Deploying Maxiful on Windows

How it installs

Per person, with no administrator rights. The installer, Maxiful-x64-setup.exe, runs as the person signed in to Windows and installs into that person's %LOCALAPPDATA%\Maxiful. It is listed under that person's installed apps, so each person who uses Maxiful on a computer has an install of their own.

Windows 10 or later, 64-bit. Maxiful's window is drawn by Microsoft Edge WebView2. If the WebView2 Runtime is missing, the installer downloads Microsoft's own WebView2 installer from go.microsoft.com and runs it silently.

What it runs. Maxiful is a desktop app, Maxiful.exe. On its first start it sets up the assistants' runtime for that person: OpenClaw, the open-source agent runtime, on a copy of Node.js that Maxiful installs for that person. A background process of that runtime, the gateway, runs the assistants, and it starts again each time the person signs in to Windows.

Silent install

Maxiful-x64-setup.exe /S

Exit codes. 0 means the install finished, and any other code means it did not. A 2 can have more than one cause; one is another program keeping one of Maxiful's files in use for 30 seconds, and then nothing was changed. The installer ends the person's own running Maxiful before it writes.

Over an installed copy. Running a newer installer the same way updates it in place, and the person's assistants and data stay. We measured this on our Windows test PC on 26 October 2026, from 0.9.54 to the signed 0.9.58.

The one prompt: Microsoft Defender

After it writes its files, Maxiful asks Windows to let Microsoft Defender skip four of its own working folders, because they change thousands of files every time the team starts. Windows shows its own permission prompt for this; for a person without administrator rights, it asks for an administrator's sign-in.

If nobody answers, Windows closes the prompt by itself after about two minutes and the install still finishes. Maxiful asks once more the next time it starts, and a second unanswered prompt counts as a no and is not asked again. With the folders scanned, everything works, and the team starts more slowly. The person can change it later in Maxiful's settings, under Let Defender skip Maxiful's working folders.

First start: what each person does

A silent install leaves Maxiful ready to open. IT cannot complete a person's sign-in or setup code for them today: the first start asks each person for these steps.

• Each person signs in with their own email address. Maxiful emails a sign-in link, and the link opens the app.
• A person setting up a new workspace enters the setup code from their Maxiful account. A code works on the first computer that uses it.
• A colleague invited to a workspace joins it instead. Each new device of a colleague waits until the workspace owner lets it in on the Team page, under People.

Setup then installs Node.js and the runtime for that person and starts the team. It needs the network hosts listed below.

What it puts on the computer

<name> below is the install's own short name.

Processes

Commands the assistants run (a shell, PowerShell, scripts) run as children of the gateway, in each assistant's own sandbox by default. The gateway listens on 127.0.0.1 at a port from 18800 up (18800 for the first install), and Maxiful.exe on further loopback ports; on our test PC nothing of Maxiful's listened on any other address.

Network hosts to allow

Every connection is opened from the computer outward, over HTTPS (the relay also uses WSS). Nothing on our side can open a connection to the computer.

For setup and everyday use

Only when a feature is used

How security tools see it

Signer. Every installer we publish today is signed by a certificate issued to PolyTrader Ltd (the certificate's subject reads CN=Polytrader LTD), the company that published Maxiful before Maxiful AB, and so is the Maxiful.exe it installs. Read a file's signature with Get-AuthenticodeSignature, and compare a download with the checksum on your setup page (Help shows how).

Unsigned parts. The runtime's node.exe and the assistants' chrome.exe carry no Authenticode signature; Maxiful checks each against a pinned SHA-256 before it uses it. An allowlist for them goes by path.

Behaviour. A per-user Node.js process starts at sign-in, makes outbound HTTPS calls, runs commands for the assistants, and copies its plugins' files at each start, so it writes many files under the install's folder.

