# How to Install agents using Start Up Script?

**Last Updated On**: 22 Jul 2026  
**19 minutes read**

**Windows startup script** is a script that runs automatically when the operating system starts up. It is used to trigger the agent installation process automatically when a machine boots up. This ensures that the agent is installed before the user logs in, providing seamless deployment across multiple systems. [Windows GPO Tool](https://www.manageengine.com/products/desktop-central/products/desktop-central/agent-installation-using-gpo-lightweight-tool.html) can be used to install agents using Startup Script.

> **Note:** If a new GPO policy is applied, the installation for existing installed agents will be skipped on all machines. The remaining agents will be installed according to the new policy.

## Advantages:

- Common method of agent installation through traditional GPO editor.
- It allows for customization with additional parameters or scripts during GPO configuration for agent installation.

## Disadvantages:

- Requires a system restart for the GPO policy to apply, delaying agent installation until then.
- In remote work environments with machines connected through VPN, this method may not be suitable if the VPN is not connected during the restart.
- Complex to configure via traditional GPO editor

**For Endpoint Central versions 10.1.2124.1 and above, it is recommended to use exe based installation.**

## .EXE

### EXE-based agent installation in GPO Startup Script

1. Download the agent package
   - Open the server web console.
   - Navigate to **Agent > Computers**
   - Select the required remote office.
   - Click the **Download Agent** button.
   - Rename the file to `LocalOffice_Agent.exe`.

![download agent exe format in gpo scheduler](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gposched1.webp)

2. [Download the script](https://www.manageengine.com/products/desktop-central/scripts/InstallAgentstartupscript.ps1) (SHA 256 Checksum: Calculating...) and place it in the folder.

3. Create a GPO to identify targets for deployment
   - Open the Group Policy Management Console (GPMC) by opening Run (Windows key + R) and typing **gpmc.msc**.
   - Right-click on your target organizational unit (typically a domain), and select **Create a GPO in this domain, and Link it here**.

![Once in the GPMC, right-click on your target](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/gposched4.webp)

> **Note:** To install agents selectively on a few devices:
>
> - Click on the **Scope** tab.
> - Under **Security Filtering**, click **Add**.
> - In the **Select User, Computer, or Group** dialog box, click **Object Types**.
> - Select specific computer object types.
> - Click **OK**.
> - Specify the computer names.
> - Click **Check Names**.
> - Click **OK**.

4. Enter a name for the new GPO (for example, `EC_Agent_Install`). The new GPO will appear under **Group Policy Objects**.

5. Create a startup task to execute deployment and installation:
   - Right-click the new GPO and select **Edit**.
   - Expand **Computer Configuration --> Policies --> Windows Settings --> Scripts (Startup/Shutdown)**.
   - Right-click **Startup**, click **Properties**, and switch to **PowerShell Scripts**.

![Create a start-up task to execute the deployment and installation of the Windows Agent.](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/startup1.webp)

- Click **Show Files**.
- Paste **Installagent.ps1** and **LocalOffice_Agent.exe** into the folder.

![place the agent file and powershell script in folder](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/startup2.webp)

- Copy the network path:  
  `\\Domain name\SysVol\Domain name\Policies\{ID}\Machine\Scripts\Startup`

> **Note:** If files cannot be placed in the shared UNC folder path:
>
> - Open **Server Manager → File and Storage Services → Shares**.
> - Copy the Local Path of SYSVOL.
> - Navigate to:  
>   `C:\Windows\SYSVOL\sysvol\Domain\Policies\{GUID}\Machine\Scripts\Startup`

![Open Server manager -> File and storage services -> Shares](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/startup3.webp)

- In **Startup Properties**, click **Add**.
- Select **PowerShell Scripts** and specify:

![Make sure to select](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/startup4.webp)

- **Script name:**  
  `\\domain.com\SysVol\domain.com\Policies\{id}\Machine\Scripts\Startup\Installagent.ps1`
- **Script parameters:**  
  `LocalOffice_Agent.exe`

> **Alternative:** You can use a VBScript instead of PowerShell.
>
> 1. Download the [VB script](https://www.manageengine.com/products/desktop-central/scripts/InstallAgentstartupVBSscript.vbs).
> 2. Place it in the Script folder.
> 3. Select **Scripts**.
> 4. Configure as shown below:

![As an alternative to the execution of PowerShell, you can also execute VBscript script for agent installation using GPO](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/startup5.webp)

- **Script name:**  
  `\\domain.com\SysVol\domain.com\Policies\{id}\Machine\Scripts\Startup\Installagent.vbs`
- **Script parameters:**  
  `LocalOffice_Agent.exe`

6. Click **OK** to close dialogs.  
7. Close the editors and management console.  
8. The script executes when client computers reboot.

### Troubleshooting steps

- Ensure the network path is accessible from endpoints.
- Verify required files are present in the shared folder.

If issues persist, collect:

1. **GPO Result from client**
   - Open Command Prompt as administrator.
   - Run:
     ```
     gpresult /h gprep.html
     ```
   - Upload `C:\gprep.html`.

2. **Event Logs**
   - Export and upload Application and System logs from Event Viewer.

---

## .MSI

> **Note:** Ensure the network uses a Domain-based setup (not Workgroup). The script installs the agent only on computers where it is not already installed.

1. Download the **Zip** file and extract it:
   - Navigate to **Agent → Agent Installation** in the server console.
   - Under **Using Directory Services**, in the **GPO** tab, click **Download Agent**.
   - Select the required office.

> **Note:** This can be a local or remote office.

2. Save the `.msi` and `.mst` files in:  
   `\\Domain name\SysVol\Domain name\Policies\{ID}\Machine\Scripts\Startup`  
   Include `DCAgentServerInfo.json` only if build version is 10.1.2124.1 and above.

