---
locale: "en"
updated_at: "2026-06-26T11:03:16.411Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/guides/deploying-agents/iis-agent"
---

# Deploying the IIS agent

Install from the console or manually, configure settings.

## Overview

The UserLock IIS agent allows UserLock to monitor, control, and enforce access policies on IIS (Internet Information Services) sessions.
It enables session tracking, multi-factor authentication (MFA) enforcement, and concurrent session control for web applications such as Outlook Web Access (OWA), RD Web, or SharePoint.

This guide explains how to manually install, configure, and maintain the IIS agent, as well as how to fine-tune its settings and known limitations.

## Step 1. Install the agent

You can install the IIS agent automatically from the **UserLock console** or manually on each IIS server.

### Option A – Install from the console

💡 **The simplest way** is to deploy the IIS agent directly from the **UserLock console**.
This automatically installs the correct module and registers it on the IIS server.

See: [Install from the console](/userlock/docs/getting-started/deploying-agent#deploy-from-the-console-recommended)

### Option B – Install manually

If you cannot deploy the IIS agent from the console, you can install it manually on each IIS server.

1. **Copy and register the module**
  1. Copy the corresponding **DLL file** from the UserLock installation folder to any local directory on the IIS server (for example, `C:\Program Files\UserLock IIS Agent`).
  2. Open an **elevated Command Prompt** (Run as Administrator).
  3. Run the registration command matching your IIS server architecture:
    | **IIS Server architecture** | File to copy | Command to register |
    | --- | --- | --- |
    | 32-bit | `UlHttpModule.dll` | `regsvr32 [Path]\UlHttpModule.dll` |
    | 64-bit | `UlHttpModule_x64.dll` | `regsvr32 [Path]\UlHttpModule_x64.dll` |
    👉 Replace `[Path]` with the actual location where you copied the file.
2. **Register communication settings**
  Create the following registry key to allow the IIS agent to communicate with the UserLock servers:
  - **Registry path:**
  `HKEY_LOCAL_MACHINE\SOFTWARE\ISDecisions\UserLock\IIS`
  - **Keys:**
    | **Value name** | **Type** | **Description** |
    | --- | --- | --- |
    | **UserLockServer** | REG_SZ | Name of the Primary UserLock server |
    | **UserLockServerBackup** | REG_SZ | Name of the Backup UserLock server |

Once the installation is complete, continue to configuration.

## Step 2. Configure the agent

After deployment, configure the UserLock module within **IIS Manager**.

### 1. Register the module on the IIS server

1. In **IIS Manager**, select the IIS server in the left pane.
2. Open the **Modules** section.
  ![](https://a.storyblok.com/f/122374/700x517/3904ecfd85/httpmodule1.png)
3. In the **Actions** panel, click **Configure Native Modules…**.
  ![](https://a.storyblok.com/f/122374/700x517/5384767746/httpmodule2.png)
4. Click **Register**, and browse to the `UlHttpModule.dll` file you copied.
  ![](https://a.storyblok.com/f/122374/483x385/e54e1f66de/httpmodule3.png)
  - Default locations:
    - `C:\Windows\System32` (64-bit)
    - `C:\Windows\SysWOW64` (32-bit)
5. Click **OK** to add it to the module list.
  ![](https://a.storyblok.com/f/122374/454x212/e2afaf2b1d/httpmodule4.png)
6. **Uncheck** the UserLock IIS agent before closing the wizard — this prevents it from being enabled for all web applications.
  ![](https://a.storyblok.com/f/122374/483x385/a69ffabc38/httpmodule5.png)

### 2. Enable the module for a specific web application

1. In the left pane, select the **web application** you want to protect.
2. Open the **Modules** section.
  ![](https://a.storyblok.com/f/122374/700x517/320b67843b/httpmodule6.png)
3. Click **Configure Native Modules…** in the **Actions** panel.
4. Check the box next to **UserLock IIS Agent**, then click **OK**.
  ![](https://a.storyblok.com/f/122374/700x517/0c5c27a577/httpmodule7.png)

The IIS agent is now active for that specific application.

## Step 3. Adjust agent settings

The default configuration is suitable for most environments.

Use these** optional settings** only if you wish to fine-tune the behavior of the IIS agent after installation.

