KB9084 - FAQ - PCS client component deployment

This article reviews frequently asked questions (FAQs) and useful information for those who either install, uninstall, or upgrade Pulse Secure Client or PCS legacy client components on client machines, and who may or may not have administrator permissions or privileges for their system.

What should I know when installing, uninstalling, or upgrading Pulse Secure Client or PCS legacy client components on client machines for users with and without administrative permissions or privileges for their system?

This FAQ is organized by:

• Pulse Secure Client
• Pulse Secure Legacy clients
• Pulse Secure Installer Service

Pulse Secure client

1. What are the methods which I can use to deploy Pulse Secure on desktops?
   • Web install
   • Standalone application installer (Default)
   • Standalone application installer (Preconfigured)
   
    
2. Is there a recommended method for installing or upgrading Pulse Secure Desktop Client?

   There are benefits and disadvantages to all three methods when you are installing Pulse Secure Desktop Client for the first time. We recommend that you choose whatever option best suites your organization's needs. See the following documentation for more information:
   Pulse Connect Secure Administration Guide Chapter 6: Deploying Pulse Secure client

   However, when you are upgrading Pulse Secure Client, we recommend that all upgrades be performed by connecting directly via Pulse Secure Client rather than using the Web install method. Any additional components which may have been installed on a Pulse Secure Client may not get upgraded if the default component set on the role is configured to install "No components" or "Minimal components." The "Minimal components" option will only upgrade components needed to support selected configuration.
    
3. How can I enable or disable Pulse Secure Client install or upgrade from the PCS gateway?
   In the PCS Admin Console select Maintenance > System > Options: Enable we installation and automatic upgrade of the Pulse Secure Clients to allow the Pulse Secure Client to receive install or upgrade prompts from the PCS appliance. This will be the case regardless if Pulse Secure Client is launched by connecting directly via Pulse Secure Client or if a web browser is used to launch Pulse Secure Client. If this option is disabled, then you will not be able to receive install or upgrade prompts from the PCS appliance to the Pulse Secure Client even if the web browser was not used to launch it. See KB25867 - [Pulse] How can I enable, disable or suppress Pulse Secure Desktop client install or upgrade from the Pulse Connect Secure? for more details.
   
   NOTE: A bound endpoint receives connection set options and connections from its binding server, but it can have its Pulse Secure Client software upgraded from any PCS Server that has the automatic upgrade option enabled. During a client software upgrade, the client loses network connectivity temporarily as the driver is upgraded
   
    
4. Are administrator privileges required to install, un-install, or upgrade Pulse Secure Desktop Client?

   Yes, administrator privileges are required for the initial install or un-installations of Pulse Secure Client on Windows and Mac OS. However, the Installer Service is built-in component for Pulse Secure Client on Windows by default and will be used for subsequent upgrades when you connect to PCS directly or from the web. The built-in Installer Service is not available for Pulse Secure Client on Mac OS, so administrator privileges will be required for the initial install, as well as for un-install and subsequent upgrades.

   
    

PCS Legacy client

1. What are the methods which I can use to deploy the legacy PCS client components?
   • Web install
   • Standalone application installer
   
    
2. Is there a recommended method for installing or upgrading legacy clients?

   There are benefits and disadvantages to both methods. We recommend that you choose whatever option best suites your organization's needs. See the following documentation for more information: 
   Pulse Connect Secure Administration Guide Part 4: Remote Access and Part 5, Chapter 29: General System Management under "Downloading Application Installers"

3. How can I deploy PCS client components using the standalone application installers?
   • Distribute the file to client machines using software distribution tools. This option enables you to install an application or service on client machines whose users do not have administrator privileges or permissions, which privilieges are required to install the application or service.
   • Post the executable in a secure repository so that users with the proper administrator rights may download and install the appropriate version.
   • Download and execute a script that automatically retrieves the proper version of the installer from an FTP server.
   
    
4. Are administrator privileges required to install, un-install, or upgrade the legacy PCS client components?

   This depends on the component in question. Please see KB9085 - [Pulse] What are the required permissions to install and run Pulse Connect Secure legacy client components or Pulse Secure Desktop client? for more information.

Pulse Secure Installer Service

1. What is the Pulse Secure Installer Service, and what is the benefit of using it?

   The standalone Installer Service client is available as standalone installer and is also included by default as a built-in component for Pulse Secure client for Windows. The Installer Service standalone client will be invoked for both the legacy PCS clients and the initial install of Pulse Secure Desktop Client on Windows. However, Pulse Secure Client invokes its own built-in Installer Service component for subsequent upgrades, so the Installer Service standalone client install is not required. Once the Installer Service is installed using admin privileges, users can download, install, upgrade, and run Pulse Secure client-side components on Windows machines as restricted users.

2. How does Installer Service work?

   In order to perform tasks that require administrator privileges, the Installer Service runs under the client’s Local System account, which is a powerful account with full access to the system, and registers itself with Windows’ Service Control Manager (SCM). The service starts automatically on install and during client system start up.

    

3. Will Installer Service be invoked when I install, uninstall, or upgrade the standalone application installers?

   No, Installer Service will only be invoked when you attempt to install or uninstall a PCS client component from the Web. This is because Installer Service standalone client can only be invoked by an Active-X control or a Java applet running inside the user’s Web browser. The Active-X control or Java applet communicates the details of the installation processes to be performed through a secure channel between the PCS Appliance and the client system. 

4. How can I uninstall PCS client components from the Web when Installer Service is installed?

   Login to the web as a user, select Preferences from the user toolbar, if enabled. Applications available for un-installation will be listed under the Applications tab. 

5. What is required in order to install Installer Service?
   • Administrator privileges are required to install the Installer Service. For additional information, see the Client Side Changes Guide listed under the software release at PCS Documentation & Software .
   • Ensure the Microsoft Windows Installer exists on the client system prior to installing the Installer Service.
   • The end users’ client systems must contain either a valid and enabled Java Runtime Engine (JRE) or a current PCS Appliance ActiveX control. If the client systems do not contain either of these software components, the end user will be unable to connect to the gateway. If there is no JRE on the end users’ client systems, download an appropriate installer package from Maintenance > System > Installers.
6. Where can I download the standalone application installers?

   You can download the specific application(s) and/or Pulse Secure Installer Service from in the PCS admin Console (Maintenance > System > Installers).