TYO Reach on managed Windows devices
Endpoint protection software — PractiseProtect, Microsoft Defender for Endpoint, Carbon Black, and similar tools — can block the patterns used by many installers and apps. TYO Reach is built to handle these restrictions. This page covers what to expect at each step.
Installing
TYOReach-Setup.exe is designed to work on locked-down machines:
- It writes the app directly to
%LOCALAPPDATA%\TYO Lab\TYO Reach\— no temporary file extraction, no execution from%TEMP%. - It creates Desktop and Start Menu shortcuts using the Windows COM
IShellLinkAPI — no PowerShell subprocess is spawned. - It writes a registry auto-run entry under
HKCU— no admin rights required.
User install (recommended): run TYOReach-Setup.exe and choose
Install for me only. No UAC prompt, no admin rights needed.
All-users install: choose Install for everyone. A UAC elevation prompt appears. If your machine's policy blocks UAC, use the user install instead.
After installation the app tries to start automatically. If that is blocked by endpoint
protection, a dialog shows the install path. Navigate to
%LOCALAPPDATA%\TYO Lab\TYO Reach\ in Explorer and double-click tyoreach.exe to
start it manually. After the first run the auto-run entry starts it at each login.
Signing in
When you click the sign-in item in the tray menu, TYO Reach works through a cascade of fallbacks until one succeeds.
Step 1 — Browser opens automatically
On most machines the login page opens in your default browser and you sign in normally. After sign-in the browser redirects back to a local address and the tray completes the flow automatically.
Step 2 — Copy the login link manually
If endpoint protection blocks the browser launch, the tray menu item changes to:
Copy login link (localhost:PORT) — click to copy
Click it to copy the login URL to your clipboard, then paste it into any browser
window and sign in. The port shown (localhost:PORT) is the local callback address the
tray is listening on — the browser uses it to hand back the auth code automatically
after you sign in.
Step 3 — Notepad opens with the link
If the clipboard is also blocked, TYO Reach writes the login URL to
%TEMP%\reach-login.txt and opens it in Notepad. Copy the URL from Notepad and paste
it into your browser.
Step 4 — Dialog with the link
If Notepad cannot be launched, a dialog appears showing the full URL. Press Ctrl+C inside the dialog to copy its contents, then paste into a text editor to extract the URL.
The login URL is also written to the log file at every sign-in attempt — see Finding the log file below.
Poll mode
In the default login flow the browser redirects to localhost:PORT after sign-in. If
endpoint protection blocks loopback connections from the browser, this redirect never
arrives and the tray waits indefinitely.
Poll mode removes the loopback dependency entirely. Instead of a local callback,
the server stores the auth code and the tray polls for it every two seconds — no
localhost connection is needed.
To switch to poll mode: Ctrl+Click the sign-in item in the tray menu. The label changes:
| Label | Mode |
|---|---|
| Sign in to TYO Reach | Default (browser + localhost callback) |
| Sign in | Poll mode (copy-paste only, no localhost) |
Ctrl+Click again to switch back. The mode persists until you change it.
In poll mode, clicking Sign in immediately shows the copy/Notepad/dialog cascade described above — the tray never tries to open a browser or wait on a localhost connection.
Finding the log file
TYO Reach tries three locations in order and uses the first one it can write to:
%LOCALAPPDATA%\TYOReach\reach.log%APPDATA%\TYOReach\reach.log%TEMP%\TYOReach\reach.log
The very first line of the log records which path is in use, e.g.:
2026/07/19 09:14:01 [log] file: C:\Users\vicky\AppData\Local\TYOReach\reach.log
Every sign-in attempt logs the full login URL, so if all clipboard and Notepad fallbacks fail you can retrieve the URL directly from the log file.
Troubleshooting
| Symptom | What to try |
|---|---|
| Setup.exe won't run | Right-click → Run as administrator, or ask IT to whitelist the file |
| Tray icon never appears after install | Navigate to %LOCALAPPDATA%\TYO Lab\TYO Reach\ and double-click tyoreach.exe |
| Browser doesn't open when clicking sign in | Ctrl+Click the sign-in item to switch to poll mode |
| Login link paste is empty (clipboard blocked) | Check %TEMP%\reach-login.txt — Notepad should have opened it automatically |
| Login hangs indefinitely | Switch to poll mode; no localhost callback is needed in that mode |
| Can't find the login URL anywhere | Open the log file (see above) — the URL is written there on every attempt |
Still stuck? Get in touch with your log file attached and we'll help diagnose what's being blocked.