# IQService Commands
In addition to the commands -i to install and -s to start, other command line options with IQService include:
| Command Line Options | Description |
| --- | --- |
| `-b` | Skips the installation of secondary IQService. This is recommended to use for IQService instances installed on a load balanced deployment. |
| `-d` | Run in console mode |
| `-i` | Install a service |
| `-k` | Stop the service |
| `-m` | Allows you to pick the best certificate for TLS communication (when there are multiple) from the IQService host personal folder.
To pick the certificate with a matching subject name: `IQService.exe -m DNS:`
To pick the certificate with a matching serial number: `IQService.exe -m SN:`
To pick the certificate with a matching subject name and serial number: `IQService.exe -m DNS: -m SN:` |
| `-p` | Update the port (requires restart)
**Important**
If you are updating your IQService instance to use a TLS port, disable the existing non-TLS port. For more information, refer to [Disabling Non-TLS Communication for an Existing IQService Instance]().
**Warning**
To enhance security, it is mandatory to configure the TLS for IQService. If you continue using non-TLS configuration, any before and after script execution will be disabled to safeguard your environment. Remove non-TLS configuration for IQService to execute any rules and scripts. |
| `-r` | Remove the service |
| `-u` | Uninstall the service. Removes the service components and clears the registry entries. |
| `-s` | Start the service |
| `-t` | Restart (stop/start) the service |
| `-v` | Print version information |
| `-l ` | Trace Level 0-3; 0=off 1=error 2=info 3=debug |
| `-f ` | Trace the file name. Defaults to system32 directory. Enter the full path with filename to log to a different path.
For example: `iqservice -l 3 -f "C:\Sailpoint\IQService\iqtrace.log"` |
| `-a { \\| list}` | Registers a domain user for Client Authentication. Pass domain user name in msDS-PrincipalName (domain\\user) format. Multiple users can be registered in single command by separating users with semicolon ( ; ). This command appends the users to already registered users list if exist.
For example: `-a "Acme\John.Smith; Acme\Joe.Phillips"`
Ensure that the exact same user name is configured on the source for this feature to work.
To list already registered users, run the command with "list" parameter. For example: `-a list` |
| `-x { \\| list}` | De-registers a user from Client Authentication Users List. Pass domain user name in msDS-PrincipalName (domain\\user) format. Multiple users can be registered in single command by separating users with semicolon ( ; ).
For example: `-x "Acme\John.Smith; Acme\Joe.Phillips"`
To list already registered users, run the command with "list" parameter. For example: `-x list` |
| `-o ` | TLS port for communication between IQService and SailPoint. This port accepts communication over TLS only.
**Important**
TLS is mandatory. Do not disable the TLS port. |
| `-j ` | Enforce the specific TLS version for communication between IQService and SailPoint. Supported values are: TLS1.2, TLS1.1, TLS1.0. Default is TLS1.2. |
| `-y ` | IQService update availability check interval. |
| `-z tcp(s)://:` | Configures the UpdateService details that IQService communicates with. |
| `-z enableClientAuth` | Enables the certificate-based client authentication between UpdateService and IQService. Configuring this will require an X.509 certificate be present in the personal certificate store of the IQService machine with EKU having Client Authentication. |
| `-z disableClientAuth` | Disables the certificate-based client authentication. Configuring this will not provide a client certificate during the TLS handshake while communicating with UpdateService.
**Warning**
If UpdateService is configured to communicate with only trusted clients, then this configuration will break the communication channel. |
| `-? \\| h:` | This is for help output.
Running `IQService.exe -?` or `IQService.exe -h` displays command line options.
**Caution**
To enhance security, it is mandatory to configure TLS for IQService. If you continue using a non-TLS configuration, before and after script execution is disabled to safeguard your environment.
Additionally, the following feature is also disabled in a non-TLS configuration: Using gMSA as a Service Account |
| `-w` | Allow the IP addresses or FQDNs of additional client hosts configured for an instance. Separate multiple clients with semicolons. For example, `IQService.exe -w 10.10.20.30;LB.domain.com`.
To whitelist the IPs and FQDN, run the command with `IP/FQDN`. For example, `IQService.exe -w {}`
To list the whitelisted IPs and FQDN, run the command with the `list` parameter. For example, `IQService.exe -w list`
To delete the whitelisted IPs and FQDN, run the command with the `delete` parameter. For example, `IQService.exe -w delete` |
| `-g` | View the enabled or disabled status of IQService services: `IQService.exe -g`
Enable a service: `IQService.exe -g --enable `
This applies to ScriptExecutor and GMSAPasswordData only.
Disable a service: `IQService.exe -g --disable `
This applies to ScriptExecutor and GMSAPasswordData only.
**Note**
For service descriptions and security changes, refer to [Option to Disable Services](). |
## tlsVersion Configuration
IQService supports the tlsVersion configuration `default`. To enable it, run the `IQService.exe -j default` command.
With this configuration the operating system selects the best available protocol. This configuration requires that `SystemDefaultTlsVersions` is enabled on the IQService machine. If it is not enabled, then IQService falls back to the highest common supported version from the predefined list of TLS versions.