Repairing the Client Installation

A repair means removing the installed client and installing the current version again. It is the fastest way to rule out a damaged installation, and it is worth doing before spending time on a deeper analysis whenever the client misbehaves in a way that does not look like a configuration problem.

Your device stays enrolled

The client's configuration is not part of the installation package, so an uninstall leaves it in place. After the repair the device comes back as the same client — you do not have to enroll it again, and no duplicate entry appears in the Admin Console.

The one exception is a deliberate clean install, described under Starting from scratch.

When a repair helps

• A file was removed by antivirus software. Endpoint protection occasionally quarantines a file below C:\Program Files\XplicitTrust\, usually xtUpdateService.exe. The client then keeps running with a piece missing — most visibly, it stops updating itself.
• The client stopped updating and stays on an old version, while other devices in the same tenant move on.
• A service is not running. The client shows as offline, or nothing happens when you start it.
• An update was interrupted, for example by a shutdown, and left a mixed-version installation behind.
• Before contacting support, to establish a known-good baseline — it saves a round trip if the problem turns out to be a damaged installation.

When it does not help

A repair only touches the software on the device. Everything decided in your tenant comes straight back afterwards, so a repair changes nothing if:

• a resource is unreachable because of policies, gateway or DNS configuration;
• sign-in fails or repeats — that is an identity-provider matter, see Supported IdPs;
• connectivity is degraded by a firewall or by SSL inspection, see the FAQ.

In those cases a repair costs you a maintenance window without changing anything.

Windows

Using the repair script

We provide a PowerShell script that performs the whole procedure:

https://dl.xplicittrust.com/Repair-XplicitTrustAgent.ps1

1) Download the script.

2) Right-click the downloaded file and choose Run with PowerShell.

3) Confirm the Windows prompt asking for administrator rights. The script requests them itself; it cannot do its work without them.

The window stays open when the script is finished so you can read the result.

The script performs these steps:

• stops the XplicitTrust services;
• uninstalls every installed XplicitTrust package;
• removes service registrations that the uninstall left behind — a leftover registration is a common reason for a manual reinstall to fail;
• looks up the current release and downloads xtna-agent.msi;
• checks that the download carries a valid XplicitTrust signature;
• installs it silently;
• verifies that all services and program files are back, and reports what it found.

A log of every step, together with a copy of your configuration taken before the uninstall, is written to %TEMP%\xtna-reinstall. Please attach that folder if you contact support afterwards.

If nothing happens when you run the script

Windows blocks script files that were downloaded from the internet. Either right-click the file, choose Properties and tick Unblock, or run the following in an administrative PowerShell in the download folder:

Unblock-File .\Repair-XplicitTrustAgent.ps1

Options

The script can be started from an administrative PowerShell with additional options:

Option	Effect
-PurgeConfig	Also removes the configuration. The device has to be enrolled again afterwards.
-NoPause	Does not wait for a keypress at the end — for unattended use through a management tool.
-MsiUrl <url>	Installs the package from this address instead of the current release.

powershell -ExecutionPolicy Bypass -File .\Repair-XplicitTrustAgent.ps1 -PurgeConfig

Doing it manually

The same procedure by hand, if you prefer not to run a downloaded script:

1) Open Apps & Features and uninstall XplicitTrust Network Access.

2) Check in an administrative PowerShell that no service is left behind:

Get-Service xtService, xtUpdateService, xtWatchdog

Any service still listed has to be removed before reinstalling, for example sc.exe delete xtService.

3) Download the current client from https://dl.xplicittrust.com/xtna-agent.msi and install it by double-clicking it.

4) Verify that the services are running and that C:\Program Files\XplicitTrust\ contains the program files again.

After an antivirus quarantine

If the cause was antivirus software, the repair alone is not enough — the file will be removed again on the next scan. Add an exception for

C:\Program Files\XplicitTrust\

in your endpoint protection, and please report the detection to support(at)xplicittrust.com with the exact detection name. These findings are false positives on our auto-update component, and we file them with the vendors so the detection disappears for everyone.

macOS and Linux

There is no repair script for these platforms; perform the two documented steps in order:

1) Uninstall the client for your platform.

2) Install it again: macOS, Linux.

As on Windows, the configuration below /etc/XplicitTrust/ is kept unless you delete it explicitly, so the device stays enrolled.

Starting from scratch

If you want the device to be enrolled from scratch — for instance because it should appear as a different client, or because you are handing the machine to someone else — remove the configuration as well:

WindowsmacOS / Linux

powershell -ExecutionPolicy Bypass -File .\Repair-XplicitTrustAgent.ps1 -PurgeConfig

Or delete C:\Program Files\XplicitTrust\config after the uninstall.

Delete /etc/XplicitTrust/ after the uninstall.

The device then has to be configured again as described on the installation page for your platform, and the old client entry can be removed in the Admin Console.

If the repair did not help

Please contact support(at)xplicittrust.com and include:

• what the client does now, and since when;
• the %TEMP%\xtna-reinstall folder on Windows;
• the output of the connectivity check:

xtna-util -connectivity -domain <email domain of your tenant>