> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/unigetui/for-it-teams/organization/devolutions-agent.md).

# Install approved apps without admin rights

Let standard users install and update the apps you approve, without administrator rights or UAC prompts, by delegating operations to Devolutions Agent.

Standard users can't run most installers on Windows. With Devolutions Agent, they don't need to: UniGetUI hands the operation to the Agent, which checks it against **your policy** and runs it with the rights it needs. Users get the apps they're allowed to have, and nothing else.

{% hint style="info" %}
Windows only. Requires Devolutions Agent.
{% endhint %}

## How it works

1. A user clicks ***Install***, ***Update*** or ***Uninstall*** in UniGetUI.
2. Instead of showing a UAC prompt, UniGetUI sends the request to the package broker in Devolutions Agent.
3. The Agent compares the request with the policy you defined: which apps, sources, operations and versions are allowed.
4. If the policy allows it, the Agent runs the operation and UniGetUI shows its progress and output as usual. If not, the operation fails with ***Operation denied by policy*** and the reason you wrote in the rule.

**It's fail-closed.** If the Agent isn't installed, isn't running, or can't be reached, the operation fails. UniGetUI never falls back to a UAC prompt. And if a user turns the broker off in UniGetUI, they're back to UAC prompts they can't approve without administrator credentials, so they gain nothing.

Operations of WinGet, Chocolatey, Scoop, Windows PowerShell, PowerShell 7, pip, npm, Bun, Cargo, .NET Tool and vcpkg can go through the Agent. Apps that UniGetUI only detects on the computer (source ***Local PC***) aren't sent to it.

{% stepper %}
{% step %}

### Install and enable the broker in Devolutions Agent

Install Devolutions Agent on the computers. See [Deploy Devolutions Agent silently](https://docs.devolutions.net/resources/devolutions-agent/deploy-devolutions-agent-silently).

{% hint style="warning" %}
**Documentation pending.** The steps to enable the package broker in Devolutions Agent, and to set where the Agent reads its policy file and whether UniGetUI may change it, aren't documented yet. Contact Devolutions support if you need them now.
{% endhint %}

Also [install UniGetUI for all users](/unigetui/for-it-teams/organization/deploy.md) (`/ALLUSERS`). That's required to create or edit the policy from UniGetUI.
{% endstep %}

{% step %}

### Turn on the broker in UniGetUI

1. Go to ***Settings*** – ***Administrator rights and other dangerous settings***.
2. Turn on ***Delegate package operations to the Devolutions Agent broker***.

From now on, install, update and uninstall operations go through the Agent.
{% endstep %}

{% step %}

### Create the policy

1. On the same settings page, click ***Inspect active package broker policy***.
2. If the ***State*** shows that no policy exists, click ***Create***. To change an existing policy, click ***Edit***.
3. Enter a ***Policy ID*** (for example `contoso-workstations`) and a ***Publisher***. Optionally add a ***Description*** and a ***Support URL*** where users can ask for an exception.
4. Leave the ***Default decision*** on ***Deny***, so anything you don't explicitly allow is blocked.
5. Click ***Add rule*** for each group of apps you want to allow (see below).
6. Click ***Save*** and approve the Windows administrator prompt.

{% hint style="info" %}
Rolling out for the first time? Set ***Audit mode*** to ***Yes***. The Agent logs what it would deny but lets everything through. Once the logs look right, set it back to ***No***.
{% endhint %}
{% endstep %}

{% step %}

### Check that it works

Install an allowed app and a forbidden one from a standard user account. The first should install without any prompt; the second should fail with ***Operation denied by policy***.
{% endstep %}
{% endstepper %}

## What a policy can control

Each rule \_**Allow**\_s or \_**Deny**\_s the requests that match it. Rules are evaluated in order; use ***Move up*** and ***Move down*** to change it. Leave a criterion empty to match everything.

