{"slug":"install-tailscale-on-windows-with-msi","title":"Install Tailscale on Windows with MSI","tags":["tailscale","setup"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Install Tailscale on Windows with MSI\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nThe current version of the Tailscale client available for [download](https://tailscale.com/download/windows) requires Windows 10 or later or Windows Server 2016 or later.\r\n\r\nThis topic shows how to install Tailscale with the Windows Installer (MSI) package. If you want to use the Tailscale\r\n`.exe` installer, refer to [Install Tailscale on Windows](https://tailscale.com/docs/install/windows).\r\n\r\n## [To install](https://tailscale.com/docs/install/windows/msi\\#to-install)\r\n\r\n1. Download the latest `.msi` file from the [Tailscale Packages](https://pkgs.tailscale.com/stable/#windows) page. You need to choose the version for your\r\nCPU architecture. If your architecture is based on `ARM64`, use the `x86` version.\r\n\r\n2. Run the installer. You can double select the download, or you can use the [`msiexec`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec) command:\r\n\r\n`msiexec /i `\r\n\r\nOptionally, write logging information from `msiexec` to a file. The folder used for the log file must already exist.\r\n\r\n`msiexec /L /i `\r\n\r\n3. Note the new Tailscale icon in your system tray once installation is complete. If it is not\r\nvisible, select the up arrow to find it in the system tray overflow area.\r\n\r\n4. Select the Tailscale icon to expose configuration options and status messages.\r\n\r\n5. Under your account, select **Log in** to launch a browser window, and authenticate\r\nusing [your SSO identity provider](https://tailscale.com/docs/integrations/identity).\r\n\r\n\r\n## [To uninstall](https://tailscale.com/docs/install/windows/msi\\#to-uninstall)\r\n\r\nUsers can [uninstall Tailscale](https://tailscale.com/docs/features/client/uninstall) through the Windows control panel.\r\n\r\nFor system administration or debugging purposes, you can also uninstall with `msiexec`. If you uninstall with\r\n`msiexec`, you must use the same `.msi` file that you used to install the client.\r\n\r\n```markup\r\nmsiexec /x \r\n```\r\n\r\nYou can also use the `/L` option to write logging information from `msiexec` to a file.\r\n\r\n```markup\r\nmsiexec /L /x \r\n```\r\n\r\n## [Properties](https://tailscale.com/docs/install/windows/msi\\#properties)\r\n\r\nIf you use the `msiexec` command-line tool, you can set several MSI properties that control the user's experience with\r\nthe Tailscale client. For example, this installation command hides the **Network Devices** menu item in the Tailscale client:\r\n\r\n```markup\r\nmsiexec TS_NETWORKDEVICES=\"hide\" /i tailscale-setup-1.22.0-amd64.msi\r\n```\r\n\r\nTailscale MSI properties, if set, are stored in the `HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Tailscale` registry key.\r\nThe [registry value type](https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry-value-types) for all Tailscale MSI properties is `REG_SZ`.\r\n\r\nThe following properties can be used with MSI.\r\n\r\n### [INSTALLDIR](https://tailscale.com/docs/install/windows/msi\\#installdir)\r\n\r\nSpecifies the path of the installation directory on disk. The installation path\r\ndefaults to `C:\\Program Files\\Tailscale`.\r\n\r\n### [TS\\_ADMINCONSOLE](https://tailscale.com/docs/install/windows/msi\\#ts_adminconsole)\r\n\r\nControls visibility of the **Admin Console** menu\r\n\r\n- Registry name: `AdminConsole`\r\n- Possible values: \"show\", \"hide\"\r\n\r\n### [TS\\_ADVERTISEEXITNODE](https://tailscale.com/docs/install/windows/msi\\#ts_advertiseexitnode)\r\n\r\nControls how the [Run As Exit Nodes](https://tailscale.com/docs/features/exit-nodes) option is configured\r\n\r\n- Registry name: `AdvertiseExitNode`\r\n- Possible values: \"always\", \"never\", \"user-decides\"\r\n\r\n### [TS\\_ALLOWINCOMINGCONNECTIONS](https://tailscale.com/docs/install/windows/msi\\#ts_allowincomingconnections)\r\n\r\nControls the **Preferences** \\> **Allow Incoming Connections** menu item\r\n\r\n- Registry name: `AllowIncomingConnections`\r\n- Possible values: \"always\", \"never\", \"user-decides\"\r\n\r\n### [TS\\_CHECKUPDATES](https://tailscale.com/docs/install/windows/msi\\#ts_checkupdates)\r\n\r\nThis policy does not currently change Windows behavior. It corresponds to `tailscale set --update-check` but the Windows client does not currently look at this because it always checks for updates.