--- locale: "en" updated_at: "2025-10-31T09:41:35.078Z" canonical: "https://www.isdecisions.com/en/userlock/docs/support/faq/installation" --- # Installation Find information about installing, upgrading, and maintaining UserLock. ## What Operating Systems are supported by UserLock UserLock supports many operating systems. You will find detailed information on [this page](/userlock/docs/getting-started/requirements). ## What is the hardware requirement? The required hardware for a UserLock server depends on the number of user sessions that will be protected. A medium sized server should be sufficient in most cases: a server with a 2 GHz dual core CPU, 2 GB of RAM and a recent hard drive should be able to manage up to 10000 simultaneous sessions. With such a processor UserLock can process up to 100 logon event/s. With such a logon rate you can authenticate 6000 users in one minute. Please note that in an organization with a very high quantity of users (for example greater than 10000) it is unlikely to have that many connections during the same minute. You will find detailed information on [this page](/userlock/docs/getting-started/requirements). ## What is the disk space consumed by the UserLock database? To calculate the disk space needed for the UserLock database, you have to consider the disk space consumed to keep the user session history: A logon event consumes 0.5 KB of disk space. Typically a user generates at least 4 connection events during a day (a logon, a lock, an unlock and a logoff) so you can calculate the disk space consumed per year as following. Example for 100 users: 100 X 4 X 0.5 KB = 200 KB/day = 4 MB/Month (20 business days) = 50 MB/Year You can simply use this formula to estimate the disk space consumed by the database according to the number of users and the time period your history have to cover. You can find more information on UserLock requirements on [this page](/userlock/docs/getting-started/requirements). ## What is the bandwidth consumed by UserLock ? A logon event exchanges 3 KB of data through the network. The network bandwidth consumed will depend on the logon rate. For example a logon rate of 100 logon/s will generate 300 KB/s. In consequence any 100 Mb/s network card (10 MB/s) will be sufficient in most cases. Take note that if you have slow network connections to some remote sites, then you should take into account the number of users behind connections. You will find detailed information on [this page](/userlock/docs/getting-started/requirements). ## Do I need to install UserLock on a Domain Controller ? No. This is not a requirement as UserLock can be installed on a member server of the domain as well as a Domain Controller. You will find detailed information on [this page](/userlock/docs/getting-started/requirements). ## Can I install the UserLock console on another machine than the server? You can install the UserLock web application and make it accessible on your corporate network. You will find detailed information on [this page](/userlock/docs/guides/installation/web-console). ## Do I need to install UserLock on a dedicated server ? For less than 10, 000 concurrent sessions, a recent server doesn’t need to be dedicated: it can be used for some others applications. We advise to have a dedicated server for UserLock application over 10, 000 concurrent sessions. You will find detailed information on [this page](/userlock/docs/getting-started/requirements). ## What are the protocols used for UserLock server/agent communication ? The required protocols are: - the ping (ICMP), - the Microsoft Files and Printers sharing (SMB TCP 445). You need to be sure that all firewalls and routers between the server and the agent don’t block these two protocols on both sides. You will find detailed information on [this page](/userlock/docs/reference/modules/communication-required-protocols). ## What results (credentials, files, folders, registry...) from the installation of UserLock and its agents on a domain ? ## Credentials The credentials required in the Configuration Wizard of UserLock are only stored on the UserLock server. This information is not stored on any other machine. The impersonation account is used by the UserLock service only. The UserLock Desktop Agent runs as the local SYSTEM account on the associated computer. The impersonation account is used by the UserLock service to perform remote actions on protected computers: installing the UserLock Desktop Agent, remotely logging off a session from the UserLock console, remotely shut down a computer, etc. When performing any of these action, nothing is stored on the target computer. Only the UserLock server has locally stored credentials. ## Changes made to Files, folders and registry #### UserLock service 1. **Installation folder of the UserLock package:** By default: "%ProgramFiles(x86)%\ISDecisions\UserLock". 