Deploying the Desktop agent

The Desktop agent audits all interactive sessions activity on these machines and protects them by applying a user access control policy defined through access policy rules.

This agent has to be installed on the machines and communicates with UserLock servers to control all open requests for interactive sessions.

The easiest way to install the UserLock IIS agent is to use the UserLock console.
You will find more information here.

You can also deploy it manually through the following procedure:

1. Copy the agent file

   The Desktop Agent runs as a Windows service under the Local System account.

   Copy UlAgentExe.exe from the UserLock installation folder on the Primary Server
   (default: %ProgramFiles(x86)%\ISDecisions\UserLock)
   to the target system folder:

   • 64-bit OS: %windir%\SysWOW64\

   • 32-bit OS: %windir%\System32\

2. Copy the credential provider files (only from Windows 10 version 1809 and Server 2019) from the UserLock installation folder of the Primary server to the System32 folder of the target machine %windir%\System32\:

   • 64-bit OS:

     • Copy UlCredProv_x64.dll → rename to UlCredProv.dll

     • Copy UlCredProvFilter_x64.dll → rename to UlCredProvFilter.dll

   • 32-bit OS:

     • Copy UlCredProv.dll

     • Copy UlCredProvFilter.dll

3. Add UserLock server names in the registry

   • Browse to the following key::
     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

   • Create the following values:

     Name	Type	Value
     UserLockServer	REG_SZ	The name of the UserLock Primary server.
     UserLockServerBackup	REG_SZ	The name of the UserLock Backup server.

   • For offsite computers, you might want to configure the following registry values as well:

     Name	Type	Value
     UserLockInternetUrl	REG_SZ	If UserLock Anywhere is enabled, create this registry value and set in its content the URL of UserLock Anywhere.
     SessionsWithout NetworkLogoffAgent Internet	REG_DWORD	If UserLock Anywhere is enabled, the number of minutes the Desktop agent will wait between each request for the list of sessions to interact with.
     UserLockCfg	REG_DWORD	See details in the Windows Installer package section.

   Example via PowerShell:

   powershell

   $RegKeyPath = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'Set-ItemProperty -Path $RegKeyPath -Name 'UserLockServer' -Value 'ULSRVPRI'Set-ItemProperty -Path $RegKeyPath -Name 'UserLockServerBackup' -Value 'ULSRVBAC'Set-ItemProperty -Path $RegKeyPath -Name 'UserLockInternetUrl' -Value 'https://VES1.VDE.INTRA/ulproxy'Set-ItemProperty -Path $RegKeyPath -Name 'UserLockCfg' -Value 768

   Note

   If these values are missing, the agent cannot contact the servers and may fail at startup.

4. Register the Windows service

   Run the following command as Administrator to register the agent service:

   ULAgentExe.exe /SERVICE S

5. Start the UserLock agent service:

   net start UlAgentService

No restart is required.

UserLock 13 fully supports installation on Windows Server Core.
You can deploy the server and complete its configuration without using any graphical interface, ensuring a lightweight and automated setup for secure environments.

You can uninstall the Desktop agent from the console, but also manually.

1. Stop the service and unregister it (run as Administrator):

   powershell

   NET STOP UlAgentService
   C:\Windows\SysWOW64\ULAgentExe.exe /SERVICE U
   C:\Windows\SysWOW64\ULAgentExe.exe /UNREGISTER

   (Replace “SysWOW64” with “System32” on 32-bit systems.)

2. Once done, the agent will be completely uninstalled.

1. Run RegEdit

2. Browse the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

3. Delete:

   • All registry values beginning with UserLock.

   • The UserLock sub key (ie the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserLock registry key).

The UserLock Desktop agent can be deployed through a third-party deployment solution or using Microsoft Group Policies. We provide MSI packages of the Desktop agent for this purpose:

Run all MSI commands as Administrator.

By default, communication settings are not configured. You need to specify some MSI properties for the MSI package except if you deploy the communication settings with the UserLock Administration template through Microsoft Group Policies.

1. Silent installation

   msiexec /i ULAgent_x64.msi /qn USERLOCKSERVER=YourUserLockServerName USERLOCKSERVERBACKUP=YourUserLockBackupServerName 

2. Silent upgrade (if previously installed via MSI)

msiexec /i ULAgent_x64.msi /qn USERLOCKSERVER=YourUserLockServerName USERLOCKSERVERBACKUP=YourUserLockBackupServerName REINSTALL=ALL REINSTALLMODE=vomus

3. Installation with advanced options

Include the USERLOCKCFG parameter to apply additional settings:

msiexec /i ULAgent_x64.msi /qn USERLOCKSERVER=YourUserLockServerName USERLOCKSERVERBACKUP=YourUserLockBackupServerName USERLOCKCFG=YourNeededCfgNumber 

Example:

To enable MFA on unlock/reconnect, require MFA for offline logons, and use the credential provider:
USERLOCKCFG=4864 (which equals 0x1300).

The PowerShell script, available here, helps to know which configurations a value of "UserLockCfg" corresponds to.

msiexec /x ULAgent_x64.msi /qn 

You can deploy the Desktop Agent using Microsoft Group Policies (GPO).
MSI packages are provided for this purpose in the UserLock installation folder.

In addition, you can deploy agent settings and communication parameters through GPOs using the Group Policy Administrative Template provided with UserLock.
This template is compatible with all installation methods (console, MSI, manual, etc.).

1. Locate the template file in the UserLock installation folder:UserLock.adm (default path: C:\Program Files (x86)\ISDecisions\UserLock\).

2. Add this template to the Group Policy you want to use to configure Desktop Agent settings.

3. Once imported, open Administrative Templates and display UserLock agent configuration.

   • In Windows Server 2008 and later, use Classic Administrative Templates.

   • You’ll find the same settings available in the UserLock console, plus communication parameters (Primary and Backup server names).

     

4. Double-click a setting to edit its properties.

   

On affected computers, all configured values are deployed to the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\ISDecisions\UserLock\Agent

To install the Desktop agent in an environment using VDI, please follow this guide.