<table><thead><tr><th width="220">CONTROL</th><th>EXAMPLES</th></tr></thead><tbody><tr><td><strong>Packages</strong></td><td>Exact IDs (<code>Mozilla.Firefox</code>) or patterns (<code>Contoso.*</code>).</td></tr><tr><td><strong>Sources</strong></td><td>Only the <code>winget</code> source, or your internal Chocolatey feed. Available when one package manager is selected.</td></tr><tr><td><strong>Operations</strong></td><td>Allow updates for everything, but installs only for a short list.</td></tr><tr><td><strong>Versions</strong></td><td>Exact versions, or a range with a minimum and a maximum version, with or without prereleases.</td></tr><tr><td><strong>Scope, architecture, privilege</strong></td><td>User or machine installs; x86, x64, Arm64; standard or elevated requests.</td></tr><tr><td><strong>Request options</strong></td><td>Interactive installs, skipped hash checks, custom parameters, custom install location, pre/post commands, and more.</td></tr></tbody></table>

On an ***Allow*** rule, select ***Add safety limits to this Allow rule*** to restrict what a matching request may do, for example to forbid custom parameters or a custom install location.

{% hint style="danger" %}
Skipping hash checks, custom parameters and pre/post commands can run arbitrary code with elevated rights. Keep them off in your Allow rules unless you've reviewed a specific need.
{% endhint %}

You can also limit when the whole policy applies with ***Valid from*** and ***Valid until***. Outside this period, the Agent rejects package operations.

## Inspect the active policy

Anyone can check what's enforced on a computer, which helps when a user reports a denied app.

1. Go to ***Settings*** – ***Administrator rights and other dangerous settings***.
2. Click ***Inspect active package broker policy***.
3. Review the ***Package broker policy*** section, then the rules. Click ***Refresh*** after a policy change.

<table><thead><tr><th width="260">FIELD</th><th>WHAT IT TELLS YOU</th></tr></thead><tbody><tr><td><strong>State</strong></td><td>Whether a valid policy is in effect, missing, or invalid. An invalid policy must be fixed or replaced by an administrator outside UniGetUI.</td></tr><tr><td><strong>Configured path</strong> / <strong>Path source</strong></td><td>Where the Agent reads the policy file, and whether that's its default location.</td></tr><tr><td><strong>Agent write capability</strong></td><td>Whether the Agent lets the policy be changed: <strong>Writable</strong>, <strong>Read-only</strong> or <strong>Unsupported</strong>.</td></tr><tr><td><strong>Policy changes from this app</strong> / <strong>Reason</strong></td><td>Whether you can edit the policy from this UniGetUI, and why not. Editing requires the Agent's permission and an all-users installation.</td></tr><tr><td><strong>Elevation required</strong></td><td>Whether saving asks for Windows administrator approval.</td></tr></tbody></table>

If the page shows ***Devolutions Agent is unavailable***, check that the Agent is installed and its service is running, then click ***Refresh***.

## What users see

For users, nothing changes: they install and update apps as usual, without UAC prompts. When something goes wrong, the operation fails with one of these messages:

<table><thead><tr><th width="280">MESSAGE</th><th>WHAT TO DO</th></tr></thead><tbody><tr><td><strong>Operation denied by policy</strong></td><td>The policy doesn't allow this app, source, operation or version. The rule's reason is shown. Ask your administrator.</td></tr><tr><td><strong>Agent broker unavailable</strong></td><td>Devolutions Agent isn't installed or isn't running.</td></tr><tr><td><strong>Operation unsupported by broker</strong></td><td>The Agent doesn't support this operation or option.</td></tr><tr><td><strong>Broker communication error</strong></td><td>The Agent didn't answer in time. The operation may still be running.</td></tr><tr><td><strong>Operation failed via broker</strong></td><td>The Agent accepted the request but the installation failed. Open the operation output for details.</td></tr></tbody></table>

## If it doesn't work

* Every operation fails with ***Agent broker unavailable***: the Agent service is stopped or missing. See [An update or installation fails](/unigetui/help/troubleshooting/update-or-install-fails.md).
* You can't click ***Create*** or ***Edit***: read the ***Reason*** field. Usually UniGetUI isn't installed for all users, or the Agent doesn't allow policy changes.
* A user needs support: [Send logs to support](/unigetui/help/troubleshooting/send-logs-to-support.md).

## Next

* [Lock down risky settings](/unigetui/for-it-teams/organization/restrict-settings.md)
* [Standardize workstations](/unigetui/for-it-teams/organization/standard-workstations.md)
* [Devolutions Agent documentation](https://docs.devolutions.net/resources/devolutions-agent)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/unigetui/for-it-teams/organization/devolutions-agent.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.