Here's a list of common installation options for Cylance. Note that they can also be used with the Cylance Unified installation MSI. Replace <PIDKEY> with the tenant's installation key.

New tenant installation (so Cylance will be running in "learning mode" for a few weeks), where clients are using Windows Defender as the primary AV:

msiexec.exe /i "CylanceProtect_x64.msi" ALLUSERS=1 /qn /norestart /log output.log PIDKEY=<PIDKEY> LAUNCHAPP=1 REGWSC=0

Existing tenant (which is past the "learning period") or a new tenant where clients are using another (supported) anti-virus as the primary AV:

msiexec.exe /i "CylanceProtect_x64.msi" ALLUSERS=1 /qn /norestart /log output.log PIDKEY=<PIDKEY> LAUNCHAPP=1

Servers (does not auto-start the Cylance systray app):

msiexec.exe /i "CylanceProtect_x64.msi" ALLUSERS=1 /qn /norestart /log output.log PIDKEY=<PIDKEY> LAUNCHAPP=0

Installation for VDI, where the client is installed on the master image. In this particular case, the master image is domain-joined (e.g., used with VMware Instant Clone or a Linked Clone which is domain-joined). Optionally, add REGWSC=1 if Windows Defender is the primary AV.

msiexec.exe /i "CylanceProtect_x64.msi" ALLUSERS=1 /qn /norestart /log output.log PIDKEY=<PIDKEY> AD=1 LAUNCHAPP=0

Some additional explanation about the parameters

In case of new tenants, where the tenant has to run in "learning mode" for several weeks, it is important that the existing anti-virus solution remains active. If the primary anti-virus is Windows Defender, a regular installation of Cylance on Windows 10 clients would disable Windows Defender. Use REGWSC=0 to avoid registering Cylance as the primary anti-virus, leaving Windows Defender fully functional.

For VDI setups, the VDI=x and AD=1 parameters control how registration in the cloud platform is handled. This is particularly important with non-persistent desktops where it is necessary to take particular care to avoid multiple registration of the same machine. A rule of thumb is to use VDI=x (where x is the number of reboots before a desktop clone is fully deployed) for non-domain joined master images, and AD=1 for domain-joined master images.