dialog box displayed at the end.

/qb+

Basic UI with a modal dialog box displayed at the end.

The modal box is not displayed if the user cancels the installation.

Use /qb+! or /qb!+ to hide the Cancel button.

/qb-

Basic UI with no modal dialog boxes.

Use /qb-! or /qb!- to hide the Cancel button.