WhispAssist/docs/enterprise-deployment.md

Enterprise deployment

How to mass-deploy WhispAssist and preset its defaults with native Windows tooling (Group Policy, SCCM, Intune, msiexec, silent NSIS). No management console, no phone-home. See ADR-0012.

WhispAssist ships two bundles:

Bundle	Scope	Admin?
WhispAssist_<ver>_x64_en-US.msi	Per-machine (all users)	Yes
WhispAssist_<ver>_x64-setup.exe (NSIS)	Current-user or all-users (prompts)	Only for all-users

Install location

• MSI: msiexec /i WhispAssist_<ver>_x64_en-US.msi INSTALLDIR="D:\Apps\WhispAssist" /qn (INSTALLDIR is Tauri's WiX install-dir property; confirm against the generated .wxs if a build changes it.)
• NSIS: WhispAssist_<ver>_x64-setup.exe /S /D=D:\Apps\WhispAssist (/S = silent, /D= = install dir; /D= must be last and unquoted per NSIS.)

Install scope (per-user vs all-users)

The NSIS .exe shows a "current user / all users" page. Current user needs no admin and installs under the user profile; all users requires elevation. Silent all-users: WhispAssist_<ver>_x64-setup.exe /S. The MSI is always per-machine (all-users) and requires admin.

Auto-start at login

Off by default (NFR-RES-4). Turn it on for the user either in-app (Settings ▸ Recording ▸ Launch WhispAssist at login) or by presetting auto_start = true in wa-defaults.ini (below). It installs a per-user HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry — no admin, and it does not start recording on its own.

Preset default settings — wa-defaults.ini

On a machine's first launch (before settings.json exists), WhispAssist reads an admin-supplied INI and seeds that user's settings.json. After that the user's own settings win and the file is ignored. First location found wins:

1. %PROGRAMDATA%\WhispAssist\wa-defaults.ini — machine-wide. Deploy with a GPO/SCCM/Intune file copy.
2. <install dir>\wa-defaults.ini — the template shipped next to the executable.

The shipped template is fully commented out, so a default install behaves as if it were absent. Uncomment and edit the keys you want to preset.

Format

Flat key = value, one per line. ; and # comment lines and [section] headers are ignored. true/false become switches, plain numbers become numbers, everything else is text. Unknown or misspelled keys are ignored.

Never put secrets in this file. API keys, OAuth tokens and sync passwords live only in the OS credential store. Any key containing key, token, secret, credential or password is dropped on read. Presetting llm_provider = anthropic still requires the key to be provisioned separately — the file adds no egress path.

Keys

Key	Values	Meaning
default_record	true/false	Record every meeting by default (consent notice still applies).
preferred_backend	auto|npu|nvidia|amd|intel|cpu	Transcription backend.
whisper_model	catalog id (e.g. base.en-q5_1)	Default transcription model.
auto_download_model	true/false	Fetch whisper_model in the background on first launch.
whisper_language	auto|ISO-639-1	Default language (multilingual model only).
low_overhead	true/false	CPU + smallest model preset.
storage_root	path	Where meetings are stored.
retention_max_age_days	number	Delete meetings older than N days.
retention_max_size_gb	number	Cap total storage at N GB.
llm_provider	ollama|custom|anthropic|off	Summary provider (key provisioned separately).
llm_endpoint	url	LLM endpoint.
llm_model	text	LLM model name.
microphone_enabled	true/false	Capture the user's mic into the transcript.
auto_record_calendar	true/false	Auto-start recording on calendar events (app open only).
theme	system|light|dark	UI theme.
auto_start	true/false	Launch WhispAssist at login (per-user Run entry).
sync_enabled	true/false	Sync master switch (targets/credentials configured in-app).

Example

default_record       = true
preferred_backend    = npu
whisper_model        = small.en-q5_1
auto_download_model  = true
retention_max_age_days = 90
auto_start           = true

Silent end-to-end example

:: 1. Push machine-wide defaults (as SYSTEM via GPO/SCCM)
mkdir "%ProgramData%\WhispAssist"
copy wa-defaults.ini "%ProgramData%\WhispAssist\wa-defaults.ini"

:: 2. Install per-machine, custom location, no UI
msiexec /i WhispAssist_<ver>_x64_en-US.msi INSTALLDIR="C:\Program Files\WhispAssist" /qn

Each user's first launch then seeds their settings.json from the machine-wide file.