How to Deploy ControlUp Agent via GPO in VDI Environments with MSI Silent Install and PowerShell Automation

Deploying the ControlUp Agent for VDI environments via Group Policy Object (GPO) does not have a dedicated official knowledge-base article, as the installation approach aligns with generic MSI silent installs used in other deployment methods like SCCM or PDQ. The official ControlUp documentation regarding local machine connection and agent communication is the primary reference for deployment: https://support.controlup.com/docs/connect-to-your-machines-locally and https://support.controlup.com/docs/agent-outbound-communication.

For non-persistent VDI setups that use a gold master image, the recommended method is to install the ControlUp agent MSI directly on the master image with specific MSI properties: `MASTER_IMAGE=true`, along with the `AUTHKEY` and `RegistrationKey`. This avoids the need for repeated installations on cloned machines via GPO. For persistent, domain-joined virtual machines, using a GPO Computer Startup Script to run an msiexec command is preferred over GPO Software Installation because it allows passing required MSI properties. An example command line looks like this:
`msiexec /i \\share\ControlUpAgent-xxxx.msi /qn AUTHKEY=”<key>” RegistrationKey=”<key>” MASTER_IMAGE=true`
The authentication keys are retrieved from the Real-Time Console under Settings → Agent. The Registration Key is mandatory starting from version 9.0. Machines must be manually added to the organization tree unless the agent version is 9.0.5 or higher, which supports self-registration.

When GPO deployment is not optimal, if remote RPC or WMI connectivity is available, deploying the agent remotely via the ControlUp console or Monitor is simpler. For cloud-managed endpoints, Microsoft Intune is the officially documented deployment method.

A practical example was shared demonstrating a PowerShell script to deploy the ControlUp Agent MSI for VDI within a Nerdio scripted action context. The script copies the MSI from a UNC file share to a local temporary path, validates that the MSI file is correctly copied (including a check on the MSI magic bytes), and then executes the msiexec command with silent installation flags, the authentication keys, and logging enabled. It captures and reports installation exit codes and prompts when a reboot is required. The script also includes a post-installation check to list ControlUp-related services to confirm the agent installed and started as expected.

This approach encapsulates the best practice for deploying ControlUp agents in VDI environments using GPO, balancing MSI property requirements, version-specific authentication mechanisms, and practical scripting for automation. For detailed agent deployment contexts and command-line references, the ControlUp official documentation remains the authoritative source: https://support.controlup.com/docs/connect-to-your-machines-locally and https://support.controlup.com/docs/agent-outbound-communication.

Read the entire ‘How to Deploy ControlUp Agent via GPO in VDI Environments with MSI Silent Install and PowerShell Automation’ thread below:

Hey team! Does anyone have the document to deploy the ControlUp for VDI Agent via GPO? I cannot find it in the knowledge base.

Hi Lucas,
Bottom line: There’s no dedicated “install cuAgent via GPO” KB. Official docs treat GPO the same as SCCM/PDQ — silent MSI install. Best references:
• support.controlup.com/docs/connect-to-your-machines-locally
•
Recommended approach
• Non-persistent VDI (gold image): Install MSI on the master image with `MASTER_IMAGE=true`+`AUTHKEY`+`RegistrationKey`. Don’t rely on ongoing GPO to clones.
• Persistent domain-joined VMs: GPOComputer Startup Script with `msiexec` is usually better than Software Installation, since you need MSI properties.
Example
`msiexec /i \\share\ControlUpAgent-….msi /qn AUTHKEY=”<key>” RegistrationKey=”<key>” MASTER_IMAGE=true`
Keys come from Real-Time Console → Settings → Agent (Authentication Key + Registration Key). Registration Key is required for outbound (9.0+).
After install: Machines still need to be added to the org tree (Add Machines / `Add-CUComputer`) unless they’re on 9.0.5+ with self-registration.

When GPO isn’t ideal: If RPC/WMI works, console/monitor remote deploy is simpler. For cloud-managed endpoints, Intune is the documented path.

Hey Abel! Thank you so much for you support. I use that links and create this script.

“`# ControlUp Agent for VDI install – Nerdio Scripted Action

$AuthKey = “KEY MODIFY”
$RegistrationKey = “REG MODIFY”

$Version = “9.2.0.622”

# Caminho UNC do MSI no file share local (ajuste para o seu ambiente)
$SourcePath = “\\fileserver\Software$\ControlUp\ControlUpAgent-net48-x64-9.2.0.622.msi”

$TempPath = “C:\Windows\Temp\ControlUp”
$MsiPath = “$TempPath\ControlUpAgent-$Version.msi”
$LogPath = “$TempPath\ControlUpAgent-$Version-install.log”

New-Item -Path $TempPath -ItemType Directory -Force | Out-Null

Write-Output “Copiando ControlUp Agent $Version de $SourcePath…”

if (!(Test-Path $SourcePath)) {
throw “MSI nao encontrado em $SourcePath. Verifique o caminho e as permissoes de leitura da maquina no share.”
}

Copy-Item -Path $SourcePath -Destination $MsiPath -Force

if (!(Test-Path $MsiPath)) {
throw “Falha ao copiar o MSI para $MsiPath.”
}

# Validacao: confirma que o arquivo copiado e um MSI valido (magic bytes D0 CF 11 E0)
$magicBytes = Get-Content -Path $MsiPath -Encoding Byte -TotalCount 4 -ErrorAction SilentlyContinue
if (-not $magicBytes -or ($magicBytes[0] -ne 0xD0) -or ($magicBytes[1] -ne 0xCF)) {
throw “Arquivo copiado nao parece ser um MSI valido. Verifique se $SourcePath aponta para o arquivo correto.”
}

Write-Output “Installing ControlUp Agent $Version…”

$Arguments = @(
“/i `”$MsiPath`””
“/qn”
“/norestart”
“AUTHKEY=`”$AuthKey`””
“RegistrationKey=`”$RegistrationKey`””
“/L*v `”$LogPath`””
)

$Process = Start-Process -FilePath “msiexec.exe” -ArgumentList $Arguments -Wait -PassThru

Write-Output “MSI exit code: $($Process.ExitCode)”
Write-Output “Install log: $LogPath”

if ($Process.ExitCode -ne 0 -and $Process.ExitCode -ne 3010) {
throw “ControlUp Agent installation failed. Exit code: $($Process.ExitCode). Check log: $LogPath”
}

if ($Process.ExitCode -eq 3010) {
Write-Output “ControlUp Agent installed successfully. Reboot required.”
} else {
Write-Output “ControlUp Agent installed successfully.”
}

# Optional validation
Get-Service | Where-Object { $_.Name -like “ControlUp” -or $_.DisplayName -like “ControlUp” } | Format-Table Name, Status, DisplayName -AutoSize“`

Continue reading and comment on the thread ‘How to Deploy ControlUp Agent via GPO in VDI Environments with MSI Silent Install and PowerShell Automation’.  Not a member? Join Here!