Installation

Installation

Installing the Cimian client on a managed Windows endpoint, verifying it works, and removing it again.

If you are coming from Munki: this is the step that corresponds to installing the munkitools package. Like munkitools it drops a set of binaries, registers a recurring background run, and does nothing useful until you point it at a repository. Configuration is a separate step — see Client Configuration.

Requirements

Requirement	Detail
Operating system	Windows 10 1809 (build 10.0.17763) or later, and Windows 11. The GUI components declare a minimum platform of 10.0.17763 and target 10.0.19041. Windows Server builds in the same range work; they are not the primary target.
Architecture	x64 and ARM64. Separate packages are published for each; there is no universal package.
Runtime	None. Every binary is published self-contained, so no .NET runtime needs to be present on the endpoint.
Privileges	Administrator to install. The agent itself runs as SYSTEM via a scheduled task and a service.
Network	Outbound HTTPS to your repository host. Cimian is a pull-only client; nothing needs to reach the endpoint.

Cimian is built on .NET 10 and published as trimmed, self-contained, single-file executables for win-x64 and win-arm64. On ARM64 the ARM64 package is required — the x64 package will install but the agent will then refuse architecture-mismatched payloads.

Distribution formats

Releases publish these artifacts per architecture:

Artifact	Filename pattern	Use
MSI	Cimian-<version>-x64.msi, Cimian-<version>-arm64.msi	The normal install method. Registers the service and scheduled tasks.
NuGet package	CimianTools-<version>-x64.nupkg, CimianTools-<version>-arm64.nupkg	Chocolatey-style deployment.
Raw binaries	Cimian-<version>-x64.zip, Cimian-<version>-arm64.zip	For automation that needs cimiimport.exe or makecatalogs.exe on a build agent without installing the client.
Intune package	.intunewin	Wraps the MSI for Microsoft Intune Win32 app deployment.

Version numbers are build datestamps in yyyy.MM.dd.HHmm form, for example 2026.05.01.0930. The release workflow refuses to publish if the git tag and the version baked into the MSI disagree.

Releases built by the public GitHub workflow are unsigned. Signing happens in a separate pipeline; if your environment enforces code signing, sign the MSI before deployment or build from source with a certificate configured. See Development.

Installing

MSI, interactively or from a script

msiexec.exe /i "Cimian-2026.05.01.0930-x64.msi" /quiet /norestart /l*v "$env:TEMP\cimian-install.log"

Microsoft Intune

Wrap the MSI as a Win32 app.

Field	Value
Install command	msiexec /i "Cimian-<version>-x64.msi" /quiet /norestart
Uninstall command	msiexec /x {ProductCode} /quiet /norestart
Install behaviour	System
Detection rule	MSI product code, or file existence of C:\Program Files\Cimian\managedsoftwareupdate.exe
Requirement rule	Match the architecture of the package you are assigning

Assign the x64 and ARM64 packages to disjoint groups, or gate each with an architecture requirement rule. Assigning both to the same device is the most common cause of a device that reinstalls Cimian on every cycle.

NuGet / Chocolatey

choco install CimianTools --source "https://cimian.example.com/nuget"

What the installer does

Beyond copying files, the package's custom actions perform these steps. They are idempotent — the same actions run on a fresh install and on an upgrade.

1. Verifies that every expected executable is present in the payload: cimiwatcher.exe, managedsoftwareupdate.exe, cimitrigger.exe, cimistatus.exe, cimiimport.exe, cimipkg.exe, makecatalogs.exe, makepkginfo.exe, manifestutil.exe, repoclean.exe, and Managed Software Center.exe. A missing binary fails the install.
2. Prepends C:\Program Files\Cimian to the machine PATH.
3. Installs and starts the CimianWatcher Windows service. If the service is already running it is left alone; if it is present but stopped it is started; if starting fails the service is reinstalled.
4. Registers two scheduled tasks, both running as SYSTEM at highest privileges.

Scheduled tasks

Task name	Command	Schedule	Timeout
Cimian Managed Software Update Hourly	managedsoftwareupdate.exe --auto	First run 5 minutes after install, then every hour indefinitely	4 hours
Cimian Watchdog	managedsoftwareupdate.exe --self-check	First run 10 minutes after install, then every 4 hours	5 minutes

The hourly task has RestartCount 3 at 10-minute intervals, runs hidden, starts when available, may start and continue on battery, and wakes the machine to run.

