# Agent Installation

The SailPoint Disconnected Application Agent is a Windows service that SailPoint uses to replay recorded operations. SailPoint sends a request to the agent. The agent opens a browser on the Windows host, runs the recorded steps, and returns the result. The browser stays on your network, and the managed system does not need to be reachable from the internet.

The agent accepts TLS connections only. There is no plaintext port. The agent must run as a dedicated unprivileged service account. It does not run as SYSTEM. For more information, refer to [Configuring TLS and Client Authentication](<https://documentation.sailpoint.com/connectors/disconnected_application/va/help/tls_client_auth_config.html>).

## Prerequisites

Before you install `SpDisconAppSvc.exe`, prepare a dedicated Windows Server virtual machine. The virtual machine must be able to reach the managed system, and the virtual appliance must be able to reach the virtual machine on the configured TLS port.

### Software Requirements

#### Operating Systems

- Microsoft Windows Server 2025
- Microsoft Windows Server 2022
- Microsoft Windows Server 2019
- Microsoft Windows Server 2016

#### .NET Framework

- .NET Framework version 4.8 and later

### Hardware Requirements

| Component | Recommended Hardware Requirement | Minimum Hardware Requirement |
| --- | --- | --- |
| CPU | 8-Core | 4-Core |
| RAM | 16 GB | 8 GB |
| Free Disk Space | 50 GB | 250 MB |

- A dedicated service account used only by the SailPoint Disconnected Application Agent. The account must be a standard user whose only group membership is **Users**. Do not use an administrator account, a personal account, or SYSTEM.
- Internet access on the host for the first runtime install, or pre-staged files for an offline install.
- A TLS server certificate in **Local Computer \> Personal**, with a subject or SAN that matches the host name. The service account needs **Read** on the private key. If the certificate is self-signed, also place it in **Local Computer \> Trusted Root Certification Authorities**.
- The Windows account that SailPoint uses to call the SailPoint Disconnected Application Agent. For more information, refer to [Configuring TLS and Client Authentication](<https://documentation.sailpoint.com/connectors/disconnected_application/va/help/tls_client_auth_config.html>).

## Service Account Permissions

The service account requires the following permissions:

| Permission | Location | Granted by |
| --- | --- | --- |
| Log on as a service | Local security policy | Administrator |
| Full Control on the SailPoint Disconnected Application Agent registry key | Registry | Administrator |
| Modify on the log folder | `%ProgramData%\SailPoint\<instance>` | Granted by `--service-account` |
| Read on the TLS private key | Certificate store | Administrator |
| Write on the account temp folder | Account temp folder | Usually already present |

To print the required permissions for the installed instance, run the following command:

```text
SpDisconAppSvc.exe --required-permissions
```

> [!CAUTION]
>
> `--service-account` records the account. It does not grant Log on as a service. Missing that right causes Windows error 1069.

> [!CAUTION]
>
> Do not install the SailPoint Disconnected Application Agent under `C:\Users\<name>\`. Use a system path such as `C:\SailPoint\SpDisconAppSvc`. Do not give the service account write access to the install folder.

## Downloading Agent

> [!NOTE]
>
> You are only entitled to download components for which you have an active license with SailPoint. The availability of a component for download does not grant you a license to use a component or entitle you to use a component for which you do not have an active license. Contact your SailPoint Account Representative or Customer Success Manager (CSM) for more information.

1. Go to **Agent Settings** and select **Download Agent**.
2. Unzip the downloaded `SpDisconAppSvc-<version>.zip` archive to a system location. For example, `C:\SailPoint\SpDisconAppSvc`.
3. Open the DLL properties and confirm that the files are trusted. Unblock the files if needed.

## Installing Agent

Complete the following steps from an elevated Command Prompt. After you start the service, the SailPoint Disconnected Application Agent runs as the service account.

The SailPoint Disconnected Application Agent does not include a browser. Before automation can run, install the browser runtime (Node.js, Playwright, and Chromium) on the host. You do not download these components by hand. One SailPoint Disconnected Application Agent command installs them.

1. Create the dedicated service account as a standard user whose only group membership is **Users**.
2. Install the browser runtime. This step requires internet access, or use `--offline <DIR>` for a host without internet access:

   ```text
   SpDisconAppSvc.exe --rpa-init
   ```
3. Install the Windows service:

   ```text
   SpDisconAppSvc.exe -i
   ```
4. Set the service account. You are prompted for the password:

   ```text
   SpDisconAppSvc.exe --service-account .\svc-rpa-agent
   ```
5. Grant Log on as a service, registry Full Control, and Read on the certificate private key.
6. Register the SailPoint caller. At least one caller is required, or the service does not start:

   ```text
   SpDisconAppSvc.exe -a DOMAIN\user
   ```
7. Verify the configuration, and then start the service:

   ```text
   SpDisconAppSvc.exe --show-config
   ```

   ```text
   SpDisconAppSvc.exe -s
   ```

`--show-config` prints `Ready to start.` or lists what is still missing. Starting the service is the real test. Failures go to the trace file and the Windows event log.

`--rpa-init` must complete before automation can run. Use `--rpa-update` later to switch only if the self-test passes. Use `--rollback` to return to the previous stack.

## Useful Commands

| Command | Purpose |
| --- | --- |
| `SpDisconAppSvc.exe -i` / `-u` | Install or uninstall |
| `SpDisconAppSvc.exe -s` / `-k` / `-t` | Start, stop, or restart |
| `SpDisconAppSvc.exe -p <port>` | TLS listen port. A restart is required. |
| `SpDisconAppSvc.exe -a DOMAIN\user` | Register a caller |
| `SpDisconAppSvc.exe --rpa-init` | Install Node.js, Playwright, and Chromium |
| `SpDisconAppSvc.exe --offline <DIR>` | Offline runtime install |
| `SpDisconAppSvc.exe --show-config` | Configuration and readiness |
| `SpDisconAppSvc.exe -h` | Help. Use this command if the available options differ. |

## Troubleshooting

| Symptom | Resolution |
| --- | --- |
| Error 1069, logon failure | Grant Log on as a service, or correct the password. |
| Access is denied. The trace file is empty. | Reinstall outside `C:\Users\`. |
| Start times out after about 30 seconds. The trace file is empty. | The service account cannot write the registry key. Check Event Viewer. This is common after a reinstall. |
| TLS error mentions the certificate | Grant Read on the private key. |
| No certificate found, but it is in the store | Place the self-signed certificate in Trusted Root Certification Authorities. |
| Provisioning or automation error | Run `--rpa-init` to completion. |
| Name or port already in use on reinstall | Close Services and Event Viewer, and then retry. |