Cloudflare One Client for Windows beta adds tamper protection: uninstall needs an admin code

Hi, it's Shii-chan!

Cloudflare Changelog developers.cloudflare.com

A new beta of the Cloudflare One Client for Windows is out, with a tamper-protection feature admins will like!

What was announced?

The Cloudflare Changelog announced a Beta of the Cloudflare One Client for Windows (version 2026.9.1555.1), available on the beta releases downloads page.

The story so far

Previously, the client ignored tunnel MTUs of 1147-1199 bytes found by Path MTU Discovery and kept a larger one. On networks like mobile hotspots, that could drop larger packets while the client showed as connected.

What changes

Three highlights:

• Automatic endpoint selection for Global Acceleration. When enabled for an organization, the client uses Global Acceleration endpoints inside the acceleration region and standard anycast endpoints elsewhere, reconnecting when the network changes
• Protection against unauthorized modification or uninstallation. When enabled, uninstalling asks for an administrator-generated code and is otherwise blocked
• A banner when the network limits the tunnel MTU to a degraded or critically low value, cleared when it recovers or the client disconnects

The Connectivity page shows the endpoints in use, and permitted users can choose endpoints in Settings.

Dive Deep

Connectivity improvements

• The client applies tunnel MTUs of 1147-1199 bytes
• With Path MTU Discovery enabled, it accepts larger packets from Cloudflare
• Access reauthentication trusts the OS certificate store, so it works with TLS inspection
• For Zero Trust, it records a traceroute outside the tunnel when the tunnel degrades or fails to connect, included in warp-diag
• In Zero Trust proxy mode, HTTP/HTTPS and SOCKS5 hostnames are resolved by Cloudflare

New MDM parameters

• mdm_file_debounce_secs (1-60): wait before applying a changed MDM file
• mdm_file_unavailable_debounce_secs (0-300): wait before acting on a missing or unreadable MDM file
• managed_network_probe_interval_secs (30-300, default 30): interval for rechecking for a managed network
• managed_network_probe_count (0 disables, 1-10, or -1 until found; default 1): number of rechecks. 0 restores the previous behavior

Windows-specific improvements and fixes

• The installer no longer asks users to close applications during upgrades, downgrades, or uninstalls
• The UI no longer starts WMIC or PowerShell to collect memory data for crash reports
• Fixed a blank or white client window after an upgrade, sign-in, sleep, or display change
• Fixed the service restarting when a captive portal firewall update stalls during sleep
• Fixed Windows on Arm devices getting stuck disconnected due to leftover tunnel adapters
• Fixed upgrade/downgrade sequences between consumer and Zero Trust registrations blocking connection (the mismatched registration is cleared)
• The UI now loads libraries from the installation directory before a user-writable directory
• Windows Wi-Fi adapters are no longer reset when Exclude split tunnel firewall rules block Windows connectivity checks, which the client now allows
• Hostname-based split tunnel entries now take effect immediately even if their firewall rule failed
• Fixed warp-cli registration license reporting an error on slow networks and DEX timestamp offsets

Known issue

A Windows DNS client regression may cause connectivity check failures on systems with large hosts files. The client includes a mitigation, but you may still see reduced DNS performance and failures.

Wrap-up

• Global Acceleration endpoints are selected automatically, with auto-reconnect on network changes
• When enabled, uninstalling needs an admin-generated code
• A low-MTU banner and support for 1147-1199 byte MTUs
• New MDM parameters and many Windows-specific fixes
• Watch out for the DNS-related known issue on systems with large hosts files

This one is for IT admins managing Windows devices with Cloudflare One!