FlexApp One Command Line Reference

ℹ️ FlexApp One Command Line Reference — For Administrators & Deployment Engineers

This article documents every available command line argument for FlexApp One application packages (.exe) and the FlexApp One Bundler CLI (bundler.exe). Arguments control service installation, layer activation, shortcut delivery, file associations, package maintenance, diagnostics, and deployment scenarios such as Microsoft Intune, Citrix, and Microsoft AVD. The Bundler CLI covers package creation, migration, and code signing credential management.

Many arguments are designed to be combined in a single command line. The sections in this article group arguments by function to help you identify which ones apply to your use case, followed by a complete quick reference table.

📄 Contents

› Overview
› Service Installation & Driver Management
› Layer Activation & Launch
› Shortcut & File Association Delivery
› Application Lifecycle & Package Maintenance
› Package Extraction & Inspection
› Diagnostics & Logging
› Performance & Timeout Tuning
› Bundler CLI (bundler.exe)
› Common Deployment Scenarios
› Complete Argument Reference

Overview

Each FlexApp One application is a self-contained executable (.exe) that embeds the application's VHDX, XML manifest, and ICO files. Arguments passed to that executable at runtime control every aspect of how the package is delivered, managed, and maintained. There is no separate configuration file — all delivery behavior is driven from the command line.

Arguments can be combined freely on a single command line unless a specific restriction is documented. Bracketed placeholders in argument syntax (such as <path> or <#>) represent values you supply; do not type the angle brackets themselves.

Package (.exe) arguments fall into eight functional groups:

Service Installation & Driver Management
Layer Activation & Launch
Shortcut & File Association Delivery
Application Lifecycle & Package Maintenance
Distribution & Deployment
Package Extraction & Inspection
Diagnostics & Logging
Performance & Timeout Tuning

The Bundler CLI (bundler.exe) is a separate tool installed with the FlexApp Packaging Console. It is used to build new package executables, migrate existing packages to updated internal components, and manage code signing credentials. See the Bundler CLI section for full details.

⚠️ Elevation required for installation arguments
Arguments that require elevation (--install, --upgrade, --uninstall) must be run from an elevated command prompt or a system-level deployment context such as Microsoft Intune or SCCM. They should generally be used as standalone arguments without combining them with delivery arguments.

Service Installation & Driver Management

These arguments manage the FlexApp service (LWLContainerService) and the VirtFs kernel driver. They are typically run once during endpoint provisioning or when upgrading the FlexApp One stack.

Argument	When to Use	Notes / Combinations
--install	Initial provisioning of an endpoint. Installs both the LWLContainerService and the VirtFs driver.	Must be run elevated. Use as the only argument — do not combine with delivery arguments. When deploying via Intune or SCCM, set as a prerequisite step before any package deployment.
--upgrade	Updating the FlexApp service and driver on an endpoint that already has a prior version installed.	Behaves identically to --install if the service does not exist. Requires elevation. Combine with --reboot if an automatic reboot is required after upgrade.
--keepfsfilter	Upgrading the service while intentionally retaining the existing filter driver version.	Must be paired with --install. Use when the filter driver version is pinned by policy or when a newer driver has a known compatibility issue in the environment.
--uninstall	Decommissioning an endpoint or removing FlexApp One entirely.	Stops and removes both the service and driver. Must be run elevated and used as the only argument. Ensure all active FlexApp One packages have been stopped before running.
--reboot	Automatically rebooting after a service upgrade completes.	Use with --upgrade. Default is false. In silent deployment pipelines that expect a clean post-upgrade state, add this to avoid a pending-reboot condition.

Layer Activation & Launch

These arguments control whether and how a FlexApp One layer is activated (mounted) and whether the application inside it is launched immediately.

