Installing or signing in on a managed Windows device

On a corporate or locked-down laptop, one of these happens: Setup.exe won't run, the browser doesn't open when you click Sign in, the pasted login link is empty, or the login hangs forever.

What it means

Endpoint protection software can interfere with the installer, with launching a browser from the tray, and with the clipboard. Reach has a fallback for each; none of them needs admin rights.

Fixes, by symptom

  1. Setup.exe won't run — right-click → Run as administrator, or ask IT to whitelist the installer. Reach itself installs at user level (no elevation needed); it's the endpoint tool blocking the executable, not Windows.
  2. Browser doesn't open when you click Sign in — Ctrl+Click the Sign in to TYO Reach tray item to switch to poll mode, which doesn't require the browser to open at all. You then complete sign-in in any browser (even on another device) and Reach picks it up from the server.
  3. Pasted login link is empty — the clipboard may be blocked. Look in %TEMP%\reach-login.txt; Notepad opens automatically with the URL when clipboard writes fail. Open that link in a browser.
  4. Login hangs indefinitely — switch to poll mode (Ctrl+Click, as above). The default mode waits for a browser callback on localhost, which some security tools block; poll mode asks the server instead.
  5. Microsoft account and the browser sign-in loops — use the in-app Windows sign-in from the tray, which doesn't depend on the browser hand-off, or see AADSTS5000611 if that's the error shown.

Full step-by-step guide, including what to tell IT: Managed Windows devices.

Common questions

Does Reach need a kernel driver or a VPN adapter?

No — that's why it runs on machines where VPN clients are blocked. It configures the browser's proxy settings and nothing below that. See Security.

Will endpoint protection flag Reach as a VPN?

Reach doesn't install a network adapter or driver, so the usual VPN detections don't trigger. Some tools still ask IT to approve any new executable — step 1 covers that.

Can IT push the settings for me?

Yes — team admins push routing policy from the dashboard, and members receive it on sign-in. See Set up your team.

Still stuck?

Get in touch and mention which endpoint protection product the device runs.