Table of Contents

Installation Guide

WindowSill offers two installation paths designed for different deployment models:

Quick Comparison

Feature Microsoft Store Standalone Installer
Target audience Individual consumers Enterprise/organization
Pricing model Free tier + WindowSill+ WindowSill Pro only
Authentication Personal Microsoft account WindowSill account
Centralized control None Registry + admin dashboard
Installation requirements Standard user Admin rights

System Requirements

  • OS: Windows 10 or 11
  • RAM: 150 MB
  • Storage: 250 MB (base install, excluding extensions)
  • Architecture: x64 or ARM64

Decision Framework

Choose Microsoft Store if:

  • You're an individual user
  • You want automatic updates with zero config
  • You don't need enterprise controls

Choose Standalone Installer if:

  • You're deploying to multiple devices
  • You need to enforce extension, AI or privacy policies
  • You want centralized API key management

Microsoft Store Version

Best for: Individual users who want simple, automated updates.

Installation

Via Microsoft Store app, or using WinGet:

winget install --id 9PG6CJPXTPZ0 --source msstore

Standalone Installer

Best for: IT teams deploying to multiple devices with policy enforcement.

What You Get

  • Silent deployment without user interaction
  • Policy enforcement via registry or admin dashboard (extensions, API keys, privacy settings)
  • Automatic authentication using device tokens

Installation

  1. Download the installer from WindowSill Dashboard
  2. Deploy with parameters as needed

Deployment Parameters

Parameter Purpose Example
/silent Show progress window only —
/verysilent Fully hidden install —
/norestart Prevents Setup from restarting the system after installation —
/allowedExtensions Whitelist specific extensions /allowedExtensions="extA;extB"
/deviceToken Auto-authenticate users to your organization /deviceToken="abc123..."
/userEmail Specify user email for authentication /userEmail="john.doe@contoso.com"

See Inno Setup documentation for additional installer options.

Not every WindowSill registry-based settings can be controlled by the installer. For full registry key documentation, see Registry Keys reference.

Parameter Deep Dive

/allowedExtensions

Controls which extensions WindowSill can load. Use semicolon-separated Package IDs.

Behavior:

  • Not set: All extensions allowed (default behavior)
  • Empty string (/allowedExtensions=""): No extensions allowed
  • Specified Package ID list (/allowedExtensions="extA;extB"): Only listed extensions allowed

Finding Package IDs:

  • Marketplace extensions: Check the extension's details page (e.g., Media Control)
  • Custom extensions: Rename .wsext to .zip, extract, and open the .nuspec file—the Package ID is in the <id> tag

Important notes:

  • When using /allowedExtensions, default WindowSill extensions are not installed unless explicitly included in the allow-list
  • This parameter does not uninstall already-installed extensions; it only prevents them from loading at startup

/deviceToken

Enables silent authentication by linking WindowSill installations to your organization. Generate tokens in the WindowSill Dashboard.

Note

Device tokens are scoped to a specific organization—either a parent organization or a sub-organization. See Organizations for details on organization hierarchy.

Deployment methods:

  • Installer parameter:

    WindowSill_Setup_x64.exe /verysilent /deviceToken="abc123..."

  • Registry key (PowerShell):

    Set-ItemProperty -Path "HKLM:\SOFTWARE\WindowSill" -Name "DeviceToken" -Value "abc123..."

How it works:

  1. Domain-restricted tokens (recommended): When creating the token, specify an email domain (e.g., @contoso.com)

    • Users with matching email addresses can sign in automatically
    • New users are auto-provisioned with a WindowSill account and added to your organization as Members

  2. Organization-only tokens: If no domain is specified, only existing organization members can authenticate

Email detection:

  • If /userEmail is not provided and the device is domain-joined or Azure AD-joined, WindowSill auto-detects the signed-in user's email on first launch
  • If the device is not domain-joined, you must provide /userEmail or authentication will fail

/userEmail

Specifies the user's email address for device token authentication.

When to use:

  • Required: On non-domain-joined devices using /deviceToken
  • Optional but recommended: On domain-joined devices where you want explicit control over which user account is provisioned (bypasses auto-detection)

Deployment methods:

  • Installer parameter:

    WindowSill_Setup_x64.exe /verysilent /deviceToken="abc123..." /userEmail="john.doe@contoso.com"

  • Registry key (PowerShell):

    Set-ItemProperty -Path "HKLM:\SOFTWARE\WindowSill" -Name "UserEmail" -Value "john.doe@contoso.com"

If omitted on domain-joined devices, WindowSill attempts to detect the email automatically. If detection fails or the device isn't domain-joined, authentication will fail silently—users will see a login prompt.

How the Installer Works

This section provides technical details about the standalone installer's behavior for IT administrators and advanced users.

Installation Location

  • Default path: C:\Program Files\WindowSill
  • Privileges: Requires administrator rights
  • Architecture: Installs in 64-bit mode on both x64 and ARM64 systems

What Gets Installed

  1. Application files — The main WindowSill application and all dependencies
  2. Visual C++ 2015 Redistributable — Installed silently if not already present
  3. Start Menu shortcut — Created in the common Start Menu for all users

System Modifications

The installer makes the following system changes:

Change Purpose
PATH environment variable Adds WindowSill's install directory to the system PATH (for extension development)
Active Setup registration Ensures per-user registration runs on first login

Registry Keys Created

The installer writes to HKLM\SOFTWARE\WindowSill:

Key Condition Purpose
AllowedExtensions When /allowedExtensions is provided Controls which extensions can load
DeviceToken When /deviceToken is provided Enables silent organization authentication
UserEmail When /userEmail is provided Specifies user email for authentication

All keys are automatically removed during uninstallation.

Active Setup (Per-User Registration)

When deploying WindowSill via Intune or other tools that run as SYSTEM, per-user registration cannot happen during installation. The installer uses Windows Active Setup to solve this:

  1. During installation, an Active Setup entry is created in the registry
  2. On each user's first login after installation, Windows runs WindowSill.exe /register
  3. This registers .wsext file associations, registers windowsill:// protocol, and register WindowSill to start automatically when the user log into Windows.

This ensures proper functionality even when the installer runs without an interactive user session. These registrations do not require administrator right.

Post-Installation Behavior

Scenario Behavior
Interactive install WindowSill launches automatically with /register to complete setup and start WindowSill
Silent install (/silent or /verysilent) App does not launch; Active Setup handles registration on first user login and start WindowSill

Uninstallation

The uninstaller performs the following cleanup:

  1. Runs WindowSill.exe /unregister to remove file associations and protocol and auto-startup.
  2. Terminates all running WindowSill processes system-wide
  3. Deletes application data from %LocalAppData%\WindowSill
  4. Removes all registry keys created during installation
  5. Removes WindowSill from the system PATH