August 26, 2026

Run PowerShell script to deploy

PowerShell scripts prepare your environment with all the configuration settings. When you run the PowerShell script to deploy Unified Access Gateway, the solution is ready for production on first system boot.

However, both Admin UI and the API are not available if the Admin UI password is not provided during deployment. If you do not provide the Admin UI password at the time of deployment, you cannot add a user later to enable access to either the Admin UI or the API. You must redeploy your Unified Access Gateway.

You can include the parameters in the INI file for creating low-priviledged admin users with monitoring roles. Creating superuser admin user is not supported. You can configure the password policies for the root user and admin user before deploying the Unified Access Gateway instance.

Parameters

For more information about the parameters, you can see the section in which the equivalent admin UI parameter is used.

For example: some of the deployment parameters are described in PowerShell deployment parameters and Deploying to vSphere using the OVF Template Wizard.

For information about parameters used in system configuration, syslog server settings, network settings, and so on, see Advanced settings.

For information about parameters used in edge services and other use cases of Unified Access Gateway such as Workspace ONE Intelligence and Identify Bridging, see Edge Service settings.

Prerequisites

For a Hyper-V deployment, and if you are upgrading Unified Access Gateway with static IP, delete the older appliance before deploying the newer instance of Unified Access Gateway.
Verify that the system requirements are appropriate and available for use.

Procedure

Download the Unified Access Gateway OVA from the Omnissa Customer Connect portal to your machine.
Download the uagdeploy-XXX.zip files into a folder on the machine.

The ZIP files are available at the Omnissa Customer Connect page for Unified Access Gateway.
Open a PowerShell script and modify the directory to the location of your script.
Open the INI file for the Unified Access Gateway virtual appliance and modify the settings appropriately. For more information, see PowerShell deployment parameters.

For example: Deploy a new Unified Access Gateway appliance UAG1. The configuration file is named uag1.ini. This file contains all the configuration settings for UAG1. You can use the sample INI files in the uagdeploy.ZIP file to create the INI file and modify the settings appropriately.

Note

You can have unique INI files for multiple Unified Access Gateway deployments in your environment. You must change the IP Addresses and the name parameters in the INI file appropriately to deploy multiple appliances.
To convert the private key from PKCS8 to PKCS1, thats is, from the BEGIN PRIVATE KEY format to BEGIN RSA PRIVATE KEY format, run the following openssl command: openssl rsa -in key.pem -out keyrsa.pem
To convert PKCS#12 format file with either a .p12 or .pfx file extension and to ensure the key is an RSA key, run the following commands: openssl pkcs12 -in cert.pfx -nokeys -out cert.pem openssl pkcs12 -in cert.pfx -nodes -nocerts -out key.pem openssl rsa -in key.pem -check -out keyrsa.pem
The [adminSAMLSettings] included in the INI file is for configuring the SAML authentication method used to authenticate the users with administrator access to the admin UI. Here, entityId refers to the external metadata provider entity id.
Passwords for the low-privileged admin users with monitoring roles are provided as parameter to the PowerShell script. If the password is not provided, then the user is prompted to enter the password. Provide the parameter as newAdminUserPwd and the parameter value similar to monitoringUser1:P@ssw0rd1;monitoringUser2:P@ssw0rd2. The enabled parameter in the INI file is optional and defaults to true if the parameter is unavailable.

5. To make sure that the script execution is not restricted, type the PowerShell set-executionpolicy command.

```

set-executionpolicy -scope currentuser unrestricted
```

If there is a warning for the script, run the following command to unblock the warning:
unblock-file -path .\uagdeploy.ps1

Run the command to start the deployment. If you do not specify the .INI file, the script defaults to ap.ini.
```
.\uagdeploy.ps1 -iniFile uag1.ini
```
Enter the credentials when prompted and complete the script.

Unified Access Gateway appliance is deployed and available for production.

Sample of the `INI` File


    [General]
    adminCertRolledBack=false
    adminDisclaimerText=
    adminMaxConcurrentSessions=5
    adminPasswordExpirationDays=90
    adminPasswordPolicyFailedLockoutCount=3
    adminPasswordPolicyMinLen=8
    adminPasswordPolicyUnlockTime=5
    adminSessionIdleTimeoutMinutes=10
    authenticationTimeout=300000
    bodyReceiveTimeoutMsec=15000
    ceipEnabled=true
    cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
    , TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384
    clientConnectionIdleTimeout=180
    cookiesToBeCached=none
    defaultGateway=10.108.120.125
    deploymentOption=threenic
    diskMode=
    dns=192.0.2.1 192.0.2.2
    dnsSearch=example1.com example2.com
    ds=
    dsComplianceOS=false
    eth0CustomConfig=DHCP^UseDNS=false
    eth1CustomConfig=DHCP^UseDNS=false
    extendedServerCertValidationEnabled=false
    fallBackNtpServers=ipOrHostname1 ipOrHostname2
    fipsEnabled=false
    healthCheckUrl=/favicon.ico
    hostClockSyncEnabled=false
    httpConnectionTimeout=120
    ip0=10.108.120.119
    ipMode=DHCPV4_DHCPV6
    ipModeforNIC2=DHCPV4_DHCPV6
    ipModeforNIC3=DHCPV4_DHCPV6
    isCiphersSetByUser=false
    isTLS11SetByUser=false
    locale=en_US
    monitoringUsersPasswordExpirationDays=90
    monitorInterval=60
    name=
    netBackendNetwork=
    netInternet=
    netManagementNetwork=
    ntpServers=ipOrHostname1 ipOrHostname2
    osLoginUsername= 
    osMaxLoginLimit=10
    outboundCipherSuites=
    passwordPolicyFailedLockout=3
    passwordPolicyMinClass=1
    passwordPolicyMinLen=6
    passwordPolicyUnlockTime=900
    quiesceMode=false
    requestTimeoutMsec=10000
    rootPasswordExpirationDays=365
    rootSessionIdleTimeoutSeconds=300
    secureRandomSource=
    sessionTimeout=36000000
    snmpEnabled= TRUE | FALSE
    source=
    sshEnabled=
    sshInterface=eth0
    sshKeyAccessEnabled=
    sshLoginBannerText= EUC Unified Access Gateway
    sshPasswordAccessEnabled=
    sshPort=22
    sshPublicKey1=
    ssl30Enabled=false
    sslprovider=
    target=
    tls10Enabled=false
    tls11Enabled=false
    tls12Enabled=true
    tls13Enabled=true
    tlsNamedGroups=
    tlsPortSharingEnabled=true
    tlsSignatureSchemes=
    uagName=UAG1
    unrecognizedSessionsMonitoringEnabled=true
    gatewaySpec=
    
