Windows Install Parameters

Two parameters are required and the rest are tuning. Pass them on the installer command line, or set them through whichever MDM is doing the deployment.

Check the version column before you rely on one. Passing a parameter to a forwarder older than the version that introduced it is accepted silently and does nothing, which is difficult to notice at fleet scale and looks like the setting not working rather than not existing.

📘

"Bundled installer default" is not the same as "the forwarder's default"

CPULIMIT and NETLIMIT are the two where this matters. The bundled installer supplies values for them even when you pass nothing, so a bundled install lands with a 5% CPU cap and a roughly 50 Mbps upload cap written to the machine. Install the standalone MSI directly and neither value is written, and the service falls back to no limit on both. If you care about the cap, set it explicitly rather than relying on which installer someone used.

The ones worth thinking about

NETLIMIT=0 means unlimited, not zero. That is the reading people get backwards, and it is the value the forwarder falls back to when nothing is set. The bundled installer does set something -- 6103 KB per second, roughly 50 Mbps -- so a bundled install is capped whether or not you asked for it. Lower it on constrained links; set it to 0 to lift the cap entirely.

CPULIMIT arrives at 5 from the bundled installer, which is already conservative. It is a percentage, and lowering it further mostly extends how long the initial backscan takes rather than making the machine noticeably happier -- the forwarder is I/O-bound during a backscan, not CPU-bound. IOPSLIMIT and MBPSLIMIT are the levers that actually relieve a struggling disk. See Forwarder Performance Tuning before reaching for any of them.

DOSCAN=0 skips the initial backscan, which means the machine's existing files are never collected. That is occasionally what you want during a staged rollout, and it permanently limits what any later YARA rule can find on that host, because a rule cannot reach a file that was never collected. See Force or Skip a Backscan.

ENABLESLEEPMODE=1 installs a forwarder that reports nothing until it is woken. Useful for pre-staging a golden image. See Sleep and Wake Forwarders.

The machine's identity is not set here. Windows derives it as <hostname>@<MAC> of the primary adapter, falling back to the hostname alone when the MAC cannot be read -- which means two same-named machines can end up sharing one asset. Override it with the STAIRWELL_REGISTRATION_KEY machine environment variable, not an installer property, and set it before the first registration. See Asset Identifiers.

A MAINTENANCE_TOKEN is issued for 14 days by default, and is scoped to one environment. Baking one into an installer package or an MDM policy means the package stops working two weeks later, and the failure reads like a broken installer rather than an expired credential. See Anti-Tamper on macOS for what the token is for.

What should I read next?

• Install on Windows, for the installation itself.
• Forwarder Performance Tuning, for the resource parameters in context.
• Asset Registration Rules, for putting the machine in the right group on arrival.