Home

WAPT: Windows Application Deployment

System
Difficulty: Advanced
4 min read

Detailed tutorial to install and configure WAPT, an open-source application deployment and management solution for Windows environments.

Back to tutorials

Key takeaways

  • WAPT brings the logic of apt to the Windows world: a server hosting a repository of signed .wapt packages, an agent on every machine, and a central management console. It is an open-source alternative to Microsoft SCCM.
  • Installing the server is scripted by the vendor Tranquil IT: wget https://wapt.fr/waptserver.sh, chmod +x waptserver.sh, then sudo ./waptserver.sh installs and configures the components (Nginx, PostgreSQL). The console is then reachable at https://server_ip.
  • The waptagent.exe agent must be downloaded from your own console: it comes pre-configured to point at your server. Once installed, the machine shows up in the inventory on its own.
  • A package is created by right-clicking an .exe or .msi and choosing "Create a WAPT package with...". The wizard generates a folder containing a setup.py, a standard Python script you can extend (shortcuts, registry keys).
  • The whole security model rests on package signing: importing through the console signs the package with your private key, and agents only install signed packages. That private key is effectively administrator access to the entire fleet.
What is WAPT?
WAPT is a fleet management and software deployment solution for Windows operating systems. Inspired by Debian's apt package manager, WAPT lets you create, deploy, update and remove software across a fleet of computers in a centralized and automated way. It is a powerful open-source alternative to solutions like Microsoft SCCM.

Why use WAPT?

  • Centralized management: A single console to see the state of your fleet, the installed software, and the updates that are needed.
  • Automation: Deploy a piece of software to 500 machines in a few clicks. Updates are handled the same way.
  • Simple package creation: WAPT provides tools to easily build software packages (.wapt) from existing installers (.msi, .exe).
  • Dynamic inventory: Get a complete and up-to-date hardware and software inventory of your fleet.
  • Security: Packages are digitally signed, ensuring that only approved packages can be installed.

Prerequisites

  • WAPT server: A Windows or Linux server. For this guide, we assume a server running Debian/Ubuntu.
  • Client machines: Windows machines to manage.
  • Network: Clients must be able to communicate with the server over the HTTP/HTTPS ports.

Premium Content

This advanced tutorial is reserved for premium members.

9,90€ / month
  • All advanced tutorials
  • New content every week
  • Progress tracking
  • Cancel anytime
Log in Create an account
MR

Written by

Morgann Riu

Cybersecurity and Linux administration expert. I share my knowledge through free tutorials and training to help system administrators and developers secure their infrastructures.

My profile LinkedIn GitHub

Frequently asked questions

Can the WAPT server run on Linux if all the clients are Windows?
Yes, and that is exactly the scenario the official installation script targets: the server runs on Debian or Ubuntu with Nginx and PostgreSQL, and only the managed workstations are Windows. The single constraint is on the network side, since clients must be able to reach the server over HTTP/HTTPS. A Windows server remains possible if your infrastructure requires it, and the agent side behaves identically.
How do I roll the agent out to hundreds of machines without visiting each one?
The two methods used in production are an Active Directory GPO that pushes waptagent.exe, or a logon script executed when the session opens. Manual installation is only for the first tests, on two or three machines, to confirm that a workstation really does appear in the console. Machines then show up in the inventory on their own as the rollout progresses.
I triggered a package installation but nothing happens on the workstation, has it failed?
Not necessarily: agents apply their tasks during their next update cycle, not instantly. To settle it immediately, select the machine in the console and use the right-click "Force update" action. If still nothing happens, the problem is further upstream: no agent installed, an agent that does not point at your server, or HTTP/HTTPS traffic blocked between the workstation and the server.
How do I add a shortcut or a registry key on top of the standard installation?
By editing the setup.py file in the package folder generated by the wizard. It is standard Python, so you add the shortcut creation, the registry write or any other post-installation action there. You then have to re-import the package from the console so it is uploaded to the repository and signed again. Without that new signature, agents will not accept the modified version.
What happens if the signing private key is lost or leaked?
If it is lost, you can no longer sign a new package, so nothing can be deployed until a new certificate is in place. If it leaks, it is far worse: whoever holds it can sign any package and have it installed across the whole fleet, since agents accept anything signed by a trusted key. WAPT makes you generate this certificate when you create your first package, so back the private key up off the server and treat it as the most sensitive secret in the infrastructure.

Share this tutorial

X LinkedIn WhatsApp

Did you enjoy this article?

Was this article helpful?

Thanks for your feedback!

Comments

Recommended for you

Linux

FOG Project : Déploiement d'images système

 Linux

GPO sur Windows Server : Gestion centralisée

 Linux

JAMF : Gestion de parc d'appareils Apple

 DevOps

GitLab CI/CD : Pipeline d\'intégration continue

In-depth article on the topic

Checklist Sécurité Linux

30 points essentiels pour sécuriser un serveur Linux. Recevez aussi les nouveaux tutoriels par email.

Pas de spam. Désabonnement en 1 clic.

← Back to home
↑