Argument	When to Use	Notes / Combinations
--index <#>	Activating the layer and launching a specific application shortcut by its index number from the package XML <Links> section.	Index numbers correspond to <Link> entries in the package XML, starting from 0. Use 999 to mount the layer without launching any shortcut — useful for file associations and context menus where the layer needs to be available but the user triggers the launch manually.
--skipactivation	Running delivery tasks (shortcut creation, file associations, registry registration) without mounting the layer.	Use with --ctl, --addtostart, or --assoc when you need to provision shortcut and association infrastructure without the overhead of mounting the VHDX at deployment time. The layer activates on first user launch.
--startup	Persisting the package launch across logons by adding it to HKCU\Run.	Registers the package executable with all subsequent arguments as a logon item. Use in persistent VDI or physical desktop deployments where the application should be available automatically at every logon.
--outofband	Relaunching the package under the local SYSTEM account.	Used in scenarios where the package must run as SYSTEM rather than the logged-on user. When a package runs as SYSTEM, behavior is equivalent to the --system flag being active automatically.
--stop	Cleanly stopping a running application layer and unmounting it from the OS.	Always run --stop before --replace, --clean, or --remove. These operations require the layer to be unmounted first.
--args	Passing launch arguments through to the packaged application's own executable.	Arguments are passed to the packaged binary, not to the FlexApp One engine itself. Use when the application inside the FlexApp package accepts command line arguments that must be forwarded at runtime (e.g., opening a specific file or URL).
--sessionisolate	Enabling per-session isolation for the packaged application.	Use in RDSH and multi-session AVD environments where multiple users may run the same FlexApp One package concurrently and must not see each other's write layer changes within the session.
--persist	Persisting changes made to the application's files during the session back into the package.	Use when the application writes data to its own installation directory that must be retained across sessions. Do not combine with --clean.

Shortcut & File Association Delivery

These arguments control how the application presents itself to the user — through shortcuts, Start Menu entries, file type associations, and the system tray icon.

Argument	When to Use	Notes / Combinations
--ctl	Creating a Click-to-Layer shortcut on the Desktop and Start Menu so the user can launch the application on demand.	The shortcut activates the layer and launches the application on click. Combine with --index 999 to create the shortcut and pre-mount the layer without immediately launching it.
--addtostart	Adding the FlexApp One package to Start Menu > Programs > FlexApp One as a secondary access point.	Use --skipactivation to create the Start Menu entry without mounting the layer at deployment time.
--system	Creating shortcuts in Public (all-user) areas instead of per-user areas.	Shortcuts go to Public Desktop and All Users Start Menu. The --reg key is written to HKLM instead of HKCU. Packages running as LOCAL SYSTEM activate this behavior automatically.
--assoc "<.ext\|index#\|args>"	Registering file type associations for extensions handled by applications inside the FlexApp One package.	Always combine with --skipactivation. Syntax supports three pipe-separated components: Extension (e.g., `.txt`), Index (e.g., `0`), Args (optional launch flags). Use `browser` as the extension value to set the default browser association.
--hidetray	Suppressing the FlexApp One system tray icon for a specific package.	Use in kiosk, published application, or task worker environments where the tray icon would confuse users or is prohibited by desktop policy.
--admin	Enabling additional options in the system tray icon for administrative and diagnostic purposes.	Use during testing or when an administrator needs tray-level access to version information or layer controls. Not intended for production end-user deployments.
--printshortcuts	Outputting the list of shortcuts defined in the package XML to a file for review.	Combine with --skipactivation and redirect output to a text file. Useful for verifying index numbers before configuring --index or --assoc. Example: `App.exe --skipactivation --printshortcuts > AppShortcuts.txt`

Application Lifecycle & Package Maintenance

These arguments manage the operational lifecycle of a deployed FlexApp One package, including updating, cleaning up, and removing it from an endpoint.

Argument	When to Use	Notes / Combinations
--replace <path>	Updating a running FlexApp One application in place with a newer version without requiring the user to manually stop the old one.	Run the new package.exe and supply the path to the old package.exe as the argument. The new package takes on the name of the old package after replacement. Best practice: use a simple, version-agnostic name as the final application name (e.g., `Notepad++.exe`). Example: `NewApp.exe --stop --replace C:\LocalCopy\OldApp.exe`
--sync <path>	Copying the FlexApp One package EXE to a local path using a block-level copy before activation.	Target path must be an existing folder. Combine with delivery arguments to perform the copy and activate in a single command. Example: `\\server\share\App.exe --sync C:\FlexApps\App.exe --ctl --index 999`
--clean	Removing shortcuts, the registration key, and the write cache for the package.	Must be run with or after --stop. Do not combine with --persist.
--remove	Deleting the FlexApp One EXE file from the endpoint disk.	Use as the final step in package decommission after running --stop and --clean. Requires --stop to be run first.
--reg	Creating a per-user registration key in HKCU\Software\FlexApp\App.exe\%username% to record that the package has been deployed for this user.	Primary use case: Microsoft Intune user-targeted detection rule. Combine with --system to write to HKLM instead for machine-targeted detection.

