---
locale: "en"
updated_at: "2026-06-30T10:53:12.498Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/guides/deploying-agents/desktop-agent"
---

# Deploying the Desktop agent

Install from the console, manually or via GPO.

## Overview

The Desktop agent audits all interactive sessions activity on these machines and protects them by applying a user access control policy defined through [access policy](/userlock/docs/getting-started/core-concepts/access-policies) rules.

This agent has to be installed on the machines and communicates with UserLock servers to control all open requests for interactive sessions.

## Install from the console

The easiest way to install the** UserLock IIS agent **is to use the **UserLock console**.
You will find [more information here](/userlock/docs/getting-started/deploying-agent#deploy-from-the-console-recommended).

## Install the agent manually

You can also deploy it manually through the following procedure:

1. Copy the **agent file**
  The Desktop Agent runs as a Windows service under the **Local System** account.
  Copy `UlAgentExe.exe` from the UserLock installation folder on the **Primary Server**
  (default: `%ProgramFiles(x86)%\ISDecisions\UserLock`)
  to the target system folder:
  - **64-bit OS:** `%windir%\SysWOW64\`
  - **32-bit OS:** `%windir%\System32\`
2. Copy the **credential provider** files (only from Windows 10 version 1809 and Server 2019) from the UserLock installation folder of the Primary server to the System32 folder of the target machine  `%windir%\System32\`:
  - 64-bit OS:
    - Copy `UlCredProv_x64.dll` → rename to `UlCredProv.dll`
    - Copy `UlCredProvFilter_x64.dll` → rename to `UlCredProvFilter.dll`
  - 32-bit OS:
    - Copy `UlCredProv.dll`
    - Copy `UlCredProvFilter.dll`
3. **Add UserLock server names in the registry**
  - Browse to the following key::
  `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon`
  - Create the following values:
    |  |  |  |
    | --- | --- | --- |
    | Name | Type | Value |
    | **UserLockServer** | REG_SZ | The name of the UserLock Primary server. |
    | **UserLockServerBackup** | REG_SZ | The name of the UserLock Backup server. |
  - For offsite computers, you might want to configure the following registry values as well:
    |  |  |  |
    | --- | --- | --- |
    | Name | Type | Value |
    | **UserLockInternetUrl** | REG_SZ | If UserLock Anywhere is enabled, create this registry value and set in its content the URL of [UserLock Anywhere](/userlock/docs/getting-started/core-concepts/userlock-anywhere). |
    | **SessionsWithout NetworkLogoffAgent Internet** | REG_DWORD | If UserLock Anywhere is enabled, the number of minutes the Desktop agent will wait between each request for the list of sessions to interact with. |
    | **UserLockCfg** | REG_DWORD | See details in the [Windows Installer package](/userlock/docs/getting-started/deploying-agents/desktop-agent#windows-installer-package) section. |
  **Example via PowerShell:**
  ```powershell
  $RegKeyPath = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
  Set-ItemProperty -Path $RegKeyPath -Name 'UserLockServer' -Value 'ULSRVPRI'
  Set-ItemProperty -Path $RegKeyPath -Name 'UserLockServerBackup' -Value 'ULSRVBAC'
  Set-ItemProperty -Path $RegKeyPath -Name 'UserLockInternetUrl' -Value 'https://VES1.VDE.INTRA/ulproxy'
  Set-ItemProperty -Path $RegKeyPath -Name 'UserLockCfg' -Value 768
  ```
  > **Note**
  >
  > If these values are missing, the agent cannot contact the servers and may fail at startup.
4. **Register the Windows service**
  Run the following command **as Administrator** to register the agent service:
  `ULAgentExe.exe /SERVICE S`
5. **Start the UserLock agent service**:
  `net start UlAgentService`

No restart is required.

