---
locale: "en"
updated_at: "2026-06-26T11:01:26.651Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/guides/deploying-agents/nps-agent"
---

# Deploying the NPS agent

Install from the console or manually, additional settings.

## Overview

The UserLock NPS agent is a DLL registered in the **Network Policy Server (NPS)** service.
It is triggered when a user authenticates through RADIUS and during session start or end events (RADIUS accounting).

This integration allows UserLock to apply access policies and multi-factor authentication (MFA) for users connecting via VPN or Wi-Fi.

> **Note**
>
> - NPS supports multiple administrative DLLs. The UserLock agent can coexist with others without conflict.
> - The registry supports multiple DLL locations (REG_MULTI_SZ value type).
> - NPS loads DLLs in the order they appear in the registry.
> - See [Microsoft documentation on NPS](https://learn.microsoft.com/en-us/windows/win32/nps/ias-extensions)

## Step 1. Install the agent

You can install the NPS agent automatically from the **UserLock console** or manually on your NPS server.

### Option A – Install from the console

💡 **The simplest way** is to deploy the NPS agent directly from the **UserLock console**.

See: [Install from the console](/userlock/docs/getting-started/deploying-agent#deploy-from-the-console-recommended)

### Option B – Install manually

If you cannot deploy the NPS agent from the console, you can install it manually on your NPS server.

1. **Copy and registrer the module**
  1. Copy the corresponding **DLL file** from the UserLock installation folder %windir%\System32\ on the server (for example, `C:\Program Files\UserLock IIS Agent`).
  2. Open an **elevated Command Prompt** (Run as Administrator).
  3. Run the registration command matching your IIS server architecture:
    | **Server architecture** | **File to copy** | **Command to register** |
    | --- | --- | --- |
    | 32-bit | `ULIasAgent.dll` | `regsvr32 C:\Windows\System32\ULIasAgent.dll` |
    | 64-bit | `ULIasAgent_x64.dll`  (rename to `ULIasAgent.dll`) | `regsvr32 C:\Windows\System32\ULIasAgent.dll` |
2. **Register communication settings**
  Create the following registry key to allow the IIS agent to communicate with the UserLock servers:
  - **Registry path:**
  `HKEY_LOCAL_MACHINE\SOFTWARE\ISDecisions\UserLock\IAS`
  - **Keys:**
    | **Value name** | **Type** | **Description** |
    | --- | --- | --- |
    | **UserLockServer** | REG_SZ | Name of the Primary UserLock server |
    | **UserLockServerBackup** | REG_SZ | Name of the Backup UserLock server |

## Step 2. Completing installation

After the NPS Agent is installed/uninstalled (through the console, or manually), its status in the **Environment ▸ Machines **page will be **Installing/Uninstalling**. 

To make it effective:

If the "Routing and Remote Access" role or the "Remote Desktop Gateway" role is installed on the NPS server, restart the server.

Otherwise, simply restart the "Network Policy Server" (IAS) service.

## Uninstall the agent

### Option A – Uninstall from the console

1. Uninstall the agent directly from the **UserLock console**.
2. The agent status will appear as *Uninstalling* . Restart the services as described in the Step 2 section to complete the process.

### Option B – Uninstall manually

1. Unregister the DLL:
`regsvr32 /u C:\Windows\System32\ULIasAgent.dll`
2. The agent will be disabled but still loaded in memory.
3. Restart the services as described in the Step 2 section to complete the process.

### Alternative methods

- Using the PowerShell cmdlet [Uninstall-UserLockAgent](/userlock/docs/build-with-userlock/powershell/cmdlet-reference/uninstall-userlockagent).
- Using the [UserLockAPI](https://help.isdecisions.com/userlock/api/) methods.

## Known limitations and additional settings

### Duplicate Wi-Fi sessions 

Some Wi-Fi Access Points (WAP) do **not fully comply with RADIUS standards** and may not send disconnection notifications. 

As a result, the same session (same user account, same device, possibly the same Wi-Fi Access Point) may appear multiple times in UserLock.

To prevent these duplicates, the NPS agent provides two **optional DWORD (32-bit) registry settings** in: `HKEY_LOCAL_MACHINE\SOFTWARE\ISDecisions\UserLock\IA`

| **Setting** | **Description** |
| --- | --- |
| `AutoResetPrevious` `SessionSameData` | When enabled (`1`), closes a previous session if the same user, device, and Wi-Fi Access Point (WAP) reconnect. *Default: 1 - (ON)* |
| `AutoResetPrevious` `SessionSameDataAndWap` | When enabled (`1`), also closes previous sessions even if the user connects through a different Wi-Fi Access Point. *Default: 0 - (OFF)* |

#### Behavior combinations

The behavior depends on how both keys are configured.
Mixing the values of these two options lets you control how UserLock handles reconnecting users on the same or different Wi-Fi Access Points.

| **AutoReset** **PreviousSession** **SameData** | **AutoReset** **PreviousSession** **SameData** **AndWap** | **Same user, device, and WAP** | **Same user and device, different WAP** |
| --- | --- | --- | --- |
| 1 | 1 | ✅ Automatically closed | ⚠️ Remains active |
| 1 | 0 | ✅ Automatically closed | ✅ Automatically closed |
| 0 | 0 | ⚠️ Remains active | ⚠️ Remains active |

> **Note**
>
> - **✅ Automatically closed** means UserLock automatically ends any existing session matching the new RADIUS connection, preventing duplicates.
> - **⚠️ Remains active** means the previous session stays open, which can result in duplicate sessions.