Deploy the Desktop Agent via Active Directory GPO (Windows)

The ZeusLock desktop agent runs in each user’s interactive Windows session — a tray app plus a local inspection proxy on 127.0.0.1:9876. Because it inspects live traffic in the logged-in session, it cannot protect a machine where nobody is signed in. This guide rolls the agent out to your domain-joined Windows fleet with Active Directory Group Policy.

How binding works

The installer you download is generic and carries no credentials. A machine is only bound to your organization once you deliver two configuration values separately:

• ServerUrl — your tenant API URL, for example https://api.zeuslock.ai.

• LicenseKey — your organization API key from Settings → API Keys (a zl_... value).

You do not configure what blocks versus alerts on the endpoint. The policy lives in the ZeusLock dashboard and the agent fetches it using the LicenseKey.

Prerequisites

• Windows 10/11 or Windows Server 2016 or later, domain-joined.

• A Group Policy Management console and rights to link a GPO to the target OU.

• A network share readable by all target computers (and by the SYSTEM account for machine-wide installs).

• Outbound network access from endpoints to your ServerUrl.

Step 1 — Download the MSI to a network share

In the dashboard, go to Agents → Deployment and download the Windows MSI. Copy it to a share every target machine can reach, for example \\fileserver\deploy\ZeusLock.msi. Confirm that Domain Computers have read access — software installed by Group Policy runs as SYSTEM, so the machine accounts must be able to read the file.

Step 2 — Create the GPO

1. Open Group Policy Management.

2. Right-click the OU that contains your target computers and choose Create a GPO in this domain, and Link it here.

3. Name it, for example, ZeusLock Agent, then Edit it.

Step 3 — Install the MSI (mind the per-user caveat)

The ZeusLock MSI is a per-user package. Group Policy Software Installation assigned under Computer Configuration can misbehave with per-user packages, so force a per-machine install. Choose one of the two approaches below.

Recommended — a computer startup script. Under Computer Configuration → Policies → Windows Settings → Scripts (Startup), add a PowerShell or batch startup script that installs silently and forces machine scope:

$msi = '\\fileserver\deploy\ZeusLock.msi'
$installed = Get-Package -Name '*Zeus*' -ErrorAction SilentlyContinue
if (-not $installed) {
    Start-Process msiexec.exe -ArgumentList @(
        '/i', "`"$msi`"", '/qn', 'ALLUSERS=1', 'MSIINSTALLPERUSER=""'
    ) -Wait
}

The key arguments are ALLUSERS=1 and MSIINSTALLPERUSER="", which convert the per-user package into a per-machine install for all users of the endpoint.

Alternative — Software Installation with a transform. If you prefer Computer Configuration → Policies → Software Settings → Software installation, create a new package, point it at the MSI on the share, and attach an .mst transform that sets ALLUSERS=1 and MSIINSTALLPERUSER="" so the assignment installs machine-wide.

Step 4 — Deliver the configuration

Deliver ServerUrl and LicenseKey with either of the following. The registry policy is the cleaner choice for Group Policy.

Option A — registry preference (recommended). Under Computer Configuration → Preferences → Windows Settings → Registry, create values under the key HKLM\SOFTWARE\Policies\ZeusLock:

• ServerUrl — REG_SZ, for example https://api.zeuslock.ai.

• LicenseKey — REG_SZ, your zl_... key.

• Optionally AgentEnabled and BlockingEnabled — REG_DWORD set to 1.

Option B — a JSON file. Instead, deploy a file at C:\ProgramData\ZeusLockDLP\config.json (via a GPO Files preference or your startup script) containing:

{
  "ServerUrl": "https://api.zeuslock.ai",
  "LicenseKey": "zl_your_org_api_key"
}

Save the file as UTF-8 without a BOM. In JSON, apiUrl and apiKey are accepted as legacy aliases, but prefer ServerUrl and LicenseKey. Do not use api_url, api_key, or any monitor_* keys — the agent ignores them.

Step 5 — Apply the policy and reboot

On a target machine, run gpupdate /force, then reboot. The startup script and Software Installation both run at boot as SYSTEM, and the registry preference applies during policy refresh. After the reboot, have the user sign in so the agent starts in their interactive session.

Step 6 — Verify

On the endpoint, confirm the configuration and the install:

reg query "HKLM\SOFTWARE\Policies\ZeusLock"
Get-Package *Zeus*

Then run a live test: with a user signed in, paste a test card number such as 4111 1111 1111 1111 into chatgpt.com and confirm an incident appears in the dashboard.

Full guide and templates

For end-to-end steps with ready-made startup scripts, an .mst transform, and registry and JSON templates, see the deployment repository at https://github.com/Zeuslock-ORG/zeuslock-agent-deployment.