The 4-hour execution limit is deliberate. A first run on a freshly imaged machine installs the whole manifest, and a single large payload can legitimately take over three hours to download; a shorter limit killed the run every time and those machines never converged. The hourly trigger cannot stack on a long run because MultipleInstances defaults to IgnoreNew.

The Watchdog task exists to catch a Cimian install that has partially disappeared — binaries removed by a cleanup tool, a half-finished uninstall. It writes C:\ProgramData\ManagedInstalls\cimian_selfcheck.json and exits 2 when it finds drift, which inventory tooling can surface as an alert. Its failure is non-fatal to the install: if registration fails the installer warns and continues.

Verifying the install

Confirm the binaries are on PATH and report a version:

managedsoftwareupdate --version

Confirm the service is running:

Get-Service CimianWatcher

Confirm both scheduled tasks exist and are ready:

Get-ScheduledTask -TaskName "Cimian Managed Software Update Hourly", "Cimian Watchdog" | Select-Object TaskName, State

Confirm the installation is intact. This exits 0 when healthy and 2 when a binary is missing:

managedsoftwareupdate --self-check

Show the configuration the client has actually resolved, which is the fastest way to catch a config file that was never delivered:

managedsoftwareupdate --show-config

Once the repository is configured, a check-only run proves end-to-end connectivity without changing anything:

managedsoftwareupdate --checkonly -vv

First run

The hourly task fires 5 minutes after install. To not wait:

Start-ScheduledTask -TaskName "Cimian Managed Software Update Hourly"

Or run a full cycle in the foreground from an elevated prompt:

managedsoftwareupdate --auto -vv

managedsoftwareupdate requires administrator for any run that installs anything. From an unelevated session, use cimitrigger, which obtains elevation itself:

cimitrigger gui

Upgrading

Install the new MSI over the old one. Windows Installer handles the major upgrade; the uninstall custom action is explicitly suppressed during the previous-version removal pass of an upgrade, so the service and scheduled tasks are not torn down and rebuilt for nothing.

Cimian can also update itself from your own repository, which is how most fleets should be doing it. See Self-Update.

Uninstalling

msiexec.exe /x "Cimian-2026.05.01.0930-x64.msi" /quiet /norestart

Or by product code, if you no longer have the MSI:

Get-CimInstance Win32_Product -Filter "Name LIKE 'Cimian%'" | ForEach-Object { msiexec.exe /x $_.IdentifyingNumber /quiet /norestart }

The uninstall custom action, in order:

1. Unregisters the Cimian Managed Software Update Hourly scheduled task.
2. Stops and removes the CimianWatcher service — first through cimiwatcher.exe uninstall, falling back to sc.exe delete CimianWatcher if the binary is already gone. This runs before file removal so the Service Control Manager is not holding a handle that blocks the delete.
3. Terminates any stray Cimian processes, including Managed Software Center.exe in the interactive user's session.

What uninstalling does not do

Uninstalling Cimian removes the agent, not the software the agent installed. Every managed application stays exactly where it is. This mirrors Munki: removing munkitools does not remove managed installs.

State under C:\ProgramData\ManagedInstalls — configuration, logs, cache, reports — is also left behind. Remove it deliberately if you are decommissioning rather than reinstalling:

Remove-Item -Path "C:\ProgramData\ManagedInstalls" -Recurse -Force

If you want the managed software gone too, do that before uninstalling the agent: move the items to managed_uninstalls in the manifest, let a run complete, and only then remove Cimian. See Manifests.

Repository-side tools

The same package installs the repository tools (cimiimport, cimipkg, makepkginfo, makecatalogs, manifestutil, repoclean) on whatever machine you install it on. On an admin workstation or a CI runner that only needs the tools, use the raw-binaries zip instead of the MSI — it avoids registering the service and scheduled tasks on a machine that is not a managed endpoint.

Related pages

• Client Configuration — what to write before the first run
• CLI Reference — every flag on every binary
• Bootstrap Mode — zero-touch provisioning on a new machine
• Troubleshooting — when the first run does not work