2. **Full path the registry key:** "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ISDecisions\UserLock". #### UserLock Agents 1. **Desktop:** the file is stored in the system folder. 2. **NPS:** - 1. %windir%\System32\ULIasAgent.dll - 2. Full path the registry key: "HKEY_LOCAL_MACHINE\SOFTWARE\ISDecisions\UserLock\IAS" 3. **IIS:** - 1. HTTPModule: %windir%\System32\UlHttpModule.dll - 2. Full path the registry key: "HKEY_LOCAL_MACHINE\SOFTWARE\ISDecisions\UserLock\IIS" ### Executable file Copied from UserLock server to the workstation if a remote administrative action is done (logoff, lock...): 1. %windir%\SysWOW64\SessionAgent.exe 2. %windir%\SysWOW64\SessionAgentUI.exe ## What are the requirements for the UserLock Backup server ? They are the same as the UserLock Primary server ([see this page](/userlock/docs/getting-started/requirements)). ## How to configure client requirements through group policies? You will find detailed information on [this page](/userlock/docs/guides/installation/enforce-firewall-requirements-on-userlock-server-and-protected-machines). ## How do I install UserLock across multiple sites? There are two ways to install UserLock across multiple sites. *Note: To calculate the network bandwidth that will be used, a logon event exchanges 3 KB of data through the network. So, for example a logon rate of 100 logons/s will generate 300 KB/s. Therefore any 100 Mb network card (10 MB/s) will be sufficient in most cases* 1. **Recommended:** Install the service on one server, and deploy the agent to end clients on all sites. This will allow you to manage all users in one centralized console. ![](https://a.storyblok.com/f/122374/747x588/f88678baa9/multiple-site-environment-multiple-service-installations-small.png) 2. If you have a slow network connection, or sites that have no internet connection, you can also install a UserLock service in each site as shown below. In this configuration, for sites with internet connection, you can still manage each installation from one console, but the reporting and restrictions will be separated by site. ![](https://a.storyblok.com/f/122374/747x678/6ceacd772e/multiple-site-environment-small.png) ## How to run a UserLock server installed on Windows Server 2019 with Desktop UserLock agents installed on Windows XP workstations. Microsoft has decided to disable the SMB1 protocol in Windows Server 2019 by default to force the use of newer SMB versions. However, Windows XP does not support these new versions, and only works with SMB1. This makes communication between these two operating systems impossible via File and Printer Sharing, which is a UserLock prerequisite for communication between service and agents. Therefore, if UserLock is installed on Windows Server 2019 and Desktop UserLock agents are installed on Windows XP workstations, UserLock will not be able to protect these workstations. For UserLock to work correctly in this scenario, you can enable the SMB1 protocol on Windows Server 2019 as follows: - Open Server Manager - Manage -> Add Roles and Features - Advance to the "Features" section - Check “SMB 1.0/CIFS File Sharing Support”: ![](https://a.storyblok.com/f/122374/788x562/b6878a06f6/smb-1-0-cifs-file-sharing-support.png) ## Can the UserLock SSO feature be installed as a separate server ? Yes. You need to execute Userlock "custom" setup on a separate server and simply uncheck all other options except "UserLockSSO". ![](https://a.storyblok.com/f/122374/495x376/4cef438977/install-shield-userlock-sso-en.png) The configuration wizard will assist you to [install and configure Single Sign-On](/userlock/docs/server-administration/sso-administration/install-configure) feature on this separate server. ## Is Userlock affected by the CVE-2021-44228 CVE-2022-22963 CVE-2022-22965 Log4Shell Vulnerability ? No. UserLock is not based on Java and doesn't use the log4j logging module so it is not affected by the CVE-2021-44228 CVE-2022-22963 CVE-2022-22965 Log4Shell Vulnerability. ## Why do I have to upgrade a beta version? The purpose of a beta release is to upgrade your production version to the final version (as soon as it's available). Furthermore, if no valid license key is registered on the server, beta versions expire on a predetermined date. See [this](/userlock/docs/guides/installation/beta-testing-procedure) page for more details on beta versions.