![how to obtain ID Value in gpo startup script](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/device-onboarding/idvalue.webp)

### To obtain {ID} value:

- Click **Start > Run**
- Enter `gpmc.msc`
- Click **OK**
- Right-click the domain → create and link a GPO
- Specify a name
- Select the GPO

> **Selective installation:** Follow these steps only if targeting specific devices (refer to this [image](https://www.manageengine.com/products/desktop-central/images/security-filtering-gpo.png)).
>
> - Click the **Scope** tab.
> - Under **Security Filtering**, click **Add**.
> - In **Select User, Computer, or Group**, click **Object Types**.
> - Select specific computer object types.
> - Click **OK**.
> - Specify computer names.
> - Click **Check Names**.
> - Click **OK**.

Right-click the GPO and click **Edit**.

### VBScript Method

Refer to this [image](https://www.manageengine.com/products/desktop-central/images/script-parameters-gpo-vbs.png).

- Expand **Computer Configuration → Policies → Windows Settings → Scripts**
- Right-click **Startup** → **Properties**
- Click **Show Files**
- Drag and drop:
  - [InstallAgent.vbs](https://www.manageengine.com/products/desktop-central/installAgent.vbs)
  - `UEMSAgent.msi`
  - `UEMSAgent.mst`

Include `DCAgentServerInfo.json` if build version is 10.1.2124.1 and above.

- Click **Add**
- Script path:  
  `(\\Domain name\SysVol\Domain name\Policies\{ID}\Machine\Scripts\Startup)\InstallAgent.vbs`
- Script parameters:  
  `UEMSAgent.msi UEMSAgent.mst`

**For Build 100653 and above:**

- If third-party SSL certificate is uploaded:
  - Include `DMRootCA.crt`
  - Script arguments:  
    `"UEMSAgent.msi UEMSAgent.mst DMRootCA.crt"`
- If not:
  - Include `DMRootCA.crt DMRootCA-Server.crt`
  - Script arguments:  
    `"UEMSAgent.msi UEMSAgent.mst DMRootCA.crt DMRootCA-Server.crt"`

### PowerShell Method

Refer to this [image](https://www.manageengine.com/products/desktop-central/images/script-parameters-gpo-ps.png).

- Ensure PowerShell is enabled on clients.
- Expand **Computer Configuration → Policies → Windows Settings → PowerShell Scripts**
- Right-click **Startup** → **Properties**
- Click **Show Files**
- Drag and drop:
  - [InstallAgent.ps1](https://www.manageengine.com/products/desktop-central/scripts/InstallAgent.txt)
  - `UEMSAgent.msi`
  - `UEMSAgent.mst`

Include `DCAgentServerInfo.json` if build version is 10.1.2124.1 and above.

- Click **Add**
- Script path:  
  `(\\Domain name\SysVol\Domain name\Policies\{ID}\Machine\Scripts\Startup)\PSInstallAgent.ps1`
- Script parameters:  
  `"UEMSAgent.msi" "UEMSAgent.mst"`

**For Build 100653 and above:**

- If third-party SSL certificate is uploaded:
  - Include `DMRootCA.crt`
  - Arguments: `"UEMSAgent.msi UEMSAgent.mst DMRootCA.crt"`
- If not:
  - Include `DMRootCA.crt DMRootCA-Server.crt`
  - Arguments: `"UEMSAgent.msi UEMSAgent.mst DMRootCA.crt DMRootCA-Server.crt"`

Click **OK**, close dialogs and consoles.

> **Note:** The script can be deployed to all computers in the domain. The target should not be a user group.

### Notes

- Associate `.vbs` files with Microsoft Windows based script host.
- You can leave the GPO indefinitely for future systems.
- The script does not reinstall existing agents.
- Agents auto-upgrade after installation.

> **Configuring IP Scope helps while deploying agents using GPO**
>
> - If IP scope is configured for all remote offices, administrators can download the local office `UEMSAgent.msi` and deploy via GPO.
> - IP scope detects computers within specified ranges and installs the correct agent.
> - Learn more: [IP Scope](https://www.manageengine.com/products/desktop-central/products/desktop-central/help/configuring_desktop_central/managing_computers_wan.html#IP_Scope)

[These are the other ways by which you can proceed with agent installation.](https://www.manageengine.com/products/desktop-central/products/desktop-central/scope-of-management-how-to.html#som-how-to2)

---

## Common Installation Issues

- [Access is denied](https://www.manageengine.com/products/desktop-central/products/desktop-central/agent_installation_access_denied.html)
- [The network path was not found](https://www.manageengine.com/products/desktop-central/products/desktop-central/agent_installation_failure_path.html)
- [Logon Failure: Unknown user name or password](https://www.manageengine.com/products/desktop-central/products/desktop-central/agent_installation_logon_failure.html)
- [No Network provider accepted the given Network Path](https://www.manageengine.com/products/desktop-central/products/desktop-central/agent_installation_network_provider.html)
- [Not enough server storage is available to process this command](https://www.manageengine.com/products/desktop-central/products/desktop-central/agent_installation_failure_storage.html)

If you still face issues installing agents, contact:  
[endpointcentral-support@manageengine.com](mailto:endpointcentral-support@manageengine.com)

[Agent Installation Knowledge Base](https://www.manageengine.com/products/desktop-central/products/desktop-central/knowledge-base.html)  
[Other GPO Installation Methods](https://www.manageengine.com/products/desktop-central/products/desktop-central/help/configuring_desktop_central/advantages-and-disadvantages-of-agent-installation-via-gpo.html)