Deploying Nutechna Companion with Group Policy, SCCM or Intune

For system administrators deploying to managed workstations. It states what the installer does, everything it writes, and every option it accepts. If the package does something not documented here, that is a defect — please report it.

Product: Nutechna Companion  ·  Publisher: NUTECHNA, INC. (all binaries Authenticode-signed)  ·  Package: NutechnaCompanion-v<version>.msi, Windows Installer, per-machine, x64  ·  Support: support@nutechna.com

Sign in to the customer portal and use Enterprise (MSI) to download the current release. Download for Windows beside it is the single-machine installer and is not intended for fleet deployment.

Deployment checklist

The short version. Each step links to the detail below.

1. Requirements

2. Verify the package before you deploy it

Get-AuthenticodeSignature .\NutechnaCompanion-v<version>.msi | Format-List Status, SignerCertificate

Two things must be true:

• Status: Valid, and
• the subject carries CN="NUTECHNA, INC.", O="NUTECHNA, INC." — that is the identity Microsoft validated, and it is what SmartScreen and UAC read.

The executable inside the package is signed independently — signing only the container would say nothing about the binary that ends up on disk.

3. Installing

Interactive

Double-click the MSI. Wizard: Welcome → install location → Ready → Install. One UAC elevation, naming NUTECHNA, INC. as verified publisher.

Silent

msiexec /i NutechnaCompanion-v<version>.msi /qn /norestart

Silent with logging — use this on the first pilot machine

msiexec /i NutechnaCompanion-v<version>.msi /qn /norestart /l*v C:\Temp\nutechna-install.log

Custom install location

msiexec /i NutechnaCompanion-v<version>.msi /qn INSTALLFOLDER="D:\Apps\Nutechna\Companion"

No reboot is required. The package requests none.

Configuration properties

Set at install time; all optional.

msiexec /i NutechnaCompanion-v<version>.msi /qn ^
        UPDATEMODE=SoftwareCenter ^
        UPDATECONTACT="helpdesk@example.com"

These land in HKLM (§5) and can be changed later by Group Policy without reinstalling.

4. How updates work under a managed install

The application does not update itself when it is installed per-machine. It detects that it cannot write its own install directory — by attempting the write, not by guessing from the path — and will not offer an update button that could not succeed. Instead it shows the version that is available and the instruction you configured.

Confirming what a workstation actually got

After a rollout, ask a machine what it believes about itself rather than walking to it and opening the application:

$p = Start-Process -FilePath "$env:ProgramFiles\Nutechna\Companion\CompanionApp.exe" `
                   -ArgumentList '--install-report' -NoNewWindow -Wait -PassThru

It prints one key=value per line and exits 0:

installDirectory=C:\Program Files\Nutechna\Companion
canSelfUpdate=false
canWriteProgramFiles=false
updateMode=SoftwareCenter
updateContact=helpdesk@example.com
version=0.1.92
managedNotice=Version 0.1.92 is available. Open Software Center to install it - no administrator rights are needed (helpdesk@example.com).

updateMode and updateContact are the values that reached HKLM, so this confirms your UPDATEMODE actually applied. managedNotice is the exact sentence your engineers will be shown — not a description of it — so you can review the wording your helpdesk address appears in before anyone sees it.

Run it as an ordinary user, not as an administrator. canSelfUpdate is measured by attempting a write in the install folder as whoever ran the command, and an administrator genuinely can write %ProgramFiles% — so an elevated prompt correctly reports canSelfUpdate=true and tells you nothing about what your engineers experience. canWriteProgramFiles is printed beside it so you can tell which of the two you are looking at.

Upgrading

Install the newer MSI over the old one — a major upgrade is configured, so the previous version is removed automatically. Do not uninstall first.

msiexec /i NutechnaCompanion-v<newer version>.msi /qn /norestart

5. Exactly what the installer writes

Files

%ProgramFiles%\Nutechna\Companion\CompanionApp.exe      the application (signed) — 46.6 MB
%ProgramFiles%\Nutechna\Companion\.nutechna-install     install marker — 28 bytes

Two files — that is the entire install folder. To confirm before deploying, extract the package without installing it: msiexec /a NutechnaCompanion-v<version>.msi /qb TARGETDIR=C:\Temp\nutechna.

