Deploying workstation backups across Windows endpoints requires a silent, predictable, and secure installer workflow. Recent updates to the Duplicati Windows installer overhaul enterprise management by turning the MSI into a fully automated, fleet-ready installation tool.

Key Deployment Enhancements

• Native Service Mode & VSS Integration: Installing Duplicati as a Windows Service allows backups to run seamlessly in the background, even if no users are logged into the machine. Furthermore, running as a service automatically defaults Duplicati to use the VSS (Volume Shadow Copy) service, granting it the necessary elevated privileges to back up locked files without manual intervention.

  
  

• Pre-Configured Preloads (INSTALL_PRELOAD=true): Administrators can enforce standardized corporate policies by dropping a preload.json configuration file in the exact same folder as the MSI. Passing INSTALL_PRELOAD=true during installation tells the installer to securely pick up and apply this file. (Without this flag, the file is ignored to prevent malicious side-loading).

  
  

• Secure Access Management: Because running as a service gives Duplicati full access to the machine, the installer restricts access. In a standard UI install, it automatically configures the current user to connect securely. In a silent unattended install, administrators must manage the service password to access the UI or allow the TrayIcon to connect.

  
  

Fleet Deployment Parameters

System administrators control zero-touch deployments through Microsoft Intune, SCCM, or Group Policy by passing native Windows Installer features directly to msiexec.exe using the ADDLOCAL and REMOVE parameters.

Automated Silent Command Example

To perform a zero-touch, unattended installation (/qn) that installs only the core application and the Windows Service (omitting desktop, start menu, and startup shortcuts), and applies a preload configuration, use the following syntax:

msiexec /i Duplicati.msi /qn ^
  ADDLOCAL=DuplicatiCore,DuplicatiServiceFeature ^
  REMOVE=DuplicatiDesktopShortCutFeature,DuplicatiProgramMenuShortCutFeature,DuplicatiStartupShortCutFeature ^
  INSTALL_PRELOAD=true ^
  DUPLICATI_SERVICE_PASSWORD=YourSecurePassword123

msiexec /i Duplicati.msi /qn ^
  ADDLOCAL=DuplicatiCore,DuplicatiServiceFeature ^
  REMOVE=DuplicatiDesktopShortCutFeature,DuplicatiProgramMenuShortCutFeature,DuplicatiStartupShortCutFeature ^
  INSTALL_PRELOAD=true ^
  DUPLICATI_SERVICE_PASSWORD=YourSecurePassword123

msiexec /i Duplicati.msi /qn ^
  ADDLOCAL=DuplicatiCore,DuplicatiServiceFeature ^
  REMOVE=DuplicatiDesktopShortCutFeature,DuplicatiProgramMenuShortCutFeature,DuplicatiStartupShortCutFeature ^
  INSTALL_PRELOAD=true ^
  DUPLICATI_SERVICE_PASSWORD=YourSecurePassword123

Post-Deployment Security

Passing DUPLICATI_SERVICE_PASSWORD via the command line may cause the password to be exposed in deployment logs. Duplicati offers two secure alternatives for unattended installs:

1. Autogenerated: If you omit the password parameter entirely, Duplicati will automatically generate a strong password and configure the TrayIcon for the current user with the password.

   
   

2. Command-Line Reset: You can securely reset the password post-installation without logging it in plain text using the built-in Windows Service executable:

   "C:\Program Files\Duplicati 2\Duplicati.WindowsService.exe" reset-password

   "C:\Program Files\Duplicati 2\Duplicati.WindowsService.exe" reset-password

   "C:\Program Files\Duplicati 2\Duplicati.WindowsService.exe" reset-password

By leveraging ADDLOCAL for precise feature control and INSTALL_PRELOAD for configuration templates, complex endpoint backup deployments are consolidated into a single, robust silent installation step.