--- locale: "en" updated_at: "2026-11-13T08:11:52.448Z" canonical: "https://www.isdecisions.com/en/userlock/docs/guides/deploying-agents/group-policy-deployment" --- # Deploy the Desktop agent with Group Policy Deploy the Desktop agent via GPO, without inbound protocols. ## Overview From UserLock 13.1, you can protect machines that accept **no inbound network traffic**. Instead of letting the UserLock server push the agent, you deploy the Desktop agent MSI packages with Group Policy. The agent then connects out to the UserLock server. Use this method when: - Your security policy blocks ping, SMB or Remote Registry towards workstations and servers. - You already deploy software with Group Policy and want UserLock to follow the same process. The same steps apply to a third-party deployment tool: deploy the same MSI packages and the same server name setting with your own tool. > **Note** > > Deploying from the UserLock console is still supported. In that case, the network requirements for console deployment still apply. See [Requirements](/userlock/docs/getting-started/requirements). ## Prerequisites - A **UserLock 13.1 Primary server** installed and configured. See [Install and configure UserLock](/userlock/docs/getting-started/installation). - Rights to create or edit a Group Policy Object (GPO) linked to the machines to protect. - Only **outbound** traffic from the protected machines to the UserLock server: | From | To | Protocol | Port | Used for | | --- | --- | --- | --- | --- | | Protected machines | UserLock server | ICMP (ping) | – | Agent checks the server is reachable | | Protected machines | UserLock server | SMB | TCP 445 | Agent communication and MSI download from the `UserLockDownloads` share | | Protected machines | DNS | DNS | UDP/TCP 53 | Resolving the server FQDN | Nothing is required from the UserLock server towards the protected machines: no ping, no SMB, no Remote Registry and no `admin$` access. The UserLock **service impersonation account** does not need administrative rights on the protected machines with this deployment method. To check, log on to a protected machine and run: ```powershell ping explorer \\ ``` The server must answer the ping and File Explorer must list its shares, including `UserLockDownloads`. ## 1. Choose the GPO 1. Open **Group Policy Management** on a domain controller or a machine with the RSAT tools. 2. Create a GPO linked to the OUs that contain the machines to protect, or pick an existing one. 3. Right-click the GPO ▸ **Edit**. A dedicated GPO is easier to maintain and to roll back than the Default Domain Policy. ## 2. Load the UserLock administrative template The templates are in the UserLock installation folder on the server (default: `C:\Program Files (x86)\ISDecisions\UserLock\`). ### ADMX (recommended) 1. Copy `UserLock.admx` to `%windir%\PolicyDefinitions` (or to the Central Store `\\\SYSVOL\\Policies\PolicyDefinitions`). 2. Copy `UserLock.adml` to the language subfolder, for example `PolicyDefinitions\en-US`. 3. Reopen the GPO editor. The settings appear under **Computer Configuration ▸ Policies ▸ Administrative Templates ▸ UserLock ▸ Agent**. ![UserLock ADMX template settings in the Group Policy Management Editor](https://a.storyblok.com/f/122374/817x494/bdfc8f7678/agentgrouppolicyadmx.png) ### ADM (classic) 1. Go to **Computer Configuration ▸ Policies**, right-click **Administrative Templates** ▸ **Add/Remove Templates…** ▸ **Add**. ![Add/Remove Templates in the Group Policy Management Editor](https://a.storyblok.com/f/122374/449x219/8cce95f6a3/agentgrouppolicyadd.png) 2. Select `UserLock.adm` in the UserLock installation folder. 3. The settings appear under **Administrative Templates ▸ Classic Administrative Templates (ADM) ▸ UserLock ▸ Agent**. ![UserLock ADM template settings under Classic Administrative Templates](https://a.storyblok.com/f/122374/786x514/7f4b0c4348/agentgrouppolicy.png) ## 3. Set the UserLock server name This is the only setting the agent needs to reach the server. 1. In **UserLock ▸ Agent**, open **Primary UserLock server name**. 2. Select **Enabled** and enter the **FQDN** of the Primary server, for example `ulserver.corp.local`. ![Primary UserLock server name policy setting](https://a.storyblok.com/f/122374/686x633/08fc37ed11/agentgrouppolicyservername.png) 3. Click **OK**. 4. If you have a Backup server, set **Backup UserLock server name** the same way. The other agent settings in this template are optional. Settings deployed by GPO take priority over values set on the machine. ## 4. Add the agent MSI packages UserLock setup creates the `UserLockDownloads` share on the server. It contains the agent packages. 1. Go to **Computer Configuration ▸ Policies ▸ Software Settings ▸ Software installation**. 2. Right-click ▸ **New ▸ Package…** 3. Browse to the **network path** `\\\UserLockDownloads` and select `ULAgent_x64.msi`. Do not use a local path: the machines must reach the package over the network. 