Start Menu

%ProgramData%\Microsoft\Windows\Start Menu\Programs\Nutechna\Nutechna Companion.lnk

Registry — HKLM, written by the installer

HKLM\SOFTWARE\Nutechna\Companion
    UpdateMode      REG_SZ    the UPDATEMODE property
    UpdateContact   REG_SZ    the UPDATECONTACT property
    InstallMode     REG_SZ    "msi"
    Version         REG_SZ    product version
    InstallPath     REG_SZ    resolved install folder

Registry — HKCU, written per user at first run

HKCU\SOFTWARE\Nutechna\Companion    shortcut keypath

Per-user application data — created by the app, not the installer

%LOCALAPPDATA%\Nutechna\companion_settings.json   settings
%LOCALAPPDATA%\Nutechna\                          license state, staged downloads, log files

Written when a user installs the Plant 3D plug-in from the app

Only when a user clicks to install or update the plug-in, with AutoCAD closed — never automatically:

%APPDATA%\Autodesk\ApplicationPlugins\DspJoint2026.bundle\   the plug-in (every binary signed)
HKCU\Software\Autodesk\AutoCAD\<release>\...\Profiles\<profile>\General\TRUSTEDPATHS
                                                     the plug-in folder is appended
Current user's Trusted Publishers certificate store  Nutechna's code-signing certificate, so
                                                     Plant 3D loads the plug-in without a
                                                     security prompt

Written by the plug-in while it runs inside Plant 3D

%LOCALAPPDATA%\DSP\        a tamper-evident clock high-water mark for license integrity (the latest
                          time the plug-in has seen, so a rolled-back clock is detected; no
                          personal data)
%LOCALAPPDATA%\Nutechna\plugin_loaded.json
                          which plug-in build AutoCAD loaded (one file, overwritten each load;
                          the app reads it to confirm an update took effect)
%APPDATA%\DSP\             display and preset settings
HKCU\SOFTWARE\Nutechna\DSP  a second copy of the same clock high-water mark
<your project folder>     the plug-in's own settings: dsp_panel_settings.json, dsp_bom_state.json,
                          dsp_regions.json, Related Files\*_styles.json
%TEMP%\dsp_publish*        when a sheet set is published: the publish list and the plot log, a few
                          small files, each overwritten by the next publish
%TEMP%\dev_ortho.pdf       only when a user runs DSP_PLOTPDF (a plot of the current layout): one
                          file, overwritten

At load the plug-in also sets two AutoCAD options, SSMAUTOOPEN and TRANSPARENCYDISPLAY. It writes no log files.

Temporary files

Listed because a complete answer is the point of this section, and because an inventory sweep will find them.

%TEMP%\.net\CompanionApp\<hash>\    ~18 MB per version ever run. The application ships as a single
                                    file, so the .NET runtime extracts its native libraries here on
                                    the first launch of each version. This is .NET's own behavior and
                                    .NET never removes them.
%TEMP%\Nutechna_Companion_*.log     installer logs. The two most recent are kept for support.

Neither is needed after the run that created it. The application sweeps its own classes at startup, and an administrator can force the sweep without launching the UI:

$p = Start-Process -FilePath "$env:ProgramFiles\Nutechna\Companion\CompanionApp.exe" `
                   -ArgumentList '--housekeeping' -NoNewWindow -Wait -PassThru
$p.ExitCode

It removes only paths matching one of its named classes, prints every path it removed with the reason, and exits non-zero if a removal failed. It never removes the extraction folder the running process is using, and never a file it does not recognize.

Use Start-Process -Wait, not the bare path. The Companion is a graphical application, and Windows does not make a shell wait for one — typing the executable's path directly at a prompt returns in a few milliseconds, before the work is finished, and leaves $LASTEXITCODE unset. That is a property of every windows-subsystem program, not of this one. -Wait blocks until it exits and -PassThru gives you the exit code; -NoNewWindow keeps its output in the console you ran it from. The same applies to the report command above (§4), and to a scripted call from SCCM or a scheduled task.

