# Install NexusGuard on Windows and Linux These steps use the compiled customer installers. Do not copy the private source repository or the vendor signing-key bundle onto student PCs. ## Before the first installation Use x86-64 Windows or a supported x86-64 Linux graphical desktop (the Linux release is built on Ubuntu 22.04). Update packages are signed; the Windows installer itself is not Authenticode-signed. Lab IT should validate the download under its normal software policy. Keep the Admin and Agents on a network that can reach the Admin's TCP port 8765. Automatic local discovery uses UDP 5353 multicast; across routed networks, use a stable DNS hostname managed by lab IT. The Admin PC requires internet access for initial activation and ongoing subscription verification. Student PCs communicate with the licensed Admin over the local network. Internet access is also needed to download signed application updates. Close an old Admin application before opening the new Admin. Stop separately configured legacy agent services; the installer migrates the known 5.x per-user startup only. Install in the same user account as before to retain its licence, pairing and attendance data. ## 1. Windows Admin PC 1. Download `NexusGuard_Setup_5.2.7.exe` to Downloads on the instructor's Windows PC. 2. Double-click the installer. No terminal, Python installation or `C:\NexusGuard` directory is required. 3. In NexusGuard setup, choose **admin** from the role list and click **Install and Start**. Agent address/code fields are not needed for Admin. 4. Approve the scoped Windows firewall configuration if prompted. It allows the local lab hub on TCP 8765 and discovery on UDP 5353 for Private/Domain networks and the local subnet. 5. The dashboard opens in a browser. Enter the subscription activation key issued by Arventiq Labs. Management remains locked until the licence is verified. Later launches verify the saved key automatically. 6. Open **Pairing Guide** and note the actual eight-character pairing code. 7. Keep the Admin application running during the lab. On later days, open **NexusGuard Admin** from the Windows Start Menu. The Admin application files are at `%LOCALAPPDATA%\NexusGuardNative\admin`, usually `C:\Users\YOUR_ACCOUNT\AppData\Local\NexusGuardNative\admin`. Existing old source files can remain at `C:\NexusGuard` during pilot migration; the native application does not run from that folder. ## 2. Linux student/Agent PC 1. Sign into the Linux graphical desktop as the account students will use. 2. Download/copy `NexusGuard_Setup_5.2.9.run` to that account's Downloads folder. 3. Open a terminal in the folder containing the file. For the usual English Downloads folder: ```bash cd "$HOME/Downloads" bash NexusGuard_Setup_5.2.9.run ``` If Downloads has a localized/custom name, open that actual folder in the file manager and choose **Open in Terminal**; run the second command there. Do not run the desktop installer with `sudo`. 4. Choose **agent**. Keep Admin address as **auto** for same-network discovery, or enter your lab's stable Admin DNS hostname. 5. Enter the code shown on the Windows Admin's Pairing Guide. Click **Install and Start**. 6. Enter the student's name and USN when the attendance/identity form appears. 7. Confirm the PC appears online in the Windows Admin dashboard. Agent files are at `~/.local/share/nexusguard-native/agent` (or the configured XDG data directory). The application menu gets **NexusGuard Agent**, and a desktop autostart entry is installed for that user. ## 3. Optional Windows student PC Run the same Windows EXE in the student's Windows account. Choose **agent**, use **auto** or the stable Admin hostname, and enter the pairing code. Its files are at `%LOCALAPPDATA%\NexusGuardNative\agent` and it starts after that account signs in. ## 4. Restart/reconnection check Restart one pilot Agent PC, then sign into its desktop. NexusGuard should start automatically, present the identity form and reconnect to its paired Admin. If the Admin IP changes on the same discovery-enabled network, the Agent rediscovers it. If the Admin is off or unreachable, the Agent retries; a running/reachable Admin is still required for an online connection. Autostart is per user after graphical sign-in, not a machine-wide pre-login service. Another OS user needs its own installation/startup configuration. Discovery cannot cross every VLAN or router automatically; lab IT must provide appropriate routing/DNS where multicast does not reach. ## 5. Routine software updates To switch an existing Linux installation to the new release feed, run `NexusGuard_Setup_5.2.9.run` once in the same desktop account. Future updates use the feed configured in the paired Admin. Use **Updates** in the licensed Admin dashboard: 1. **Check for updates** checks the signed Windows/Linux releases once. No installed device makes periodic release checks. 2. **Update Admin and connected devices** downloads each required platform package once to the Admin, then sends it to connected Agents over the lab connection. Three transfers run at a time. Devices verify the signatures and file hashes, then restart their applications when exams, forms and operations are idle. The Admin waits until Agent delivery finishes; close completed attendance rounds to allow its restart. 3. **Check versions** confirms each connected device's actual running version and startup verification. Delivered, waiting, offline and failed devices are distinguished in the table. Reconnect devices that missed delivery and click Update again. Only the Admin needs internet access for future update checks and downloads. Agent PCs receive approved packages through their paired Admin. Licence validation continues to require an online Admin. Your saved licence, pairing and attendance data are retained. **One-time upgrade:** working older native installations can receive 5.2.6 through their existing updater (about every 15 minutes while running online and idle), or use the current installer in the same desktop account. The Admin-controlled LAN update protocol becomes available after both roles reach 5.2.6. Older script installations or failed initial installations need the current installer. ## Installation and recovery No special installation path, Python installation or PowerShell commands are required on Windows. Double-click the installer, choose Admin or Agent, and click **Install and Start**. Admin does not require an IP address or pairing code. Agent shows those fields after you choose Agent. Setup waits for healthy startup before showing **Finish**. If installation cannot finish, setup retains your settings, captures diagnostics automatically and offers **Retry installation** and **Copy diagnostic report**. Use these controls in the installer; do not delete application folders or edit state files. ### Upgrading or repairing an existing installation Close NexusGuard, run the latest installer in the same desktop account, select the installed role and click **Install and Start**. Setup selects the bundled signed release before launching it, including when an older version is already installed. Reinstalling the same release can restore missing or changed application files. Licence keys, pairing and attendance are retained. Do not delete application folders or edit state files. An Arventiq Labs subscription activation key is compulsory. The eight-character Agent pairing code does not activate a subscription. Expired, revoked, invalid or unverifiable subscriptions keep management locked. Keep the Admin PC connected to the internet for verification; licence renewals are managed by Arventiq Labs. ## Troubleshooting | Symptom | Check | | --- | --- | | Admin does not start | Use the current installer and click **Retry installation**; use **Copy diagnostic report** if setup cannot finish | | Licence verification required | Connect Admin to the internet, check the activation key and subscription validity, or contact Arventiq Labs for renewal | | Agent stays offline | Admin is running; pairing code matches; TCP 8765 is reachable; mDNS UDP 5353 is permitted or stable DNS is configured | | Agent does not start after restart | Sign into the same installed desktop account; check its NexusGuard autostart entry | | Repeated/duplicate PCs | Stop old manually installed supervisors/services and run one Agent per account | | New update waits | Finish active file/control jobs, submit/close student forms and close completed attendance rounds | | Missing update feed | Connect the Admin to the internet and click Check for updates; contact Arventiq Labs if a platform feed remains unavailable | | Linux live screen or remote input unavailable | Open Live Monitor and complete the desktop sharing prompt. On Wayland desktops that support saved approval, lab IT can approve viewing once during setup. Remote control asks for separate approval. On Xorg, run the Agent in the signed-in desktop account and accept the remote-control request on that PC. | For diagnostics, use `application.log`, `manager.log`, and `update_status.json` in the appropriate native application folder. No private vendor signing key belongs in that folder.