Windows PAC Merging Guide

This guide describes how to deploy WitnessAI Witness Anywhere to Windows devices in environments that already run their own WPAD/PAC (Proxy Auto-Config). The deployment uses two PowerShell scripts. Unlike the standard Witness Anywhere paths, PAC Merging never writes or modifies any proxy/PAC setting on the device — your existing PAC remains the single source of truth. The endpoint only installs the Root CA, registers the device, and stands up a local stunnel listener; you then merge the Witness AI routing block into your own PAC.

Lifecycle Overview

The deployment follows below lifecycle:

The registration script runs on a device, installs the WitnessAI Root CA certificate to the Local Machine trusted root store, generates a device fingerprint, registers with WitnessAI, writes configuration to the user's registry, and deploys stunnel for encrypted proxy communication. It does not apply a PAC URL, set AutoConfigURL/AutoDetect, or modify Firefox/IE proxy settings.
The flush script can be assigned on-demand to remove stunnel, delete the WitnessAI registry marker. It deliberately does not reset system proxy settings, clear AutoConfigURL, or modify your PAC — so your existing proxy routing stays intact.

Generate Witness Anywhere Registration Scripts

To register devices with Witness Anywhere you must first create a PAC Token, then download the PAC registration scripts. The PAC Merge (Windows) bundle includes a registration script for onboarding devices and a flush script for cleanup.

On your WitnessAI console, click Settings in the left-side menu, then select Proxy Configuration.

Type your preferred token name in the Key Name field and select the Expiration Date. The Expiration Date should allow time for you to complete the current deployment, for example 30 days.

Once a device has been registered with Witness Anywhere, the token is no longer required. If a token expires, devices that were already deployed and successfully onboarded will continue to function normally. The token is only required during initial deployment.

Click the Generate PAC Token

Download Device Registration Scripts

To download the generated scripts, navigate to the row with your chosen Key Name in the Name column and click the corresponding download symbol on the right side.

In the new pop-up window, select Platform as PAC Merge (Windows) then click Download.

This will download a ZIP file: proxy-config.zip. Inside the folder, you will find the following files:

ps1 — Registers the device with the Witness Anywhere backend, installs the Root CA certificate, deploys stunnel for encrypted proxy communication, and configures the Cursor/Claude Code apps. It writes only the STATIC_FQDN and DEVICE_FINGERPRINT markers to the registry and leaves all proxy/PAC settings untouched.
ps1 — Removes the Witness Anywhere footprint created by this deployment (stunnel, the local registry marker, and the Cursor/Claude Code overrides) while leaving your proxy/PAC configuration untouched.

Deploying the Scripts

Deploying PAC Merging is a two-part process: (1) register the endpoints by pushing the registration script (and capture the WitnessAI PAC URL), and (2) merge the Witness AI routing block into your customer PAC so clients route AI traffic to the local stunnel listener.

1. Register the endpoints (push the registration script)

The register_device.ps1 script can be deployed with whichever MDM tooling you already use with Execution Context: System. The registration script implements the WitnessAnywhere Registration Flow. When it runs on a user machine it:

Installs the Proxy Root CA certificate into the Local Machine trusted root store.
Registers the user and device with WitnessAI and receives the device's Static FQDN and PAC URL.
Installs stunnel and configures it with the Static FQDN, forwarding to the WitnessAI proxy on port 8443, listening locally on 127.0.0.1:9411.
Configures stunnel as a startup task so the persistent SSL tunnel comes back automatically for the user.

Capture the WitnessAI PAC URL

The PAC Updater in step 2 needs a WitnessAI PAC URL (associated with a registered account) as its input. The registration script prints this URL to its transcript at C:\Windows\Temp\pac-registration-log.txt. On a registered device, open that log and copy the PAC_URL line. You will paste it into the PAC_URL constant in pac_updater.py in step 2.

2. Merge the Witness AI routing block into your PAC

The registration script stands up the stunnel listener on the endpoint but never enforces a PAC. To route AI traffic through it, you merge the Witness AI routing block into your own customer PAC using the pac_updater.py helper.

pac_updater.py downloads the latest Witness PAC from the configured PAC_URL, extracts the Witness AI domain entries, and injects a // WitnessAI routing block into your PAC — immediately before the last return "DIRECT";. AI domains are returned as PROXY 127.0.0.1:9411; DIRECT (stunnel with a DIRECT fallback); all of your existing routing rules are left unchanged.

Prerequisites

Python 3.9+.
Network access to the Witness PAC_URL configured in the script.
Your existing PAC to be saved as pac in the same directory as the script.

Steps

Download the pac_updater.py python script into any working directory.
Open pac_updater.py and set the PAC_URL constant near the top to the WitnessAI PAC URL you copied from the registration log (C:\Windows\Temp\pac-registration-log.txt) in step 1.
Place your existing PAC in the same directory as proxy.pac
Run the updater:


python3 pac_updater.py

On success you'll see modified.pac created in the same directory.

Publish modified.pac through your existing WPAD/PAC distribution so endpoints pick it up. Clients then follow your merged PAC: AI domains go to PROXY 127.0.0.1:9411 (stunnel → persistent SSL tunnel → WitnessAI proxy on port 8443) and all other traffic continues to your existing proxy or DIRECT.

Notes:

The script does not modify pac; it writes output to modified.pac. Re-running overwrites witness.pac and modified.pac.
The download times out after 30 seconds. On a network/HTTP error the script prints the error and exits without writing pac — check connectivity and firewall/proxy rules, then re-run.
If you see Customer PAC not found, ensure pac exists in the working directory. If you see Could not find default DIRECT return in customer PAC, ensure your PAC has a default return "DIRECT"; for the block to be inserted before.

Removing Witness Anywhere (Flush)

Run flush.ps1 (as SYSTEM/administrator) to remove the Witness Anywhere footprint. It is intentionally PAC-safe:

Removes stunnel (process, install directory, auto-start key, and uninstall entries).
Deletes the WitnessAI registry marker key.
Never resets proxy and never clears AutoConfigURL / ProxyEnable / Firefox proxy policy — your PAC configuration is preserved.
After flush, AI domains will still resolve to PROXY 127.0.0.1:9411 in your merged PAC until that block is removed on the PAC/WPAD side. Remove the Witness AI block from your PAC when decommissioning, otherwise AI-domain connectivity will break once the stunnel is gone.

Windows PAC Merging Guide Lifecycle Overview Generate Witness Anywhere Registration Scripts Download Device Registration Scripts Deploying the Scripts 1. Register the endpoints (push the registration script)Capture the WitnessAI PAC URL 2. Merge the Witness AI routing block into your PAC Prerequisites Steps Removing Witness Anywhere (Flush)