Package Extraction & Inspection

These arguments extract the embedded components from a FlexApp One EXE for inspection, editing, re-importing into the FlexApp Packaging Console, or cloning.

ℹ️ Non-destructive
Extraction does not modify or damage the source EXE. The extracted files (VHDX, ICO, XML) are placed in the specified target path. Use --extract as the primary argument and add --skip* flags to omit specific components.

Argument	When to Use	Notes / Combinations
--extract <path>	Pulling the VHDX, ICO, and XML files out of the package for editing, cloning, or re-import into the FlexApp Packaging Console.	The target path must exist before running the command. After extraction, the XML and VHDX can be modified in the Packaging Console and a new package can be built.
--skipdisk	Extracting the XML and ICO only, without the VHDX.	Must be combined with --extract. Use when you only need the manifest XML (e.g., to review or modify shortcut definitions) and don't want to copy a potentially large VHDX.
--skipico	Extracting the VHDX and XML without the ICO file.	Must be combined with --extract.
--skipxml	Extracting the VHDX and ICO without the XML manifest.	Must be combined with --extract.
--mapicons	Extracting individual ICO files for each shortcut defined in the package XML.	Must be combined with --extract. Each ICO is named to correspond with its <link> entry.
--diskpath <path>	Overriding the default VHDX mount path.	Default: `C:\ProgramData\Liquidware\Flexapp\Shadows`. Change only when the default path is on a volume with insufficient space or when security policy requires VHDX mounts on a specific drive.

Diagnostics & Logging

These arguments control log output and diagnostic verbosity. They are primarily used during troubleshooting and should generally not be active in production deployments.

Argument	When to Use	Notes / Combinations
--logpath <path>	Redirecting FlexApp One engine log output to a specific directory.	Use during testing or when logs need to be written to a monitored or shared location for review by Liquidware Support. The target directory must exist.
--debug	Running the FlexApp One engine in debug mode for verbose log output.	Can be combined with --console to also print debug output to the console window. Revert to normal mode after troubleshooting — debug mode generates high log volume.
--console	Printing log output to the console window in real time.	Use alongside --debug when testing from an interactive command prompt. Useful for immediate feedback without opening a separate log file.

Performance & Timeout Tuning

These arguments tune timing and performance behavior of the FlexApp One engine. Default values are appropriate for most environments. Adjust only when a specific observed behavior warrants it.

Argument	When to Use	Notes / Combinations
--blockcachesize <bytes>	Tuning the read request block size for VHDX I/O.	Default: 40 blocks. Adjust on engineering guidance when VHDX read performance is suboptimal for a specific storage type (e.g., high-latency network storage vs. local NVMe).
--authtimeout <seconds>	Setting the OAuth user authentication request timeout.	Default: 500 seconds. Relevant only when FlexApp One is used with Zero Trust / OAuth-protected package delivery.
--linktimeout <seconds>	Setting the timeout for waiting for the target binary to become available after the layer mounts.	Default: 120 seconds. Increase if the application binary takes longer than 2 minutes to become accessible after VHDX mount on slow storage.
--priorityboost	Enabling CPU priority elevation for the FlexApp One engine and the foreground application process.	Use when CPU contention on a shared RDSH host is causing FlexApp One layer operations to be slow relative to other processes. Review dynamic priority management in VirtFsService.exe.config alongside this setting.

Bundler CLI (bundler.exe)

The FlexApp One Bundler is a separate command-line tool installed with the FlexApp Packaging Console. It handles three operations: building new package executables from captured content, migrating existing packages to update their internal engine components, and storing code signing credentials for automated signing workflows.

ℹ️ Tool location
C:\Program Files (x86)\Liquidware Labs\FlexApp Packaging Console\FlexApp One Bundler\bundler.exe

Run bundler.exe --help to display top-level command help, or bundler.exe <command> --help for per-command option details.

