--- locale: "en" updated_at: "2025-10-28T16:11:04.843Z" canonical: "https://www.isdecisions.com/en/userlock/docs/support/faq/configuration" --- # Configuration Find answers about system configuration, server options, and settings. ## Can UserLock support nested OU's and groups in Active Directory? Yes UserLock supports nested security groups. ## Does UserLock modify Active Directory? No. UserLock only reads Active Directory information but doesn’t modify anything regarding accounts nor schema. ## I want to delegate the UserLock administration. Do the UserLock operators require Domain administrator privileges? No. If you want to delegate UserLock administrations to several operators, you can define on the UserLock server settings ([Permissions](/userlock/docs/server-administration/server-properties/permissions) menu) the different user/group accounts authorized to manage UserLock and what they can do. Accesses can be configured in read or/and write mode. **Allow **will grant read or write access. **Deny **will forbid it and it will be applied with higher priority if Allow is also set (similar to access rights on a file server). ## Can users stop the UserLock Agent on workstations ? No. A user without admin rights on that machine can’t stop or remove the UserLock Agent. For that you need at least the local administrator privileges on the machine. ## Can I install several UserLock Backup servers ? No. A Primary server is always associated to one Backup server. You can only have one UserLock Primary server and one UserLock Backup server on a same UserLock Protected zone. ## Can the UserLock Backup server do load balancing ? No. The role of the backup server is solely to maintain UserLock policies when the primary server is unavailable (server in maintenance, stopped or ko; UserLock service stopped or ko), until it is restored to an operational state. ## How can I migrate UserLock server to another machine? To migrate your Userlock server to another machine, please refer to [this page](/documentation/userlock/articles/guides/migrate-userlock-server). This procedure describes the migration of Userlock from one server to another. Follow it step by step and carefully. ## How to enable HTTPS on the UserLock Web Console? Today, there is no such thing as non-sensitive web traffic. HTTPS can provide a fast, secure connection that offers the level of privacy and reliability that users should expect from a web application. When properly configured, an HTTPS connection guarantees three things: - **Confidentiality.** The visitor’s connection is encrypted, obscuring URLs, cookies, and other sensitive metadata. - **Authenticity.** The visitor is talking to the “real” website, and not to an impersonator or through a “man-in-the-middle”. - **Integrity.** The data sent between the visitor and the website has not been tampered with or modified. A plain HTTP connection can be easily monitored, modified, and impersonated. Even though an internal website is not as risky as a public website, we strongly recommend that you set up HTTPS on the UserLock web console. This is a standard procedure for a web application. [Please follow instructions here](http://www.iis.net/learn/manage/configuring-security/how-to-set-up-ssl-on-iis). ## How to view and modify Advanced UserLock Settings From the desktop console on the UserLock server, press the **ALT+F7** keyboard key to display the advanced settings or go to server settings, under [Advanced settings](/userlock/docs/server-administration/server-properties/advanced-settings) menu. ## How to remove a machine from the Machines view in UserLock? UserLock displays in the Machines view all the machines belonging to the protected zone defined during the UserLock installation. The Protected zone is the network perimeter (Domain, OUs) defined when performing the [Configuration wizard](/userlock/docs/getting-started/installation#configuration-wizard). The list of machines detected in the protected Zone is updated every 5 minutes. So, you have two options to remove the machine from the Machines view: - You can remove the machine from your AD, because it is obsolete. - You can exclude the machine from the protected zone, for example by moving the machine to another OU (Organizational unit) not included in the protected zone. In both cases, the machine will be removed from the Machines view **after 7 days without UserLock Agent Desktop activity**. This point is important, because a machine outside the UserLock protected zone without uninstalling the Desktop Agent and this agent continues to contact the UserLock service (startup, session events) within the last 7 days, this computer will remain in the Machines view. **We recommend generally to uninstall the agents from the concerned machines **and then to redefine the protected area with our [Configuration wizard](/userlock/docs/getting-started/installation#configuration-wizard) tool that you can find in the Start menu or under: C:\Program Files (x86)\ISDecisions\UserLock by default. ## How to uninstall UserLock and remove all corresponding data? See dedicated procedure: click [here](/userlock/docs/guides/installation/how-to-uninstall-userlock-and-remove-all-corresponding-data-)