# Install Agents using Windows GPO | ManageEngine Remote Access Plus **Last Updated On**: 05 Aug 2026 **19 minutes read** **Windows startup script** is a script that runs automatically when the operating system starts up. It is used to trigger the agent installation process automatically when a machine boots up. This ensures that the agent is installed before the user logs in, providing seamless deployment across multiple systems. [Windows GPO Tool](https://www.manageengine.com/remote-desktop-management/products/desktop-central/agent-installation-using-gpo-lightweight-tool.html) can be used to install agents using Startup Script. > **Note** > If a new GPO policy is applied, the installation for existing installed agents will be skipped on all machines. The remaining agents will be installed according to the new policy. ### Advantages: - Common method of agent installation through traditional GPO editor. - It allows for customization with additional parameters or scripts during GPO configuration for agent installation. ## Disadvantages: ### Disadvantages: - Requires a system restart for the GPO policy to apply, delaying agent installation until then. - In remote work environments with machines connected through VPN, this method may not be suitable if the VPN is not connected during the restart. - Complex to configure via traditional GPO editor > **For Endpoint Central versions 10.1.2124.1 and above, it is recommended to use exe based installation.** ## .EXE ### EXE-based Agent Installation in GPO Startup Script 1. **Download the agent package** - Open the server web console. - Navigate to **Agent > Computers** - Select the required remote office. - Click the **Download Agent** button. - Rename the file to `LocalOffice_Agent.exe`. ![download agent exe format in gpo scheduler](https://cdn.manageengine.com/sites/meweb/images/remote-desktop-management/help/device-onboarding/gposched1.webp) 2. [Download the script](https://www.manageengine.com/products/desktop-central/scripts/InstallAgentstartupscript.ps1) and place it in the folder. 3. **Create a GPO to identify targets for deployment** - Open the Group Policy Management Console (GPMC) by opening Run (Windows key + R) and typing `gpmc.msc`. - Once in the GPMC, right-click on your target "organizational unit" (typically a domain), and select **Create a GPO in this domain, and Link it here**. ![Once in the GPMC, right-click on your target](https://cdn.manageengine.com/sites/meweb/images/remote-desktop-management/help/device-onboarding/gposched4.webp) > **Note:** To install agents selectively on a few devices: > > - Click on the **Scope** tab. > - Under **Security Filtering** section, click **Add**. > - In the **Select User, Computer, or Group** dialog box, click **Object Types**. > - Select specific computer object types. > - Click **OK**. > - Specify the computer names. > - Click on **Check Names**. > - Click **OK**. 4. Enter a name for the new GPO. For example, `EC_Agent_Install`. 5. **Create a startup task to execute the deployment and installation of the Windows Agent** - Open the Group Policy Management Editor by right-clicking on the new GPO you created, and selecting **Edit**. - Expand **Computer Configuration --> Policies --> Windows Settings --> Scripts (Startup/Shutdown)**. - Right click **Startup**, click **Properties**, and switch to **PowerShell Scripts**. ![Create a start-up task to execute the deployment and installation of the Windows Agent.](https://cdn.manageengine.com/sites/meweb/images/remote-desktop-management/help/device-onboarding/startup1.webp) - Click **Show File**. - Paste the `Installagent.ps1` and `LocalOffice_Agent.exe` downloaded above into the created folder. ![place the agent file and powershell script in folder](https://cdn.manageengine.com/sites/meweb/images/remote-desktop-management/help/device-onboarding/startup2.webp) - Copy the network path (needed in later steps). Format: `\\Domain name\SysVol\Domain name\Policies\{ID}\Machine\Scripts\Startup` > **Note:** If the files cannot be placed in the shared UNC folder path: > > - Open **Server Manager --> File and Storage Services --> Shares**. > - Copy the local path of SYSVOL. > - Open the SYSVOL folder and respective script folder, for example: > `C:\Windows\SYSVOL\sysvol\Domain\Policies\{853CF422-03F1-4C6A-8C3C-9F941F40E23B}\Machine\Scripts\Startup` ![Open Server manager -> File and storage services -> Shares](https://cdn.manageengine.com/sites/meweb/images/remote-desktop-management/help/device-onboarding/startup3.webp) - Browse and navigate to the location. - In the **Startup Properties** dialog box, click **Add**. - Select **PowerShell Scripts** and specify the path and script as shown below: ![Make sure to select](https://cdn.manageengine.com/sites/meweb/images/remote-desktop-management/help/device-onboarding/startup4.webp) - **Script name:** `\\domain.com\SysVol\domain.com\Policies\{id}\Machine\Scripts\Startup\Installagent.ps1` - **Script parameters:** `LocalOffice_Agent.exe` > **Alternative:** You can execute a VBScript for agent installation using GPO. > > 1. Download the [VB script](https://www.manageengine.com/products/desktop-central/scripts/InstallAgentstartupVBSscript.vbs) and place it in the folder. > 2. Place it in the Script folder as mentioned above. > 3. Select **Scripts**. > 4. Change the script and parameters as below. ![As an alternative to the execution of PowerShell, you can also execute VBscript script for agent installation using GPO](https://cdn.manageengine.com/sites/meweb/images/remote-desktop-management/help/device-onboarding/startup5.webp) - **Script Name:** `\\domain.com\SysVol\domain.com\Policies\{id}\Machine\Scripts\Startup\Installagent.vbs` - **Script Parameters:** `LocalOffice_Agent.exe` 6. Click **OK** to close the **Add a Script** dialog box. 7. Click **OK** to close the **Startup Properties** dialog box. 8. Close the **Group Policy Object Editor**. 9. Close the **Group Policy Management** dialog box. 10. The script will be executed when the client computers reboot. ### Troubleshooting steps: Ensure the network path is accessible from the endpoints and check if the required files for installation are present in the shared folder. If the issue persists, share the following with support: 1. **GPO Result from the client machine** - Open Command Prompt as administrator. - Navigate to `C:\` and run: ``` gpresult /h gprep.html ``` - Upload the `gprep.html` file from `C:\`. 2. **Event Logs** - Export and upload Application and System Event Viewer logs. ## .MSI > **Note:** Ensure that the network has a domain-based setup and not a workgroup setup. The script will install the agent only on computers where it is not already installed. 1. Download the **Zip** file, extract it, and follow the steps below: - Navigate to the server web console → **Agent → Agent Installation**. - Under **Using Directory Services**, in the **GPO** tab, click **Download Agent**. - Select the required office. > **Note:** This can be a local or remote office depending on the target computers. 2. Save the `.msi` and `.mst` files in: `\\Domain name\SysVol\Domain name\Policies\{ID}\Machine\Scripts\Startup` Include `DCAgentServerInfo.json` only if the build version is 10.1.2124.1 and above. ![how to obtain ID Value in gpo startup script](https://cdn.manageengine.com/sites/meweb/images/remote-desktop-management/help/device-onboarding/idvalue.webp) ### Selective installation (optional) Follow these steps only if installing agents on selected devices (refer this [image](https://www.manageengine.com/products/desktop-central/images/security-filtering-gpo.png)): - Click the **Scope** tab. - Under **Security Filtering**, click **Add**. - In **Select User, Computer, or Group**, click **Object Types**. - Select specific computer object types. - Click **OK**. - Specify the computer names. - Click **Check Names**. - Click **OK**. Right click the GPO and click **Edit**. > **Alternative:** You can execute PowerShell instead of VBScript. ### Executing VBScript Refer to this [image](https://www.manageengine.com/products/desktop-central/images/script-parameters-gpo-vbs.png). - Expand **Computer Configuration --> Policies --> Windows Settings --> Scripts**. - Right click **Startup** → **Properties**. - Click **Show Files**. - Drag and drop [InstallAgent.vbs](https://www.manageengine.com/products/desktop-central/installAgent.vbs) (rename from `.txt` to `.vbs`) along with `UEMSAgent.msi` and `UEMSAgent.mst`. - Include `DCAgentServerInfo.json` (for build 10.1.2124.1 and above). - In **Startup Properties**, click **Add** and specify: ``` (\\Domain name\SysVol\Domain name\Policies\{ID}\Machine\Scripts\Startup)\InstallAgent.vbs ``` - Script parameters: ``` UEMSAgent.msi UEMSAgent.mst ``` For Build 100653 and above: - If SSL third-party certificate is uploaded: include `DMRootCA.crt` Script arguments: ``` "UEMSAgent.msi UEMSAgent.mst DMRootCA.crt" ``` - If SSL certificate is not uploaded: include `DMRootCA.crt DMRootCA-Server.crt` Script arguments: ``` "UEMSAgent.msi UEMSAgent.mst DMRootCA.crt DMRootCA-Server.crt" ``` ### Executing PowerShell Script Refer to this [image](https://www.manageengine.com/products/desktop-central/images/script-parameters-gpo-ps.png). - Ensure PowerShell is enabled on all client computers. - Expand **Computer Configuration --> Policies --> Windows Settings --> PowerShell Scripts**. - Right click **Startup** → **Properties**. - Click **Show Files**. - Drag and drop [InstallAgent.ps1](https://www.manageengine.com/products/desktop-central/scripts/InstallAgent.txt) (rename to `.ps1`) along with `UEMSAgent.msi` and `UEMSAgent.mst`. - Include `DCAgentServerInfo.json` (for build 10.1.2124.1 and above). - In **Startup Properties**, click **Add** and specify: ``` (\\Domain name\SysVol\Domain name\Policies\{ID}\Machine\Scripts\Startup)\PSInstallAgent.ps1 ``` - Script parameters: ``` "UEMSAgent.msi" "UEMSAgent.mst" ``` For Build 100653 and above: - If SSL third-party certificate is uploaded: include `DMRootCA.crt` Script arguments: ``` "UEMSAgent.msi UEMSAgent.mst DMRootCA.crt" ``` - If SSL certificate is not uploaded: include `DMRootCA.crt DMRootCA-Server.crt` Script arguments: ``` "UEMSAgent.msi UEMSAgent.mst DMRootCA.crt DMRootCA-Server.crt" ``` Click **OK** to close dialogs and editors. > **Note:** The script can be deployed to all computers in the domain. The target should not be a user group. ### Notes - Set `.vbs` file association to Microsoft Windows-based script host on all client computers. - You can leave the GPO object installed indefinitely for future computers. - The script will not reinstall agents that are already installed. - You do not need to update and download `UEMSAgent.msi` after every server update. The agent auto-upgrades when new versions are available. > **Configuring IP Scope will help while deploying agents using GPO** > > - If IP scope is configured for all remote offices, administrators can download the local office `UEMSAgent.msi` and deploy it across remote offices using GPO. > - IP scope automatically detects computers within the specified IP range and reinstalls the appropriate agent. > - [Know more on IP Scope here](https://www.manageengine.com/remote-desktop-management/products/desktop-central/help/configuring_desktop_central/managing_computers_wan.html#IP_Scope) [These are the other ways by which you can proceed with agent installation.](https://www.manageengine.com/remote-desktop-management/products/desktop-central/scope-of-management-how-to.html#som-how-to2) --- ## Common Installation Issues - [Access is denied](https://www.manageengine.com/remote-desktop-management/products/desktop-central/agent_installation_access_denied.html) - [The network path was not found](https://www.manageengine.com/remote-desktop-management/products/desktop-central/agent_installation_failure_path.html) - [Logon Failure: Unknown user name or password](https://www.manageengine.com/remote-desktop-management/products/desktop-central/agent_installation_logon_failure.html) - [No Network provider accepted the given Network Path](https://www.manageengine.com/remote-desktop-management/products/desktop-central/agent_installation_network_provider.html) - [Not enough server storage is available to process this command](https://www.manageengine.com/remote-desktop-management/products/desktop-central/agent_installation_failure_storage.html) If you still face issues installing the agents, contact support at [remoteaccessplus-support@manageengine.com](mailto:remoteaccessplus-support@manageengine.com). [Agent Installation Knowledge Base](https://www.manageengine.com/remote-desktop-management/products/desktop-central/knowledge-base.html) [Other GPO Installation Methods](https://www.manageengine.com/remote-desktop-management/products/desktop-central/help/configuring_desktop_central/advantages-and-disadvantages-of-agent-installation-via-gpo.html)