CrowdStrike. CrowdStrike publishes an OpenClaw "Search & Removal" content pack for Falcon for IT. It looks for running OpenClaw processes, global npm installs, OpenClaw binaries in common paths, services, and state and configuration folders in home folders. Its removal workflow stops services and processes, uninstalls npm packages, deletes installation and configuration folders, and removes service registrations, Scheduled Tasks among them. Maxiful's gateway is a running OpenClaw process with its state in %USERPROFILE%\.openclaw-<name>, so that pack may find it. Run on a Maxiful computer, its removal could stop the team and delete the assistants' configuration and memory. Use its search to see where Maxiful runs, and keep its removal away from the computers where your organisation uses Maxiful.

What to allowlist

• Processes: %LOCALAPPDATA%\Maxiful\Maxiful.exe (signed) and gateway-launcher.exe, %LOCALAPPDATA%\Lanoko\node-v24.21.0\node.exe, and %USERPROFILE%\.openclaw-*\browser\chromium\chrome-win64\chrome.exe.
• Folders: the four Defender folders above.
• Network: the hosts above.

Whether to allowlist is your security team's call. These processes run commands for the assistants, inside each assistant's sandbox by default, with the approvals described on our Security page.

Updates

Maxiful looks for a new version on maxiful.ai when it starts and every six hours. A new version is a signed installer, checked against a key built into the app before it runs. The person chooses Update and restart or Later, and the update runs the installer in passive mode.

A new Maxiful version can carry a newer OpenClaw runtime. Maxiful then updates the runtime for that person with npm, from registry.npmjs.org. You can also push each new installer yourself with /S, as above.

Removing Maxiful

Everything: in Maxiful's settings, Remove Maxiful from this computer. It stops the background process and its scheduled tasks, deletes the install's data and credentials, removes the Node.js runtime it installed unless another install on the computer still uses it, and starts the uninstaller when Maxiful quits. The person's own documents are not touched.

The uninstaller alone (%LOCALAPPDATA%\Maxiful\uninstall.exe /S, which the Intune recipe below runs) removes the app, its shortcuts, the team keeper task and the Defender exclusions Maxiful added; Windows may show its prompt again for those. It leaves the runtime, the gateway's startup entry and the install's data, and the background process keeps running with everything it holds. Use Remove Maxiful from this computer first.

Microsoft Intune (Win32 app)

We measured the silent install and the update over an installed copy on our own Windows test PC. This recipe follows Microsoft's Win32 app documentation and has not been run in an Intune tenant; if yours behaves differently, tell us at [email protected].

1. Make a package folder holding Maxiful-x64-setup.exe, downloaded from your Maxiful account and checked against its SHA-256, and a file uninstall.cmd, because Intune does not expand environment variables in an uninstall command:

   @echo off
   "%LOCALAPPDATA%\Maxiful\uninstall.exe" /S _?=%LOCALAPPDATA%\Maxiful
   set rc=%ERRORLEVEL%
   del /q "%LOCALAPPDATA%\Maxiful\uninstall.exe"
   rmdir "%LOCALAPPDATA%\Maxiful"
   exit /b %rc%

   _?= makes the uninstaller run in place and finish before the script goes on; the two lines after it remove the uninstaller itself and the empty folder.
2. Make the .intunewin file with Microsoft's Win32 Content Prep Tool:

   IntuneWinAppUtil.exe -c C:\maxiful-package -s Maxiful-x64-setup.exe -o C:\maxiful-intunewin -q

3. Program: install command Maxiful-x64-setup.exe /S; uninstall command uninstall.cmd; install behaviour User; device restart behaviour No specific action; the default return codes.
4. Requirements: 64-bit, Windows 10 or later.
5. Detection rule: File, path %LOCALAPPDATA%\Maxiful, file Maxiful.exe, method File or folder exists.
6. Assignment: Required or Available, to user groups.

Read the Defender prompt and the first start above before you assign it widely: Intune expects an install that asks nothing, and Windows' Defender prompt is the one question Maxiful's install can raise.