No services. No scheduled tasks. No drivers. No shell extensions. No startup entries created by the installer.

6. Network requirements — read this before deploying behind a restrictive policy

If outbound access to api.nutechna.com is blocked, the software will not function at all. This is not a degraded mode. License activation, the license heartbeat, license-agreement acceptance and updates all cross this boundary, so a blocked environment produces a product nobody can use. If nutechnadl.blob.core.windows.net is blocked, the Plant 3D plug-in and updates cannot be downloaded — the application signs in, and then has nothing to install. Please confirm both rules below are in place before rolling out.

If your policy requires an allowlist by IP rather than hostname, contact Nutechna support — the service is hosted on Microsoft Azure and addresses can change, so a hostname rule is strongly preferred.

6.1 Required outbound access

Two destinations. That is the whole list.

No inbound rules are required. No non-standard ports are used. The software does not listen on any port and does not accept incoming connections.

6.2 What is NOT sent — for your security review

The software runs on your workstations and works on your files where they are. The following never leave your network:

• drawing files, 3D models, and project files;
• file paths, user documents, or anything scanned from the workstation.

What does cross the boundary is limited to: the user's sign-in email and password; a license identifier, a hashed machine fingerprint and the machine's name for activation and heartbeat; the version of the license agreement a user accepted, with a timestamp (the server records the address it arrived from); version numbers for update checks; and a support report, only when a user chooses to send one, with anything they choose to attach. Drawing files themselves are never uploaded, and nothing goes from a workstation to a third party.

6.3 TLS inspection

An inspecting proxy that re-signs TLS is supported, provided the workstation trusts your proxy's root certificate — normally true on a managed machine. The software's integrity checks do not depend on the transport: downloaded artifacts are verified against our own signing key over the file contents, so inspection does not break them.

If a workstation does not trust the inspection certificate, the software reports that specifically rather than failing generically — see §6.5.

6.4 Proxies

The software uses the Windows system proxy configuration. If your proxy requires authentication, ensure the workstation's system proxy settings supply it; there is no separate proxy configuration inside the application.

6.5 Verifying connectivity before you deploy

Run this on one pilot workstation, as the user who will run the software:

Test-NetConnection api.nutechna.com -Port 443
Invoke-WebRequest https://api.nutechna.com/ -UseBasicParsing | Select-Object StatusCode
Test-NetConnection nutechnadl.blob.core.windows.net -Port 443

TcpTestSucceeded : True on both hosts and StatusCode : 200 mean the required rules are in place.

The Companion also diagnoses this itself and separates the causes, because they belong to different teams:

If a user reports being unable to accept the license agreement, check this table first — a blocked network presents that way, and it is a network condition rather than a software fault.

7. Uninstall

Interactive: Add/Remove Programs → "Nutechna Companion", publisher NUTECHNA, INC.

Scripted. msiexec /x needs the ProductCode, and the ProductCode changes with every version — so there is no single literal we could print here that would be correct on your machines. Resolve it first, then pass it:

$app = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall'
) | Where-Object { Test-Path $_ } |
    ForEach-Object { Get-ChildItem $_ | ForEach-Object { Get-ItemProperty $_.PSPath } } |
    Where-Object { $_.DisplayName -like 'Nutechna Companion*' -and
                   $_.PSChildName -match '^\{[0-9A-Fa-f-]{36}\}$' }

$app.PSChildName                                  # the ProductCode currently installed
Start-Process msiexec -Wait -ArgumentList '/x', $app.PSChildName, '/qn', '/norestart'

From SCCM / Intune: use the uninstall command your management tool recorded at deployment, or detect by the UpgradeCode below — that is what it is for.

Uninstall removes the install folder, the Start Menu shortcut, the HKLM key and the ARP entry. Per-user settings and license state under %LOCALAPPDATA%\Nutechna are intentionally left so a reinstall does not lose a user's configuration. Delete that folder to remove all traces; §5 lists everything, including the temporary files a sweep can reclaim.

8. Detection rules (SCCM / Intune)

9. Troubleshooting