Install the MSI
One MSI per PC. Installed with a registration token, it also registers the PC with your app, which gives the PC its own key for push. It asks nobody for U2 until people are added to “U2 Secured Users”.
Get a registration token
- 1In this portal, open the app for your PCs (or create one under Apps), then Machines → Add machines.
- 2Give the token a label, how many hours it stays valid and, if you like, how many PCs may use it. Create token.
- 3Copy the token now: it is shown only once.
Download and check it
Invoke-WebRequest -UseBasicParsing -OutFile u2secured-windows-0.2.0-x64.msi https://u2secured.com/downloads/windows/u2secured-windows-0.2.0-x64.msi
Invoke-WebRequest -UseBasicParsing -OutFile SHA256SUMS https://u2secured.com/downloads/windows/SHA256SUMS
(Get-FileHash u2secured-windows-0.2.0-x64.msi -Algorithm SHA256).Hash.ToLower()
Select-String u2secured-windows-0.2.0-x64.msi SHA256SUMSOr download the installer in a browser from https://u2secured.com/downloads/windows/u2secured-windows-0.2.0-x64.msi and the checksums from https://u2secured.com/downloads/windows/SHA256SUMS. The two hashes must match. https://u2secured.com/downloads/windows/latest.json names the current version.
Version 0.2.0 is not code-signed yet
Windows shows “Unknown publisher” when it runs, and SmartScreen may warn about it. That is expected for 0.2.0: check the SHA-256 against SHA256SUMS before you install. A signed build follows, and this note goes when it ships.
Install and register in one step
msiexec /i u2secured-windows-0.2.0-x64.msi /qn REGISTRATION_TOKEN=rkr_… MACHINE_NAME=reception-pcRun it from an elevated prompt, or push it with your deployment tool. The PC registers during the install, and if registration fails the whole install fails and the PC keeps Windows’ own sign-in. An upgrade or reinstall with the same command on a PC that is already registered skips registration and succeeds, so one command line can go to every PC on every version.
| Property | Default | Meaning |
|---|---|---|
REGISTRATION_TOKEN | — | The rkr_… token from the Machines tab. Kept out of the installer’s log. Without it the PC is installed but not registered, and cannot send pushes until you register it. |
MACHINE_NAME | (computer name) | The PC’s name in the portal and in the phone’s push text. |
API_HOST | https://auth.u2secured.com | The U2 Secured service to use. Only applies when the PC has no configuration yet. |
Keep the token out of PowerShell’s history
A token typed at a PowerShell prompt is saved in plain text in PSReadLine’s history file. Deploy the command with a deployment tool such as Intune or Group Policy, which keeps it out of any shell. If you did type it, delete it from the file named by (Get-PSReadLineOption).HistorySavePath.
Or install first, register after
msiexec /i u2secured-windows-0.2.0-x64.msi
# copy the token in the portal first
$f = "$env:TEMP\u2-token"
Get-Clipboard | Set-Content -NoNewline -Encoding ascii $f
& "$env:ProgramFiles\U2Secured\u2auth-admin.exe" register --name reception-pc --token-file $f
Remove-Item $fInstall the MSI by double-clicking it, or with the first line below, then register from an elevated PowerShell. Copy the token in the portal first: Get-Clipboard writes it to the file, so it is never typed at the prompt. --name is the PC’s name in the portal.
The PC then appears in the app’s Machines tab, with OS windows/amd64.
What the install does
- Puts U2AuthCP.dll, u2auth-pam-helper.exe and u2auth-admin.exe in Program Files\U2Secured.
- Registers the U2 Secured sign-in tile, and a filter that hides Windows’ own tiles.
- Creates the local group “U2 Secured Users”, empty, and the configuration in ProgramData\U2Secured, which only SYSTEM and Administrators can read.
- Registers “U2 Secured” as an Event Log source.
- With a token, registers the PC. Its key is sealed with the PC’s TPM, or with Windows DPAPI on a PC without one.