Controlling updates
When the app updates itself, how to disable that by policy and what users see
When the app updates itself
The app can only update itself if it is allowed to replace its own installation. With the MSI that is not the case: it installs for all users of the device into C:\Program Files, where a standard user cannot write. A self-update would therefore not replace the managed installation, it would create a second copy inside the user profile.
The app detects this and turns automatic updates off. At startup it checks:
- Does the program live in
C:\Program Files(Windows) or in an application bundle the signed-in user cannot write to (macOS)? - Has an administrator disabled updates by policy?
If either applies, the app never checks for new versions and the update button does not appear. Rolling out new versions is then entirely up to you.
On the Mac this comes down to how tightly you lock /Applications. If the application bundle stays writable for the signed-in user, the app keeps itself up to date even when you deployed it through an MDM. If you want to control the timing anyway, set the policy in the next section.
Disabling automatic updates by policy
This policy applies regardless of the installation location, so it also covers an installation inside the user profile.
Windows. Value DisableAutoUpdate (REG_DWORD) under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\DeutschlandGPT. 1 disables updates, 0 or a missing value allows them. The same path under HKEY_CURRENT_USER is read as well, in case you want the policy to apply to individual users only.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\DeutschlandGPT]
"DisableAutoUpdate"=dword:00000001
Deploy it as a registry preference in a group policy, or as a PowerShell script in Intune:
New-Item -Path 'HKLM:\SOFTWARE\Policies\DeutschlandGPT' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\DeutschlandGPT' `
-Name 'DisableAutoUpdate' -PropertyType DWord -Value 1 -Force | Out-Null
macOS. Create the file /Library/Application Support/DeutschlandGPT/managed-config.json. It deliberately sits outside the user profile so that only administrative processes and MDM payloads can write it.
{
"disableAutoUpdate": true
}
The policy is read when the app starts, so a change takes effect on the next launch.
What users see
As long as the installed version is supported, nothing changes: the app works normally, it simply stops offering updates.
If the installed version falls below the minimum supported version, the app shows a window that cannot be dismissed. On a managed installation that window has no update button. Instead it shows the installed version, the required version, a note to contact IT, and a link to the matching installer they can forward.
Plan your rollout with lead time. Managed devices cannot get themselves out of this state: if the minimum version is raised before your rollout completes, affected users cannot use the app until you deploy the new build. We announce increases to the minimum version in advance, so talk to us if you need a longer window.
Detecting new versions
To find out whether a newer version exists without a JSON parser, use the version endpoint:
curl -fsL https://www.deutschlandgpt.de/api/desktop/version/windows-msi
That works well as a condition in a scheduled task, an Intune script or a Jamf extension attribute. The full list of stable URLs is in the overview.
Network
Updates use their own addresses, which have to be allowed separately from the running app. The full list is on Network requirements.