Update and Manage CSE Desktop App Versions

Update the desktop app across your devices and keep it up to date

  • Last validated: Sep 17, 2026

Overview

This doc explains how to keep the Cloud Secure Edge (CSE) desktop app up to date across your fleet, including a fleet that was built up over time and now runs a mix of app versions and installation methods.

Update the CSE Windows app to v4.5.1 or later. Earlier versions do not reliably renew device registration on their own. End users have to open the app and renew manually before registration expires, and devices that miss that window have to be re-registered. Enable App Auto Update, or deploy v4.5.1 manually: x86 EXE, x86 MSI, ARM EXE, ARM MSI.

There are two ways to keep the app up to date. We recommend App Auto Update.

Approach How it works Who it suits
App Auto Update (recommended) CSE updates the app on each device silently, with no action from you or the end user. Most orgs.
Manual updates You deploy each version yourself, through a Device Manager, a remote monitoring and management (RMM) platform, or by hand. Orgs that need to approve and schedule every version.

You can also combine the two: deploy a specific version manually when you need a fleet on it immediately, then leave App Auto Update on to carry the fleet forward.

Terminology

Term What it means
Legacy Banyan install Desktop app v3.28.x or earlier, installed from a Banyan-branded installer.
CSE EXE install Desktop app v4.0.0 or later, installed from the .exe installer, either by hand or through the zero touch script.
CSE MSI install Desktop app v4.3.0 or later, installed from the Windows .msi package. See Installing the CSE Desktop App for Windows (MSI).
App Auto Update The org-level setting in the CSE Command Center that lets CSE update the app on end user devices silently. See App Auto Update.

Legacy Banyan installs and CSE installs are the same application under two names. No product migration is required between them.

App Auto Update (Recommended)

App Auto Update requires desktop app v4.2.0 or later. Whether a device needs anything done first depends only on its version:

Installed version Action required before enabling
Any MSI install None. The MSI was released at v4.3.0, so every MSI install already meets the requirement.
CSE EXE v4.2.0 or later None.
CSE EXE v4.0.0 to v4.1.x Update the device once. See Update Methods.
Legacy Banyan, v3.28.x or earlier Update the device once. See Update Methods.

Devices below v4.2.0 need one manual update to become eligible. After that, CSE keeps them up to date.

Enable App Auto Update

In the CSE Command Center, go to Settings > SonicWall CSE Client > the Deployment tab, and turn on App Auto Update. For full steps, and for how this setting interacts with the per-device MDM flag, see App Auto Update.

App Auto Update is an org-level setting, so enable it separately in each org. If you are a managed service provider (MSP), no single control turns it on across every org you administer. Orgs provisioned after the April 2026 release have it on by default. Orgs provisioned before that release do not, so turn it on by hand.

The per-device mdm_disable_auto_update parameter in mdm-config.json overrides the org-level setting. Its default value allows auto update to function, so no action is required for most orgs.

Check this parameter only if it was set previously, for example to suppress update prompts while a Device Manager pushed versions instead. If it was set, change it to false before relying on App Auto Update.

See Customizing desktop app functionality for the full parameter list. For MSI installs, the equivalent property is DISABLE_AUTO_UPDATE.

A new version becomes available for auto update about one week after it is published. Auto-updating devices therefore trail the newest version on the download page by roughly one release.

To put a fleet on a specific version sooner, as with the v4.5.1 registration renewal fix, deploy that version once using Update Methods. Auto update then applies subsequent versions.

For more detail, see When a new version becomes available for auto-update.

Manual Updates

Choose this approach to approve and schedule every version yourself. Leave App Auto Update off and deploy each version using Update Methods on your own schedule.

With App Auto Update off, end users on desktop app v4.2.0 and later receive an update notification and can apply the update themselves. To prevent those prompts, set mdm_disable_auto_update to true. See Customizing desktop app functionality.

Update Methods

These methods apply to both approaches. Use them to deploy a version manually, whether as the one-time update that makes a device eligible for App Auto Update or as your ongoing update process.

The method depends on whether the app was installed from an EXE or an MSI. The installed version does not affect which method to use, and no path requires an intermediate upgrade: any version can be updated directly to the current release.

Each method preserves the device’s org registration, device certificate, tokens, mdm-config.json, and user settings. End users are not asked to re-register or to re-enter an invite code.

We do not provide a script that detects which installer is on a device and selects the update path. Determine the installation method from your own deployment records before updating.

Update an EXE Install, Including Legacy Banyan

Run the SonicWall CSE app installer script in upgrade mode. Pass the literal string upgrade in place of both the invite code and the deployment key:

.\sonicwall-cse-windows.ps1 upgrade upgrade <APP_VERSION>

APP_VERSION is optional. Omit it to install the latest published version. Pass an exact version, such as 4.5.1, to pin the fleet to a known build.

The script stops the app, installs the requested version silently, and restarts the app as the logged-on user. It skips the config file and device staging steps that a first-time install performs, which is what preserves the existing registration.

Run the script with administrator privileges. The script can be delivered through any Device Manager or RMM platform that runs PowerShell as an administrator, such as Microsoft Intune, ConnectWise RMM, or Kaseya VSA.

Run the script when a user is logged on to the device. The script’s last step launches the app in the logged-on user’s session. Running it unattended as the Windows SYSTEM account, with no user signed in, has not been validated. Test that case in your environment before relying on it.

Install the current MSI over the existing one:

msiexec /i sonicwallcse-<new_version>.msi /quiet /norestart

Windows Installer replaces the older version in place. The existing mdm-config.json, staged certificates, and tokens are preserved.

Do not use the EXE script on a device that was installed from an MSI. For reinstall, downgrade, and troubleshooting behavior, see Upgrade Scenarios.

Existing EXE installations do not need to be migrated to the MSI. Update them in place and leave them as EXE installations. Once all devices run desktop app v4.2.0 or later with App Auto Update enabled, the installation method does not affect how the app is updated.

The MSI and EXE installers are mutually exclusive. Each blocks the other on the same device, so migrating a device from EXE to MSI requires uninstalling the existing installation first.

For new Windows deployments, use the MSI. It provides additional deployment controls, including silent installation switches, verbose logging, and exit codes that a Device Manager can act on.

  • Access to CSE-secured services is interrupted. The app stops and restarts during the update, so access drops for that period and returns once the app restarts. Schedule fleet-wide updates outside of working hours when possible.
  • The device stays registered. Org registration, device certificate, tokens, and configuration are preserved. End users are not asked to re-register or to re-enter an invite code.
  • No end user action is required for the EXE script update, the MSI silent update, or an App Auto Update install.
  • No end user administrator rights are required. App Auto Update applies without elevated privileges on desktop app v4.2.0 and later.

Update a Single Device

To update one device outside of a fleet rollout, use either of the following:

  • The in-app update. When a new version is available and the end user receives an update notification in the app, they can apply the update by selecting it. Notifications appear when App Auto Update is off, or on devices earlier than v4.2.0. See How auto update works.
  • The installer. Download the current installer from the CSE desktop app download page and run it over the existing install, using the installation method already on the device.

Installing an older version over a newer one is blocked. See Register the Desktop App.

Was this page helpful?