\r\n\r\n- Registry name: `CheckUpdates`\r\n- Possible values: \"always\", \"never\", \"user-decides\"\r\n\r\n### [TS\\_ENABLEDNS](https://tailscale.com/docs/install/windows/msi\\#ts_enabledns)\r\n\r\nControls whether to apply its DNS configuration when the tunnel is connected\r\n\r\n- Registry name: `UseTailscaleDNSSettings`\r\n- Possible values: \"always\", \"never\", \"user-decides\"\r\n\r\n### [TS\\_ENABLESUBNETS](https://tailscale.com/docs/install/windows/msi\\#ts_enablesubnets)\r\n\r\nControls whether to accept subnets advertised by other nodes in your tailnet\r\n\r\n- Registry name: `UseTailscaleSubnets`\r\n- Possible values: \"always\", \"never\", \"user-decides\"\r\n\r\n### [TS\\_EXITNODEMENU](https://tailscale.com/docs/install/windows/msi\\#ts_exitnodemenu)\r\n\r\nControls the visibility of the **Exit Nodes** menu\r\n\r\n- Registry name: `ExitNodesPicker`\r\n- Possible values: \"show\", \"hide\"\r\n\r\n### [TS\\_FLUSHDNSONSESSIONUNLOCK](https://tailscale.com/docs/install/windows/msi\\#ts_flushdnsonsessionunlock)\r\n\r\nEnables additional DNS cache flushing for debugging purposes. This should only be enabled if recommended by Tailscale Support.\r\n\r\n- Registry name: `FlushDNSOnSessionUnlock`\r\n- Possible values: \"1\", \"0\"\r\n\r\n### [TS\\_INSTALLUPDATES](https://tailscale.com/docs/install/windows/msi\\#ts_installupdates)\r\n\r\nControls how **Automatically Install Updates** is configured\r\n\r\n- Registry name: `InstallUpdates`\r\n- Possible values: \"always\", \"never\", \"user-decides\"\r\n\r\n### [TS\\_KEYEXPIRATIONNOTICE](https://tailscale.com/docs/install/windows/msi\\#ts_keyexpirationnotice)\r\n\r\nEnables a warning message that will be displayed up to time prior to the login's\r\nactual expiry. The default is 24 hours.\r\n\r\n- Registry name: `KeyExpirationNotice`\r\n- Possible values: String value that can be parsed by Go's [`time.ParseDuration` function](https://pkg.go.dev/time#ParseDuration). For example, \"12h\".\r\n\r\n### [TS\\_LOGINURL](https://tailscale.com/docs/install/windows/msi\\#ts_loginurl)\r\n\r\nControls the required use of a particular Tailscale coordination server. For more information, refer to [Set a custom control server URL](https://tailscale.com/docs/features/tailscale-system-policies#set-a-custom-control-server-url).\r\n\r\n- Registry name: `LoginURL`\r\n- Possible values: URL for the coordination server\r\n\r\n### [TS\\_NETWORKDEVICES](https://tailscale.com/docs/install/windows/msi\\#ts_networkdevices)\r\n\r\nControls the visibility of the **Network Devices** menu\r\n\r\n- Registry name: `NetworkDevices`\r\n- Possible values: \"show\", \"hide\"\r\n\r\n### [TS\\_NOLAUNCH](https://tailscale.com/docs/install/windows/msi\\#ts_nolaunch)\r\n\r\nControls whether the Tailscale client is launched as part of the installation. This property is applicable only during silent installation.\r\n\r\n- Registry name: Not applicable—no value is saved to the registry.\r\n- Possible values: Any string. Set this to a non-empty string to prevent the Tailscale GUI client from launching as part of installation.\r\n\r\n### [TS\\_ONBOARDING\\_FLOW](https://tailscale.com/docs/install/windows/msi\\#ts_onboarding_flow)\r\n\r\nControls visibility of the onboarding flow\r\n\r\n- Registry name: `OnboardingFlow`\r\n- Possible values: \"show\", \"hide\"\r\n\r\n### [TS\\_PREFERENCESMENU](https://tailscale.com/docs/install/windows/msi\\#ts_preferencesmenu)\r\n\r\nControls the visibility of the **Preferences** menu\r\n\r\n- Registry name: `PreferencesMenu`\r\n- Possible values: \"show\", \"hide\"\r\n\r\n### [TS\\_TESTMENU](https://tailscale.com/docs/install/windows/msi\\#ts_testmenu)\r\n\r\nControls whether it is possible for users to bring up the debug menu by holding either `CTRL` or `SHIFT` when opening the Tailscale menu.\r\n\r\n- Registry name: `TestMenu`\r\n- Possible values: \"show\", \"hide\"\r\n\r\n### [TS\\_UNATTENDEDMODE](https://tailscale.com/docs/install/windows/msi\\#ts_unattendedmode)\r\n\r\nControls the **Preferences** \\> **Run Unattended** menu item\r\n\r\n- Registry name: `UnattendedMode`\r\n- Possible values: \"always\", \"never\", \"user-decides\"\r\n\r\n### [TS\\_UPDATEMENU](https://tailscale.com/docs/install/windows/msi\\#ts_updatemenu)\r\n\r\nControls the visibility of the **Update Tailscale** menu item.\r\n\r\n- Registry name: `UpdateMenu`\r\n- Possible values: \"show\", \"hide\"\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Install Tailscale on Windows with MSI

