Installing Tailscale on Windows with MSI

This article shows how to install Tailscale with the Windows Installer (MSI) package. If you want to use the Tailscale .exe installer, see Installing Tailscale on Windows.

To install

1. Download the latest .msi file from the Tailscale Packages page. You need to choose the version for your CPU architecture. If your architecture is based on ARM64, use the x86 version.

2. Run the installer. You can double click the download, or you can use the msiexec command:

   msiexec /i <path_to_tailscale_msi.msi>

   Optionally, write logging information from msiexec to a file. The folder used for the log file must already exist.

   msiexec /L <path_to_log.log> /i <path_to_tailscale_msi.msi>

3. Note the new Tailscale icon in your system tray once installation is complete. If it is not visible, click the up arrow to find it in the system tray overflow area.

4. Click on the Tailscale icon to expose configuration options and status messages.

5. Under your account, click on Log in to launch a browser window, and authenticate using your SSO identity provider.

Congratulations! You’ve added your Windows workstation to your Tailscale network.

To uninstall

Users can uninstall Tailscale through the Windows control panel.

For system administration or debugging purposes, you can also uninstall with msiexec. If you uninstall with msiexec, you must use the same .msi file that you used to install the client.

msiexec /x <path_to_tailscale_msi.msi>

You can also use the /L option to write logging information from msiexec to a file.

msiexec /L <path_to_log.log> /x <path_to_tailscale_msi.msi>

Properties

If you use the msiexec command-line tool, you can set several MSI properties that control the user's experience with the Tailscale client. For example, this installation command hides the Network Devices menu item in the Tailscale client:

msiexec TS_NETWORKDEVICES="hide" /i tailscale-setup-1.22.0-amd64.msi

Tailscale MSI properties, if set, are stored in the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Tailscale registry key. The registry value type for all Tailscale MSI properties is REG_SZ.

The following properties can be used with MSI.

INSTALLDIR

Specifies the path of the installation directory on disk. The installation path defaults to C:\Program Files\Tailscale.

TS_ADMINCONSOLE

Controls visibility of the Admin Console menu

• Registry name: AdminConsole
• Possible values: "show", "hide"

TS_ADVERTISEEXITNODE

Controls how the Run As Exit Nodes option is configured

• Registry name: AdvertiseExitNode
• Possible values: "always", "never", "user-decides"

TS_ALLOWINCOMINGCONNECTIONS

Controls the Preferences > Allow Incoming Connections menu item

• Registry name: AllowIncomingConnections
• Possible values: "always", "never", "user-decides"

TS_CHECKUPDATES

This policy does not currently change Windows behavior. It corresponds to tailscale set --update-check but the Windows client does not currently look at this because it always checks for updates.

• Registry name: CheckUpdates
• Possible values: "always", "never", "user-decides"

TS_ENABLEDNS

Controls whether to apply its DNS configuration when the tunnel is connected

• Registry name: UseTailscaleDNSSettings
• Possible values: "always", "never", "user-decides"

TS_ENABLESUBNETS

Controls whether to accept subnets advertised by other nodes in your tailnet

• Registry name: UseTailscaleSubnets
• Possible values: "always", "never", "user-decides"

TS_EXITNODEMENU

Controls the visibility of the Exit Nodes menu

• Registry name: ExitNodesPicker
• Possible values: "show", "hide"

TS_FLUSHDNSONSESSIONUNLOCK

Enables additional DNS cache flushing for debugging purposes. This should only be enabled if recommended by Tailscale Support.

• Registry name: FlushDNSOnSessionUnlock
• Possible values: "1", "0"

TS_INSTALLUPDATES

Controls how Automatically Install Updates is configured

• Registry name: InstallUpdates
• Possible values: "always", "never", "user-decides"

TS_KEYEXPIRATIONNOTICE

Enables a warning message that will be displayed up to time prior to the login's actual expiry. The default is 24 hours.

• Registry name: KeyExpirationNotice
• Possible values: String value that can be parsed by Go's time.ParseDuration function. For example, "12h".

TS_LOGINURL

Controls the required use of a particular Tailscale coordination server. See Set a custom control server URL for more details.

• Registry name: LoginURL
• Possible values: URL for the coordination server

TS_NETWORKDEVICES

Controls the visibility of the Network Devices menu

• Registry name: NetworkDevices
• Possible values: "show", "hide"

TS_NOLAUNCH

Controls whether the Tailscale client is launched as part of the installation. This property is applicable only during silent installation.

• Registry name: Not applicable—no value is saved to the registry.
• Possible values: Any string. Set this to a non-empty string to prevent the Tailscale GUI client from launching as part of installation.

TS_PREFERENCESMENU

Controls the visibility of the Preferences menu

• Registry name: PreferencesMenu
• Possible values: "show", "hide"

TS_TESTMENU

Controls whether it is possible for users to bring up the debug menu by holding either ctrl or shift when opening the Tailscale menu.

• Registry name: TestMenu
• Possible values: "show", "hide"

TS_UNATTENDEDMODE

Controls the Preferences > Run Unattended menu item

• Registry name: UnattendedMode
• Possible values: "always", "never", "user-decides"

TS_UPDATEMENU

Controls the visibility of the Update Tailscale menu item.

• Registry name: UpdateMenu
• Possible values: "show", "hide"