### For Windows Server Core

UserLock 13.0 fully supports installation on **Windows Server Core**.
You can deploy the server and complete its configuration without using any graphical interface, ensuring a lightweight and automated setup for secure environments.

| **Server Core edition** | **Description** |
| --- | --- |
| **Windows Server Core 2019 (or later) with *****Application Compatibility Feature on Demand*** | The **standard UserLock Desktop Agent** is used. Users can **enroll in MFA** directly.  📘 *See Microsoft documentation:*[ Install the Application Compatibility Feature on Demand on Server Core](https://learn.microsoft.com/en-us/windows-server/get-started/server-core-app-compatibility-feature-on-demand?tabs=windows-update#installing-the-app-compatibility-feature-on-demand) |
| **Other Server Core editions** | UserLock deploys the **special Server Core agent** :  - **MFA enrollment is not available**, but users can still **validate MFA codes**. - Not compatible with the **UserLock password Credential Provider** (therefore not compatible with MFA for UAC prompts). |

## Uninstall the agent

### Option A – Uninstall from the console

1. In the UserLock console, go to **Environment** ▸ **Machines**.
2. Select one or more machines and click on the **Actions** button.
3. In the menu, click to **Uninstall** the Desktop agent.
4. In the upper right corner, the [Admin action](/userlock/docs/reference/admin-actions) icon animates. Click it to monitor the uninstallation progress.

### Option B – Uninstall manually

1. Stop the service and unregister it (run as Administrator):
  ```powershell
  NET STOP UlAgentService
  C:\Windows\SysWOW64\ULAgentExe.exe /SERVICE U
  C:\Windows\SysWOW64\ULAgentExe.exe /UNREGISTER
  ```
  (Replace “SysWOW64” with “System32” on 32-bit systems.)
2. Once done, the agent will be completely uninstalled.

### Option C – Uninstall by using the **automatic deployer** in *Uninstall* mode

1. Open the **UserLock console**.
2. Go to ⚙ **Server settings** **▸** **Agent distribution**.
3. Enable **Automatic distribution**
4. Set **Distribution mode** to **Uninstall agent**.
  ![](https://a.storyblok.com/f/122374/1450x968/b55a68e139/agent-distribution-mode.png)
5. Wait until all computers show **Not installed** in the list.

### Alternative methods

- Using the PowerShell cmdlet [Uninstall-UserLockAgent](/userlock/docs/build-with-userlock/powershell/cmdlet-reference/uninstall-userlockagent).
- Using the [UserLockAPI](https://help.isdecisions.com/userlock/api/) methods.

### To completely clean agent data

See [Uninstall UserLock and remove all corresponding data ("On computers with the Desktop agent" section)](/userlock/docs/guides/installation/advanced/uninstall-userlock#on-computers-with-the-desktop-agent).

## Windows Installer package

The UserLock Desktop agent can be deployed through a third-party deployment solution or using Microsoft Group Policies. We provide MSI packages of the Desktop agent for this purpose:

| **Target OS** | **MSI file** | **Default location** |
| --- | --- | --- |
| 64-bit | `UlAgent_x64.msi` | `%ProgramFiles(x86)%\ISDecisions\UserLock\` |
| 32-bit | `UlAgent_x86.msi` | `%ProgramFiles(x86)%\ISDecisions\UserLock\` |

Run all MSI commands **as Administrator**.

By default, communication settings are not configured. You need to specify some MSI properties for the MSI package except if you deploy the communication settings with the UserLock [Administration template](/userlock/docs/getting-started/deploying-agents/desktop-agent#group-policy-deployment) through Microsoft Group Policies.

1. **Silent installation**
  ```
  msiexec /i ULAgent_x64.msi /qn USERLOCKSERVER=YourUserLockServerName USERLOCKSERVERBACKUP=YourUserLockBackupServerName
  ```
2. **Silent upgrade** (if previously installed via MSI)

If you are upgrading from version 12.2 or earlier to version 13.0 or later:

```
msiexec /i ULAgent_x64.msi /qn USERLOCKSERVER=YourUserLockServerName USERLOCKSERVERBACKUP=YourUserLockBackupServerName
```

For other cases:

```
msiexec /i ULAgent_x64.msi /qn USERLOCKSERVER=YourUserLockServerName USERLOCKSERVERBACKUP=YourUserLockBackupServerName REINSTALL=ALL REINSTALLMODE=vomus
```