Bundler Commands

Command	Alias	Description
bundle	b	Bundles a FlexApp capture (VHDX + XML + ICO) into a self-contained FlexApp One package executable. This is the primary build step after application capture is complete in the Packaging Console.
migrate	m	Migrates one or more existing FlexApp One package executables to update their internal engine components and options without requiring a full re-capture. Use this after a FlexApp One version upgrade to refresh the engine binary embedded in older packages.
setsigningcredential	s	Stores the code signing certificate password so it is available for future signing operations without requiring it to be passed on the command line each time.

migrate Command Options

The migrate command accepts one or more source package paths and produces a new target executable containing the updated engine. Multiple --packagepath flags can be specified to process a batch of packages in a single invocation.

Usage syntax:

    bundler.exe -m --migrate -p <packagepath> [-p <packagepath> ...] [-f <fapath>] -t <targetexecutable>
  

Option	Short	Default	Description
--packagepath <path>	-p	Required	Path to the source FlexApp One package EXE to migrate. Repeat this flag for each package when processing multiple packages in a single command.
--targetexecutable <path>	-t	Required	Full output path for the migrated package EXE. The parent directory must exist.
--fapath <path>	-f	—	Optional. Path to the FlexApp engine binary (fa.exe) to embed during migration. Use when targeting a specific engine version rather than the one bundled with the installed Packaging Console.
--icofile <path>	-i	—	Optional. Overrides the ICO file embedded in the source package during migration. Use to update application icons without a full re-capture.
--certfile <path>	-c	—	Path to the code signing certificate (.pfx). When supplied, the output package EXE is signed using this certificate. Combine with setsigningcredential to avoid supplying the certificate password interactively.
--logpath <path>	-l	—	Redirects bundler log output to the specified directory. Useful for capturing migration results in automated pipeline runs.
--expirationdate <date>	-e	—	Sets an expiration date for the package. After this date the package will refuse to activate. Use for time-limited software entitlements or controlled rollout windows.
--appid <guid>	—	—	Application ID (GUID) for the OAuth provider used with Zero Trust / OAuth-protected package delivery. Example format: `f81d4fae-7dec-11d0-a765-00a0c91e6bf6`.
--nocallhome	—	false	Disables telemetry callbacks from the migrated package. Use in air-gapped or strict network-egress-controlled environments where outbound connections to Liquidware are not permitted.
--seticon	—	true	Controls whether the application icon is set on the output EXE. Set to false to skip icon assignment during migration (e.g., when the icon will be applied separately via a signing or branding pipeline step).
--licfile <path>	—	—	Path to a Liquidware license file to embed in the migrated package. Use when the package is being prepared for delivery in a licensed or subscription-gated deployment.

Bundler Deployment Scenarios

Migrate a Single Package to the Current Engine Version

    bundler.exe migrate -p C:\Packages\Notepad++.exe -t C:\Packages\Notepad++_migrated.exe
  

Produces a new EXE at the target path with the engine binary updated to match the currently installed Packaging Console version. The original package is not modified.

Migrate Multiple Packages in a Single Pass

    bundler.exe migrate -p C:\Packages\App1.exe -p C:\Packages\App2.exe -p C:\Packages\App3.exe -t C:\Packages\Migrated\
  

Processes all three packages in sequence. When the target is a directory path, each output EXE retains its source filename. Use this pattern in post-upgrade maintenance scripts to refresh an entire package library.

Migrate and Sign in One Step

    bundler.exe migrate -p C:\Packages\Notepad++.exe -t C:\Output\Notepad++.exe -c C:\Certs\CodeSign.pfx -l C:\Logs\migrate
  

Migrates the package, applies the code signing certificate, and writes the migration log to the specified directory. Run bundler.exe setsigningcredential first to store the certificate password so this command runs unattended.

Migrate with OAuth App ID for Zero Trust Delivery

    bundler.exe migrate -p C:\Packages\Notepad++.exe -t C:\Output\Notepad++.exe --appid f81d4fae-7dec-11d0-a765-00a0c91e6bf6
  

Embeds the OAuth application ID required for Zero Trust / OAuth-protected delivery. The GUID must match the application registration in your OAuth provider (e.g., Azure AD app registration).