\n

Last validated: Jan 5, 2026

\n

The current version of the Tailscale client available for download requires Windows 10 or later or Windows Server 2016 or later.

\n

This topic shows how to install Tailscale with the Windows Installer (MSI) package. If you want to use the Tailscale\r\n.exe installer, refer to Install Tailscale on Windows.

\n

To install

\n
    \n
  1. \n

    Download the latest .msi file from the Tailscale Packages page. You need to choose the version for your\r\nCPU architecture. If your architecture is based on ARM64, use the x86 version.

    \n
    2. \n
  2. \n

    Run the installer. You can double select the download, or you can use the msiexec command:

    \n
    3. \n
\n

msiexec /i <path_to_tailscale_msi.msi>

\n

Optionally, write logging information from msiexec to a file. The folder used for the log file must already exist.

\n

msiexec /L <path_to_log.log> /i <path_to_tailscale_msi.msi>

\n
    \n
  1. \n

    Note the new Tailscale icon in your system tray once installation is complete. If it is not\r\nvisible, select the up arrow to find it in the system tray overflow area.

    \n
    2. \n
  2. \n

    Select the Tailscale icon to expose configuration options and status messages.

    \n
    3. \n
  3. \n

    Under your account, select Log in to launch a browser window, and authenticate\r\nusing your SSO identity provider.

    \n
    4. \n
\n

To uninstall

\n

Users can uninstall Tailscale through the Windows control panel.

\n

For system administration or debugging purposes, you can also uninstall with msiexec. If you uninstall with\r\nmsiexec, you must use the same .msi file that you used to install the client.

\n
msiexec /x <path_to_tailscale_msi.msi>\n
\n

You can also use the /L option to write logging information from msiexec to a file.

\n
msiexec /L <path_to_log.log> /x <path_to_tailscale_msi.msi>\n
\n

Properties

\n

If you use the msiexec command-line tool, you can set several MSI properties that control the user's experience with\r\nthe Tailscale client. For example, this installation command hides the Network Devices menu item in the Tailscale client:

\n
msiexec TS_NETWORKDEVICES=\"hide\" /i tailscale-setup-1.22.0-amd64.msi\n
\n

Tailscale MSI properties, if set, are stored in the HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Tailscale registry key.\r\nThe registry value type for all Tailscale MSI properties is REG_SZ.

\n

The following properties can be used with MSI.

\n

INSTALLDIR

\n

Specifies the path of the installation directory on disk. The installation path\r\ndefaults to C:\\Program Files\\Tailscale.

