# Install, Uninstall & Migrate Agents with GPO Tool **Last Updated On**: 20 Jul 2026 **7 minutes read** Windows GPO is a powerful and versatile tool. Agent can be **installed, uninstalled or migrated** using the GPO light-weight tool. ## Advantages - The GPO Lightweight Tool is a simple and user-friendly tool for configuring Group Policy Objects (GPO) to deploy agent installations, whether through startup processes or scheduled tasks. - It also allows to uninstall/ re-install agents through GPO without complexity on configuring the GPO. ## Disadvantages - The disadvantages of the GPO startup script and scheduled task methods are inherited. **Note:** - The GPO lightweight tool only supports .EXE files and does not support .MSI files. - Kindly use account with Domain Admin credentials. - If a new GPO policy is applied, the installation for existing installed agents will be skipped on all machines. The remaining agents will be installed according to the new policy. Follow the steps given below to create a Group policy and link it with OUs and Domains: ## Steps ### 1. Select the account details - Open the Domain Controller of the required AD in which the GPO needs to be configured. - To download the GPO tool click [here](https://workdrive.zohoexternal.com/external/ec722341046448a3b71debe0cb7853c143d6be3be678008c744951ab1aeb1359). - Execute the Tool As an administrator. - Select "**Continue with above details**" and click next. ![GPO tool showing auto-fetched account details with 'Continue with above details' selected](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gpo1.webp) - If you encounter an error in fetching the domain or domain controller name or if you would like to execute the tool from another machine instead of the domain controller machine, select the **enter details manually** option. Kindly use account with domain admin credentials privilege. ![Entering the domain and domain controller details manually in the GPO tool](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gpo2.webp) **To get the domain or OU Distinguished name, follow these steps:** - Under Administrative tools, open the active directory users and computers. ![Opening Active Directory Users and Computers from Administrative Tools](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gpo3.webp) - Under View, enable Advanced Features. ![Enabling Advanced Features under the View menu](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gpo4.webp) - Right click on the OU / Domain and Select Properties -> Attribute Editor -> distinguishedName -> View. ![Viewing the distinguishedName attribute from the OU or Domain properties Attribute Editor](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gpo5.webp) ### 2. Choose the required action - Select the required action **(Installation \ Uninstallation \ Migration)**. ![Selecting the required action — Installation, Uninstallation, or Migration](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gpo6.webp) **If you choose installation, for the agent installer EXE, follow these steps:** - Open the server web console. - Navigate to **Agent -> Computers**. - Select the required remote office. - Click **Download Agent** and add the downloaded file in the tool. ![Downloading the agent installer from Agent > Computers and adding it to the tool](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gpo7.webp) **If you choose uninstallation**, use the **AgentCleanupToolClient.exe**. Follow the steps given in this [document](https://www.manageengine.com/products/desktop-central/desktop_agent_uninstallation.html) to generate the Cleanup tool. ![Adding AgentCleanupToolClient.exe for the uninstallation action](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gpo13.webp) **If you choose migration**, use **Agent Installer exe and AgentCleanupToolClient.exe**. Follow the steps given in this [document](https://www.manageengine.com/products/desktop-central/desktop_agent_uninstallation.html) to generate the Cleanup tool. ![Adding the agent installer and AgentCleanupToolClient.exe for the migration action](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gpo12.webp) For the **agent installer EXE**, follow these steps: - Open the server web console. - Navigate to **Agent -> Computers**. - Select the required remote office. - Click **Download Agent** and add the downloaded file in the tool. ### 3. Choose the Policy details - **Enter the Name of the GPO** [eg : MEECAgentInstall ] -> **Enter the policy type** [Startup or scheduler ] -> **Select the Script type** [powershell script is always recommended]. ![Entering the GPO name, policy type, and script type](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gpo8.webp) ### 4. Link the GPO - To apply policy to entire domain, select "**Entire Domain**". - To apply the policy to a **specific OU**, enter the OU distinguished names and click next. (To obtain the OU distinguished name, refer to the first step.) ![Linking the GPO to the entire domain or a specific OU](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gpo9.webp) ### 5. Confirm the details - Confirm the policy details and click next. - The policy has been successfully created. ![Confirming the policy details, showing the policy created successfully](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gpo10.webp) **Note:** If the start up policy is configured, restart the endpoints and check the status and if the scheduler policy is created it will be applied in the endpoints within 90 mins. **To test the policy in a machine immediately after creation, follow the steps below:** - Open the **client machine -> Command prompt** as an admin and execute the command **gpupdate /force**. ![Running gpupdate /force in an administrator command prompt on the client machine](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gpo11.webp) - Once the policy update is completed restart the machine if the "**Start-up**" policy is configured. - For "**Immediate Task**" policy will be applied once the policy update is completed. Listed below are a few possible issues that can be encountered during agent installation, and resolution steps for the same: - [Access is denied](https://www.manageengine.com/products/desktop-central/help/tools/agent_installation_access_denied.html) - [The network path was not found](https://www.manageengine.com/products/desktop-central/help/cve/agent_installation_failure_path.html) - [Logon Failure: Unknown user name or password](https://www.manageengine.com/products/desktop-central/help/device-onboarding/agent_installation_logon_failure.html) - [No Network provider accepted the given Network Path](https://www.manageengine.com/products/desktop-central/help/device-onboarding/agent_installation_network_provider.html) - [Not enough server storage is available to process this command](https://www.manageengine.com/products/desktop-central/help/device-onboarding/agent_installation_failure_storage.html)