Migrate and Replace the Embedded Icon

    bundler.exe migrate -p C:\Packages\Notepad++.exe -t C:\Output\Notepad++.exe -i C:\Icons\Notepad++_updated.ico
  

Replaces the ICO embedded in the source package with the specified file during migration. Use to push an updated application icon without requiring a full re-capture in the Packaging Console.

Common Deployment Scenarios

Intune / SCCM — Silent Machine-Wide Deployment (First Run)

    App.exe --install

    App.exe --sync C:\FlexApps\App.exe --ctl --index 999 --reg --system

Step 1 installs the service and driver. Step 2 copies locally, creates an all-user shortcut, mounts the layer, and registers the detection key in HKLM.

Intune — User-Targeted Deployment with Detection Rule

  App.exe --ctl --index 999 --reg

Configure the Intune detection rule to look for: HKCU\Software\FlexApp\App.exe\%username%

Shortcut + File Associations Only (No Layer Mount at Deploy Time)

    App.exe --ctl --addtostart --assoc ".doc|0" --assoc ".docx|0" --skipactivation
  

Creates shortcut, Start Menu entry, and file associations. Layer mounts on first user launch.

In-Place Application Update

  NewApp.exe --stop --replace C:\FlexApps\OldApp.exe

Copy the new package to the same local path first, then run this command. Stops the old layer and replaces the EXE atomically.

Package Decommission / Cleanup

    App.exe --stop

    App.exe --clean

    App.exe --remove

Run in sequence: unmount the layer, remove shortcuts and write cache, then delete the EXE from disk.

Verify Shortcut Index Numbers Before Configuring --assoc or --index

    App.exe --skipactivation --printshortcuts > C:\Temp\AppShortcuts.txt
  

Review the output file to confirm index numbers before setting --assoc or --index values.

Extract Package for Re-Import or Editing

    App.exe --extract C:\Extracted\App --skipdisk

    App.exe --extract C:\Extracted\App

First variant extracts only the XML and ICO for manifest review or shortcut edits. Second variant extracts all three components for a full clone or re-import.

Complete Argument Reference

Every FlexApp One package command line argument and Bundler CLI option for quick lookup. Refer to the sections above for full context and combination guidance.

