What is WAPT?
WAPT is a fleet management and software deployment solution for Windows operating systems. Inspired by Debian's apt package manager, WAPT lets you create, deploy, update and remove software across a fleet of computers in a centralized and automated way. It is a powerful open-source alternative to solutions like Microsoft SCCM.
Why use WAPT?
Centralized management: A single console to see the state of your fleet, the installed software, and the updates that are needed.
Automation: Deploy a piece of software to 500 machines in a few clicks. Updates are handled the same way.
Simple package creation: WAPT provides tools to easily build software packages (.wapt) from existing installers (.msi, .exe).
Dynamic inventory: Get a complete and up-to-date hardware and software inventory of your fleet.
Security: Packages are digitally signed, ensuring that only approved packages can be installed.
Prerequisites
WAPT server: A Windows or Linux server. For this guide, we assume a server running Debian/Ubuntu.
Client machines: Windows machines to manage.
Network: Clients must be able to communicate with the server over the HTTP/HTTPS ports.
Premium Content
This advanced tutorial is reserved for premium members.
Cybersecurity and Linux administration expert. I share my knowledge through free tutorials and training to help system administrators and developers secure their infrastructures.
Can the WAPT server run on Linux if all the clients are Windows?
Yes, and that is exactly the scenario the official installation script targets: the server runs on Debian or Ubuntu with Nginx and PostgreSQL, and only the managed workstations are Windows. The single constraint is on the network side, since clients must be able to reach the server over HTTP/HTTPS. A Windows server remains possible if your infrastructure requires it, and the agent side behaves identically.
How do I roll the agent out to hundreds of machines without visiting each one?
The two methods used in production are an Active Directory GPO that pushes waptagent.exe, or a logon script executed when the session opens. Manual installation is only for the first tests, on two or three machines, to confirm that a workstation really does appear in the console. Machines then show up in the inventory on their own as the rollout progresses.
I triggered a package installation but nothing happens on the workstation, has it failed?
Not necessarily: agents apply their tasks during their next update cycle, not instantly. To settle it immediately, select the machine in the console and use the right-click "Force update" action. If still nothing happens, the problem is further upstream: no agent installed, an agent that does not point at your server, or HTTP/HTTPS traffic blocked between the workstation and the server.
How do I add a shortcut or a registry key on top of the standard installation?
By editing the setup.py file in the package folder generated by the wizard. It is standard Python, so you add the shortcut creation, the registry write or any other post-installation action there. You then have to re-import the package from the console so it is uploaded to the repository and signed again. Without that new signature, agents will not accept the modified version.
What happens if the signing private key is lost or leaked?
If it is lost, you can no longer sign a new package, so nothing can be deployed until a new certificate is in place. If it leaks, it is far worse: whoever holds it can sign any package and have it installed across the whole fleet, since agents accept anything signed by a trusted key. WAPT makes you generate this certificate when you create your first package, so back the private key up off the server and treat it as the most sensitive secret in the infrastructure.
Comments