Process flow for Windows login agent deployment from the ADSelfService Plus admin portal

Prerequisites:

1. Before deploying the login agent, ensure ADSelfService Plus is running in application mode. 
   
2. The credentials provided during domain configuration must belongs to a service account that is a part of the Active Directory Domain Admins group.
   

Step 1) The ADSelfServicePlusClientSoftware.msi file gets copied over to the target machine under the admin$ share

1. The service account used for domain configuration in ADSelfService Plus must be a Domain Admin to access the admin$ share of the target user machine.
2. The admin$ share should be accessible over the network.

Step 2) Remote installation. The copied file then gets executed remotely using RemCom.exe, PAExec.exe, or WMI

1. The Windows Remote Registry service must be running on the target user machine.
   
2. The service account used for domain configuration in ADSelfService Plus must be a Domain Admin to have update permissions for Windows Registry settings on the target machine.
   

How to configure a domain using service account with Domain Admin permissions in ADSelfService Plus

1. Log into the ADSelfService Plus admin portal. Click Domain Settings on the top-right corner.
   
2. Under the Actions column, click the Edit Domain Details icon. The Edit Domain Settings page will open.
3. Here, select the Authentication checkbox, and add or update the preferred service account's credentials as the Domain Username and Domain Password.

Common errors that hinder the Windows login agent installation sequence

1. Access to admin$ of the client computer is not available
   In the machine where ADSelfService Plus is installed, select Start > Run, and type \\<client ComputerName>\admin$.  If you get the same error, enable Remote Administration exception on the client computers as below:

1. From the client computer, select Start > Run and type gpedit.msc and press Enter.
   
2. Expand the Administrative Templates > Network Connections > Windows Firewall.
   
3. Click the Domain Profile and double-click the Firewall: Allow remote administration exception.
   
4. Select Enabled and click OK.

1. Windows Remote Registry Services are not enabled
   To enable Remote Registry Services:

1. Open Services.
   
2. Find the Remote Registry service.
   
3. Verify that it runs on System Startup.

1. Antivirus software blocks the login agent installation
   Please disable any antivirus or firewall on the client and server then try to reinstall the Windows login agent. The RemCom.exe file is used to install the client software remotely to the machines. Please exclude the installation directory of ManageEngine ADSelfService Plus in antivirus software so that the RemCom.exe file is not blocked from accessing the ADSelfService Plus server.