Package executable (App.exe) arguments

Argument	Syntax	Description
--admin	App.exe --admin	Enables additional administrative options in the system tray icon for this package.
--install	App.exe --install	Installs the FlexApp service (LWLContainerService) and VirtFs driver. Requires elevation. Use as the only argument.
--upgrade	App.exe --upgrade	Upgrades the FlexApp service and driver. Behaves as --install if the service does not exist. Requires elevation.
--keepfsfilter	App.exe --install --keepfsfilter	Retains the existing filter driver version when installing a newer service. Must be used with --install.
--uninstall	App.exe --uninstall	Stops and removes the FlexApp service and driver. Requires elevation. Use as the only argument.
--reboot	App.exe --upgrade --reboot	Reboots after upgrade completes. Default: false. Use with --upgrade.
--startup	App.exe --startup [other args]	Adds the package to HKCU\Run so it launches at every logon with any subsequent arguments included.
--index <#>	App.exe --index 0	Mounts the layer and launches the shortcut at index #. Use 999 to mount without launching any shortcut.
--ctl	App.exe --ctl --index 999	Creates a Click-to-Layer shortcut on the Desktop and Start Menu.
--addtostart	App.exe --addtostart --skipactivation	Adds the package to Start Menu > Programs > FlexApp One.
--stop	App.exe --stop	Stops the running layer and unmounts it from the OS. Required before --replace, --clean, and --remove.
--replace <path>	NewApp.exe --stop --replace C:\old\OldApp.exe	Replaces and restarts the application with a new version. The new EXE takes the old EXE's name after replacement.
--reg	App.exe --ctl --index 999 --reg	Creates a registration key at HKCU\Software\FlexApp\App.exe\%username%. Use with --system for HKLM.
--clean	App.exe --stop --clean	Removes shortcuts, registration key, and write cache. Do not use with --persist.
--sync <path>	\\srv\App.exe --sync C:\FA\App.exe --ctl --index 999	Block-level copy of the EXE to a local folder. Target folder must exist.
--system	App.exe --system --ctl --index 999	Creates shortcuts in Public (all-user) areas. Writes --reg key to HKLM. Automatic when running as LOCAL SYSTEM.
--remove	App.exe --stop --remove	Deletes the FlexApp One EXE from the endpoint disk. Requires --stop.
--skipactivation	App.exe --ctl --skipactivation	Performs runtime commands (shortcuts, associations, registry) without mounting the layer.
--assoc "<.ext\|idx\|args>"	App.exe --assoc ".txt" --skipactivation	Registers file type associations. Always combine with --skipactivation.
--extract <path>	App.exe --extract C:\Out	Extracts the embedded VHDX, ICO, and XML from the package to the specified folder.
--skipdisk	App.exe --extract C:\Out --skipdisk	Skips VHDX extraction. Use with --extract.
--skipico	App.exe --extract C:\Out --skipico	Skips ICO extraction. Use with --extract.
--skipxml	App.exe --extract C:\Out --skipxml	Skips XML extraction. Use with --extract.
--mapicons	App.exe --extract C:\Out --mapicons	Extracts individual ICO files per shortcut link. Use with --extract.
--diskpath <path>	App.exe --diskpath D:\Mounts --index 0	Sets the VHDX mount path. Default: C:\ProgramData\Liquidware\Flexapp\Shadows.
--printshortcuts	App.exe --skipactivation --printshortcuts > out.txt	Prints package shortcut index list to output. Use with --skipactivation.
--logpath <path>	App.exe --logpath "C:\Logs" --index 0	Redirects engine log output to the specified directory.
--debug	App.exe --debug --console --index 0	Enables debug-level log verbosity. Combine with --console for real-time output.
--console	App.exe --debug --console --index 0	Outputs engine log to the console window. Use with --debug.
--persist	App.exe --persist --index 0	Persists application file changes back to the package. Do not combine with --clean.
--sessionisolate	App.exe --sessionisolate --index 0	Enables per-session isolation. Use in RDSH and multi-session AVD environments.
--hidetray	App.exe --hidetray --index 0	Hides the system tray icon for this package.
--args	App.exe --index 0 --args /open file	Passes launch arguments through to the application inside the package.
--blockcachesize <bytes>	App.exe --blockcachesize 80 --index 0	Sets the VHDX read block size. Default: 40.
--authtimeout <sec>	App.exe --authtimeout 300 --index 0	Sets the OAuth authentication timeout. Default: 500 seconds.
--linktimeout <sec>	App.exe --linktimeout 180 --index 0	Sets the timeout for the target binary to appear after mount. Default: 120 seconds.
--priorityboost	App.exe --priorityboost --index 0	Enables CPU priority elevation for the engine and foreground application process.
--outofband	App.exe --outofband	Relaunches the package as the local SYSTEM account.

Bundler CLI (bundler.exe) commands

Command	Alias	Syntax	Description
bundle	b	bundler.exe bundle [options]	Bundles a FlexApp capture (VHDX + XML + ICO) into a self-contained package EXE.
migrate	m	bundler.exe migrate -p <pkg> -t <out>	Updates the internal engine components of one or more existing package EXEs. See options table below.
setsigningcredential	s	bundler.exe setsigningcredential	Stores the code signing certificate password for use in future unattended signing operations.

Bundler CLI (bundler.exe migrate) options

Option	Short	Default	Description
--packagepath	-p	Required	Source FlexApp One package EXE path. Repeatable for batch migration.
--targetexecutable	-t	Required	Output path for the migrated package EXE.
--fapath	-f	—	Optional path to a specific FlexApp engine binary (fa.exe) to embed.
--icofile	-i	—	Overrides the embedded ICO during migration.
--certfile	-c	—	Code signing certificate (.pfx) path. Signs the output EXE when supplied.
--logpath	-l	—	Redirects bundler log output to the specified directory.
--expirationdate	-e	—	Sets a package expiration date. Package will not activate after this date.
--appid	—	—	OAuth provider application ID (GUID) for Zero Trust delivery.
--nocallhome	—	false	Disables telemetry callbacks from the migrated package.
--seticon	—	true	Controls whether the application icon is applied to the output EXE.
--licfile	—	—	Path to a Liquidware license file to embed in the migrated package.

Product	Liquidware FlexApp / ProfileUnity
Component	FlexApp One / FlexApp One Bundler
Applies To	FlexApp One 6.x and later
Updated	May 28, 2026