### IIS session timeout

By default, UserLock considers an IIS session closed after **5 minutes** of inactivity.
To change this:

1. Create a new registry value (REG_DWORD) on the IIS server:
  `HKEY_LOCAL_MACHINE\SOFTWARE\ISDecisions\UserLock\IIS\SessionTimeout `
2. Set the timeout value in minutes (for example, `10`).
3. Restart or recycle the IIS application pool.

> **Note**
>
> Setting a very short timeout may cause excessive logon/logoff events in UserLock.

### Monitor specific application pools

By default, all IIS applications on a configured site are monitored. To **restrict monitoring** to certain application pools:

1. Create this registry key (REG_MULTI_SZ):
  `HKEY_LOCAL_MACHINE\SOFTWARE\ISDecisions\UserLock\IIS\ProtectedApplicationPools`
2. List the names of the application pools to supervise (one per line).

> **Example:**
>
> - `MSExchangeOWAAppPool`
> - `MSExchangeSyncAppPool`
> 
> This configuration helps reduce noise on servers like Exchange, where many web applications share the same IIS site.

### Ignore specific users

You can exclude built-in or diagnostic accounts (e.g., “Health Mailbox” accounts) from being tracked.

Create the following registry values under:
`HKEY_LOCAL_MACHINE\SOFTWARE\ISDecisions\UserLock\IIS`

| **Value name** | **Type** | **Description** |
| --- | --- | --- |
| **IgnoredUsers** | REG_MULTI_SZ | List of user accounts (e.g., `Domain\User`) |
| **IgnoredLocalUsers** | REG_MULTI_SZ | List of local users to ignore for local requests |
| **IgnoredUsersPattern** | REG_MULTI_SZ | Patterns with `*`* *wildcards (e.g., `*HealthMailbox*`) |
| **ProtectHealthmailboxSessions** | REG_DWORD | Set to `1` to audit HealthMailbox sessions |

Restart the protected application pools after editing these values.

### Forms authentication mode

The IIS agent can protect applications using either **Windows** or **Forms authentication**.

By default, Windows authentication is enabled.
To enable Forms authentication mode:

1. Create the registry value (REG_DWORD):
  `HKEY_LOCAL_MACHINE\SOFTWARE\ISDecisions\UserLock\IIS\EnableFormsAuthentication `
2. Set its value to `1`.
3. Restart or recycle the IIS application pool.

###

## Uninstall the agent

### Manually

From the UserLock console, you can **stop managing** the IIS agent on a target server.
**Important:** This action **does not** unregister the module in IIS or remove files/registry entries on the server.

After using the console, you **must** complete the removal on each IIS server by following these steps.

1. Open **IIS Manager**.
2. For each web application where the UserLock IIS module is enabled:
  - Select the application.
  - Open **Modules**, and remove the **UserLock IIS Agent** entry.
3. At the **server level**, open **Modules → Configure Native Modules…**, select the **UserLock IIS Agent**, and click **Unregister**.
4. Apply the change (pick one):
  - **No restart**: delete the volatile key:
    `HKEY_LOCAL_MACHINE\SOFTWARE\ISDecisions\UserLock\IIS\Volatile`
  - **Or restart the server **the flush the volatile data
5. Clean the **persistent configuration **key :
  `HKEY_LOCAL_MACHINE\SOFTWARE\ISDecisions\UserLock\IIS`
6. Delete the **DLL **files:
  `C:\Windows\System32\UlHttpModule.dll`
  `C:\Windows\SysWOW64\UlHttpModule.dll `

> **Note**
>
> The **Volatile** key (or a restart) ensures IIS stops referencing the module immediately.
> Then you remove the **persistent configuration** and the **DLLs** to complete the cleanup.

### Alternative methods

- Using the PowerShell cmdlet [Uninstall-UserLockAgent](/userlock/docs/build-with-userlock/powershell/cmdlet-reference/uninstall-userlockagent).
- Using the [UserLockAPI](https://help.isdecisions.com/userlock/api/) methods.

## Known limitations

- **Browser close behavior:**
If a user closes their browser without logging off, the session remains open until the timeout expires.
- **Concurrent session control:**
If concurrent IIS sessions are limited, a user may be blocked from reconnecting until the timeout elapses.
- **Cookies:**
Cookies must be enabled in browsers. Deleting them on exit helps ensure clean session closure.
- **Session naming:**
UserLock identifies sessions by IIS server name, web application, client IP address, and application pool.

Administrators can also close IIS sessions manually in the **Activity ▸ **[Active sessions](/userlock/docs/reference/activity#active-sessions) page of the UserLock console.