\n

TS_ADMINCONSOLE

\n

Controls visibility of the Admin Console menu

\n
    \n
  • Registry name: AdminConsole
    • \n
  • Possible values: \"show\", \"hide\"
    • \n
\n

TS_ADVERTISEEXITNODE

\n

Controls how the Run As Exit Nodes option is configured

\n
    \n
  • Registry name: AdvertiseExitNode
    • \n
  • Possible values: \"always\", \"never\", \"user-decides\"
    • \n
\n

TS_ALLOWINCOMINGCONNECTIONS

\n

Controls the Preferences > Allow Incoming Connections menu item

\n
    \n
  • Registry name: AllowIncomingConnections
    • \n
  • Possible values: \"always\", \"never\", \"user-decides\"
    • \n
\n

TS_CHECKUPDATES

\n

This policy does not currently change Windows behavior. It corresponds to tailscale set --update-check but the Windows client does not currently look at this because it always checks for updates.

\n
    \n
  • Registry name: CheckUpdates
    • \n
  • Possible values: \"always\", \"never\", \"user-decides\"
    • \n
\n

TS_ENABLEDNS

\n

Controls whether to apply its DNS configuration when the tunnel is connected

\n
    \n
  • Registry name: UseTailscaleDNSSettings
    • \n
  • Possible values: \"always\", \"never\", \"user-decides\"
    • \n
\n

TS_ENABLESUBNETS

\n

Controls whether to accept subnets advertised by other nodes in your tailnet

\n
    \n
  • Registry name: UseTailscaleSubnets
    • \n
  • Possible values: \"always\", \"never\", \"user-decides\"
    • \n
\n

TS_EXITNODEMENU

\n

Controls the visibility of the Exit Nodes menu

\n
    \n
  • Registry name: ExitNodesPicker
    • \n
  • Possible values: \"show\", \"hide\"
    • \n
\n

TS_FLUSHDNSONSESSIONUNLOCK

\n

Enables additional DNS cache flushing for debugging purposes. This should only be enabled if recommended by Tailscale Support.

\n
    \n
  • Registry name: FlushDNSOnSessionUnlock
    • \n
  • Possible values: \"1\", \"0\"
    • \n
\n

TS_INSTALLUPDATES

\n

Controls how Automatically Install Updates is configured

\n
    \n
  • Registry name: InstallUpdates
    • \n
  • Possible values: \"always\", \"never\", \"user-decides\"
    • \n
\n

TS_KEYEXPIRATIONNOTICE

\n

Enables a warning message that will be displayed up to time prior to the login's\r\nactual expiry. The default is 24 hours.

\n
    \n
  • Registry name: KeyExpirationNotice
    • \n
  • Possible values: String value that can be parsed by Go's time.ParseDuration function. For example, \"12h\".
    • \n
\n

TS_LOGINURL

\n

Controls the required use of a particular Tailscale coordination server. For more information, refer to Set a custom control server URL.

\n
    \n
  • Registry name: LoginURL
    • \n
  • Possible values: URL for the coordination server
    • \n
\n

TS_NETWORKDEVICES

\n

Controls the visibility of the Network Devices menu

\n
    \n
  • Registry name: NetworkDevices
    • \n
  • Possible values: \"show\", \"hide\"
    • \n
\n

TS_NOLAUNCH

\n

Controls whether the Tailscale client is launched as part of the installation. This property is applicable only during silent installation.

\n
    \n
  • Registry name: Not applicable—no value is saved to the registry.
    • \n
  • Possible values: Any string. Set this to a non-empty string to prevent the Tailscale GUI client from launching as part of installation.
    • \n
\n

TS_ONBOARDING_FLOW

\n

Controls visibility of the onboarding flow

\n
    \n
  • Registry name: OnboardingFlow
    • \n
  • Possible values: \"show\", \"hide\"
    • \n
\n

TS_PREFERENCESMENU

\n

Controls the visibility of the Preferences menu

\n
    \n
  • Registry name: PreferencesMenu
    • \n
  • Possible values: \"show\", \"hide\"
    • \n
\n

TS_TESTMENU

\n

Controls whether it is possible for users to bring up the debug menu by holding either CTRL or SHIFT when opening the Tailscale menu.

\n
    \n
  • Registry name: TestMenu
    • \n
  • Possible values: \"show\", \"hide\"
    • \n
\n

TS_UNATTENDEDMODE

\n

Controls the Preferences > Run Unattended menu item

\n
    \n
  • Registry name: UnattendedMode
    • \n
  • Possible values: \"always\", \"never\", \"user-decides\"
    • \n
\n

TS_UPDATEMENU

\n

Controls the visibility of the Update Tailscale menu item.

\n
    \n
  • Registry name: UpdateMenu
    • \n
  • Possible values: \"show\", \"hide\"
    • \n
\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}