Deploy the Desktop agent with Group Policy

From UserLock 13.1, you can protect machines that accept no inbound network traffic. Instead of letting the UserLock server push the agent, you deploy the Desktop agent MSI packages with Group Policy. The agent then connects out to the UserLock server.

Use this method when:

• Your security policy blocks ping, SMB or Remote Registry towards workstations and servers.

• You already deploy software with Group Policy and want UserLock to follow the same process.

The same steps apply to a third-party deployment tool: deploy the same MSI packages and the same server name setting with your own tool.

• A UserLock 13.1 Primary server installed and configured. See Install and configure UserLock.

• Rights to create or edit a Group Policy Object (GPO) linked to the machines to protect.

• Only outbound traffic from the protected machines to the UserLock server:

Nothing is required from the UserLock server towards the protected machines: no ping, no SMB, no Remote Registry and no admin$ access.

The UserLock service impersonation account does not need administrative rights on the protected machines with this deployment method.

To check, log on to a protected machine and run:

ping <UserLock server FQDN>
explorer \\<UserLock server FQDN>

The server must answer the ping and File Explorer must list its shares, including UserLockDownloads.

1. Open Group Policy Management on a domain controller or a machine with the RSAT tools.

2. Create a GPO linked to the OUs that contain the machines to protect, or pick an existing one.

3. Right-click the GPO ▸ Edit.

A dedicated GPO is easier to maintain and to roll back than the Default Domain Policy.

The templates are in the UserLock installation folder on the server (default: C:\Program Files (x86)\ISDecisions\UserLock\).

1. Copy UserLock.admx to %windir%\PolicyDefinitions (or to the Central Store \\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions).

2. Copy UserLock.adml to the language subfolder, for example PolicyDefinitions\en-US.

3. Reopen the GPO editor. The settings appear under Computer Configuration ▸ Policies ▸ Administrative Templates ▸ UserLock ▸ Agent.

   

1. Go to Computer Configuration ▸ Policies, right-click Administrative Templates ▸ Add/Remove Templates… ▸ Add.

   

2. Select UserLock.adm in the UserLock installation folder.

3. The settings appear under Administrative Templates ▸ Classic Administrative Templates (ADM) ▸ UserLock ▸ Agent.

   

This is the only setting the agent needs to reach the server.

1. In UserLock ▸ Agent, open Primary UserLock server name.

2. Select Enabled and enter the FQDN of the Primary server, for example ulserver.corp.local.

   

3. Click OK.

4. If you have a Backup server, set Backup UserLock server name the same way.

The other agent settings in this template are optional. Settings deployed by GPO take priority over values set on the machine.

UserLock setup creates the UserLockDownloads share on the server. It contains the agent packages.

1. Go to Computer Configuration ▸ Policies ▸ Software Settings ▸ Software installation.

2. Right-click ▸ New ▸ Package…

3. Browse to the network path \\<UserLock server>\UserLockDownloads and select ULAgent_x64.msi. Do not use a local path: the machines must reach the package over the network.

4. Select Assigned and click OK.

1. Add ULAgent_x86.msi from the same share, as Assigned.

2. Open its Properties. On the General tab, rename it, for example UserLock Agent (32-bit).

3. On the Deployment tab, click Advanced… and untick Make this 32-bit X86 application available to Win64 machines. The x86 package must only install on 32-bit machines.

4. Click OK twice.

Assigned packages install at computer startup. If Group Policy runs before the network is ready, the package cannot be downloaded and the install is skipped until the next restart. This setting is recommended.

1. Go to Computer Configuration ▸ Policies ▸ Administrative Templates ▸ System ▸ Group Policy.

2. Open Specify startup policy processing wait time.

3. Select Enabled and set Amount of time to wait (in seconds) to 120.

4. Click OK.

The agent installs at the first computer startup after the machine has received the GPO. No user action is needed.

To test on a machine right away:

1. Log on to the machine as an administrator and run gpupdate /force.

2. Windows reports that software installation requires a restart. Accept it.

3. The agent installs during startup.

For the rest of the fleet, wait for the normal Group Policy refresh and for the machines to restart. For machines that rarely restart, such as servers, plan a restart.

1. Open Control Panel ▸ Programs and Features.

2. Check that UserLock Agent is listed (UserLock Agent (32 bits) on 32-bit machines).

1. Go to Environment ▸ Machines and refresh. The Desktop agent of the machine shows Installed.

2. Go to Activity ▸ Active sessions. The sessions open on the machine are listed.

3. Lock the machine and refresh the view. The session status changes to Locked.

1. Go to Access policies and add a policy for a test user: Permanent ▸ Session limits.

2. Set Workstation to Limit to 1 and save.

3. With a session open on one machine, log on as the same user on a second machine.

4. The logon is denied with a message naming the machine where the first session is open.

Once a 13.1 or later agent is installed, you can upgrade it from the UserLock console or with the automatic deployment mode, as for an agent deployed by UserLock. The protected machines still don't need to accept inbound traffic: the agent updates itself through its permanent connection to the server, and the UserLock service account doesn't need administrative rights on the machines.

You don't need to update the MSI package in the GPO. After such an upgrade, Windows settings can still show the version of the MSI package.

UserLock can't uninstall an agent installed with the MSI package. Remove the package from the GPO, or uninstall it on the machine. See Windows Installer package.

To check the values received by a machine, open HKLM\SOFTWARE\WOW6432Node\Policies\ISDecisions\UserLock\Agent in the Registry Editor (HKLM\SOFTWARE\Policies\ISDecisions\UserLock\Agent on 32-bit machines):

• Deploying the Desktop agent: other agent settings, MSI properties and manual installation.

• MFA implementation: once the agent is deployed everywhere, set up multi-factor authentication.