4. Select **Assigned** and click **OK**. ### Optional: 32-bit machines 1. Add `ULAgent_x86.msi` from the same share, as **Assigned**. 2. Open its **Properties**. On the **General** tab, rename it, for example `UserLock Agent (32-bit)`. 3. On the **Deployment** tab, click **Advanced…** and **untick** *Make this 32-bit X86 application available to Win64 machines*. The x86 package must only install on 32-bit machines. 4. Click **OK** twice. ## 5. Make startup policies wait for the network Assigned packages install at computer startup. If Group Policy runs before the network is ready, the package cannot be downloaded and the install is skipped until the next restart. This setting is recommended. 1. Go to **Computer Configuration ▸ Policies ▸ Administrative Templates ▸ System ▸ Group Policy**. 2. Open **Specify startup policy processing wait time**. 3. Select **Enabled** and set **Amount of time to wait (in seconds)** to `120`. 4. Click **OK**. ## 6. Roll out to the machines The agent installs at the first computer startup after the machine has received the GPO. No user action is needed. To test on a machine right away: 1. Log on to the machine as an administrator and run `gpupdate /force`. 2. Windows reports that software installation requires a restart. Accept it. 3. The agent installs during startup. For the rest of the fleet, wait for the normal Group Policy refresh and for the machines to restart. For machines that rarely restart, such as servers, plan a restart. ## 7. Verify the deployment ### On the machine 1. Open **Control Panel ▸ Programs and Features**. 2. Check that **UserLock Agent** is listed (**UserLock Agent (32 bits)** on 32-bit machines). ### In the UserLock console 1. Go to **Environment ▸ Machines** and refresh. The Desktop agent of the machine shows **Installed**. 2. Go to **Activity ▸ Active sessions**. The sessions open on the machine are listed. 3. Lock the machine and refresh the view. The session status changes to **Locked**. > **Note** > > Before the agent is installed, machines that block inbound traffic show **Unknown** with *No answer to the ping*. This is expected. ### Test an access policy (optional) 1. Go to **Access policies** and add a policy for a test user: **Permanent** ▸ **Session limits**. 2. Set **Workstation** to **Limit to 1** and save. 3. With a session open on one machine, log on as the same user on a second machine. 4. The logon is denied with a message naming the machine where the first session is open. ## Upgrade the agent Once a 13.1 or later agent is installed, you can upgrade it from the UserLock console or with the automatic deployment mode, as for an agent deployed by UserLock. The protected machines still don't need to accept inbound traffic: the agent updates itself through its permanent connection to the server, and the UserLock service account doesn't need administrative rights on the machines. You don't need to update the MSI package in the GPO. After such an upgrade, Windows settings can still show the version of the MSI package. ## Uninstall the agent UserLock can't uninstall an agent installed with the MSI package. Remove the package from the GPO, or uninstall it on the machine. See [Windows Installer package](/userlock/docs/guides/deploying-agents/desktop-agent#windows-installer-package). ## Troubleshooting | Symptom | What to check | | --- | --- | | The agent is not installed after a restart | Run `gpresult /r` on the machine: the GPO must be listed under *Applied Group Policy Objects* (computer settings). In **Event Viewer ▸ Windows Logs ▸ System**, look for *Application Management Group Policy* events. | | The install fails at startup | Check the network wait setting (step 5). Check that the package path is the UNC path to `UserLockDownloads` and that the machine can open it. | | The x86 package installs on 64-bit machines | Untick *Make this 32-bit X86 application available to Win64 machines* in the x86 package (step 4). | | The agent is installed but the console still shows it as not installed, or no sessions appear | From the machine, check `ping` and `\\` (see Prerequisites). Check the **Primary UserLock server name** value. On the machine, the GPO values are stored in `HKLM\SOFTWARE\WOW6432Node\Policies\ISDecisions\UserLock\Agent`. | To check the values received by a machine, open `HKLM\SOFTWARE\WOW6432Node\Policies\ISDecisions\UserLock\Agent` in the Registry Editor (`HKLM\SOFTWARE\Policies\ISDecisions\UserLock\Agent` on 32-bit machines): ![UserLock agent GPO values in the registry](https://a.storyblok.com/f/122374/566x562/fc24913fff/registry-editor.png) ## Next steps - [Deploying the Desktop agent](/userlock/docs/guides/deploying-agents/desktop-agent): other agent settings, MSI properties and manual installation. - [MFA implementation](/userlock/docs/guides/mfa-implementation): once the agent is deployed everywhere, set up multi-factor authentication.