3. **Installation with advanced options**

Include the `USERLOCKCFG` parameter to apply additional settings:

```
msiexec /i ULAgent_x64.msi /qn USERLOCKSERVER=YourUserLockServerName USERLOCKSERVERBACKUP=YourUserLockBackupServerName USERLOCKCFG=YourNeededCfgNumber
```

| **Hex** | **Decimal** | **Description** |
| --- | --- | --- |
| **0x002** | 2 | Displays errors to end users. |
| **0x010** | 16 | Prevents the Desktop Agent from sending logons denied by Active Directory. |
| **0x020** | 32 | Send a "lock session" event when the screensaver starts. |
| **0x040** | 64 | Prevent the removal of ghost (inactive) sessions on the local computer. |
| **0x180 ** | 384 | **Logons without UserLock connection**:  - Both bits disabled: Always allow logins. - 0x080 disabled and 0x100 enabled: Ask for MFA. - Both bits enabled: Force MFA. - 0x080 enabled and 0x100 disabled: Always deny logins. |
| **0x200** | 512 | Apply all restrictions (including MFA) when unlocking or reconnecting to a session. |
| **0x0800 ** | 2048 | If enabled, **UserLock Anywhere** is the only technology used by the Desktop Agent to communicate with UserLock servers. |
| **0x1000 ** | 4096 | If enabled, UserLock **Credential Provider** is enabled. |

**Example:**

To enable MFA on unlock/reconnect, "Ask for MFA" for logons without UserLock connection, and use the credential provider:
`USERLOCKCFG=4864` (which equals 0x1300).

The PowerShell script, available [here](https://cdn.isdecisions.com/Download/userlock/Get-UserLockDesktopAgentConfiguration.zip), helps to know which configurations a value of "UserLockCfg" corresponds to.

#### To uninstall the MSI package silently (on a 64-bit operating system):

```powershell
msiexec /x ULAgent_x64.msi /qn
```

## Group policy deployment

You can deploy the **Desktop Agent** using **Microsoft Group Policies (GPO)**.
MSI packages are provided for this purpose in the UserLock installation folder.

In addition, you can **deploy agent settings and communication parameters** through GPOs using the **Group Policy Administrative Template** provided with UserLock.
This template is compatible with all installation methods (console, MSI, manual, etc.).

### Log on a computer (usually a domain controller to configure a group policy)

### Load the template

#### If you wish to use ADMX and ADML

1. Locate template files in the UserLock installation folder: `UserLock.admx` and `UserLock.adml` (default path: `C:\Program Files (x86)\ISDecisions\UserLock\`) then:
  1. Copy `UserLock.admx` to the "%windir%\PolicyDefinitions" folder (usually "C:\Windows\PolicyDefinitions").
  2. Copy `UserLock.adml` to the "%windir%\PolicyDefinitions\<language id>" folder (usually "C:\Windows\PolicyDefinitions\en-US\").
2. Open the group policy you wish to modify in edit mode.
3. Browse **Computer Configuration, Administrative Templates...**, **UserLock**, **Agent**:
  ![](https://a.storyblok.com/f/122374/817x494/bdfc8f7678/agentgrouppolicyadmx.png)

#### If you wish to use ADM

1. Open the group policy you wish to modify in edit mode.
2. Browse **Computer Configuration, Administrative Templates...**, right click then "Add...":
  ![](https://a.storyblok.com/f/122374/449x219/8cce95f6a3/agentgrouppolicyadd.png)
3. Locate the template file in the UserLock installation folder:`UserLock.adm` (default path: `C:\Program Files (x86)\ISDecisions\UserLock\`).
4. Browse **Classic Administrative Templates (ADM)**, **UserLock**, **Agent**.
  ![](https://a.storyblok.com/f/122374/786x514/7f4b0c4348/agentgrouppolicy.png)

### Configure the template

You’ll find the same settings available in the UserLock console, plus communication parameters (Primary and Backup server names).

Double-click a setting to edit its properties, for example:

![](https://a.storyblok.com/f/122374/686x633/08fc37ed11/agentgrouppolicyservername.png)

On affected computers, all configured values are deployed to the registry key:
`HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\ISDecisions\UserLock\Agent` (on 32-bit target OS: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\ISDecisions\UserLock\Agent`)

![](https://a.storyblok.com/f/122374/566x562/fc24913fff/registry-editor.png)

> **Note**
>
> During some Windows updates, Microsoft sometimes resets the Winlogon key, which can cause some UserLock values ​​to disappear. Deploying agent and communication settings via Group Policy Objects (GPOs) is a solution to avoid this issue.

> **Note**
>
> The agent prioritizes agent and communication settings via GPOs over those stored in the Winlogon key.

## Install in an environment using VDI

To install the Desktop agent in an environment using VDI, please follow [this guide](/userlock/docs/guides/installation/install-desktop-agent-in-vdi-environment).