    [WorkspaceOneIntelligenceSettings1]
    encodedCredentialsFile=
    name=TEST1
    trustedCert1=
    urlThumbprints=bed12345bf8546d15de2136f4c33f00f31d44e00
    
    [WorkspaceOneIntelligenceSettings2]
    encodedCredentialsFile=
    name=RISK_SCORE
    
    [SnmpSettings]
    version= v3
    usmUser=SAM_SNMP_V3
    securityLevel=
    authAlgorithm=
    authPassword=
    privacyAlgorithm=
    privacyPassword=
    engineID=uag1.example.com
    
    [SnmpSettings]
    version=V1+V2c
    communityName=abc
    
    [WebReverseProxy1]
    proxyDestinationUrl=https://10.108.xx.xx
    trustedCert1=
    instanceId=view
    healthCheckUrl=/favicon.ico
    userNameHeader=AccessPoint-User-ID
    proxyPattern=/(.*)
    landingPagePath=/
    hostEntry1=10.108.xx.xx HZNView.uag.com
    
    [Horizon]
    endpointComplianceCheckProvider=Workspace_ONE_Intelligence_Risk_Score
    proxyDestinationUrl=https://enterViewConnectionServerUrl
    trustedCert1=
    gatewayLocation=external
    blastExternalUrl=
    additionalBlastExternalUrls=
    tunnelExternalUrl=
    additionalTunnelExternalUrls=
    disableWebClient=true
    healthCheckUrl=/favicon.ico
    proxyDestinationIPSupport=IPV4
    smartCardHintPrompt=false
    queryBrokerInterval=300
    proxyPattern=(/|/view-client(.*)|/portal(.*)|/appblast(.*))
    matchWindowsUserName=false
    windowsSSOEnabled=false
    complianceCheckOnAuthentication=true
    proxyDestinationUrlThumbprints=
    proxyDestinationPreLoginMessageEnabled=true
    customExecutable1=WEBEXVDIPLUGIN
    enableAuthOnRedirectedSite=false

    #Origin header details objects being used
    originHeaderDetailsList=1,2,3
    
    [OriginHeaderDetails1]
    origin=userorigin.com
    rewriteEnabled=true
    autoGenerated=false
    
    [OriginHeaderDetails2]
    origin=tunnelurl.com
    rewriteEnabled=false
    autoGenerated=true
    
    [OriginHeaderDetails3]
    origin=https://uag-origin.test.com:443
    rewriteEnabled=true
    autoGenerated=false

    [CustomExecutableSettings1]
    name=OPSWAT2
    osType=
    trustedSigningCertificates1=
    url=<<URL to custom executable file>>
    urlResponseRefreshInterval=
    isObtainedFromURL=
    
    [Airwatch]
    tunnelGatewayEnabled=true
    disableAutoConfigUpdate=false
    pacFilePath=
    pacFileURL=
    credentialFilePath=
    apiServerUsername=domain\apiusername
    apiServerPassword=*****
    proxyDestinationUrl=https://null
    ntlmAuthentication=false
    healthCheckUrl=/favicon.ico
    organizationGroupCode=
    apiServerUrl=https://null
    outboundProxyHost=1.2.3.4
    outboundProxyPort=3128
    outboundProxyUsername=proxyuser
    outboundProxyPassword=****
    reinitializeGatewayProcess=false
    airwatchServerHostname=tunnel.acme.com
    trustedCert1=c:\temp\CA-Cert-A.pem
    hostEntry1=1.3.5.7 backend.acme.com
    tunnelConfigurationId=
    
    [AirwatchSecureEmailGateway]
    memConfigurationId=abc123
    apiServerUsername=domain\apiusername
    healthCheckUrl=/favicon.ico
    apiServerUrl=https://null
    outboundProxyHost=1.2.3.4
    outboundProxyPort=3128
    outboundProxyUsername=proxyuser
    outboundProxyPassword=****
    reinitializeGatewayProcess=false
    airwatchServerHostname=serverNameForSNI
    apiServerPassword=****
    trustedCert1=c:\temp\CA-Cert-A.pem
    pfxCerts=C:\Users\admin\My Certs\mycacerts.pfx
    hostEntry1=1.3.5.7 exchange.acme.com
    
    [AirWatchContentGateway]
    cgConfigId=abc123
    apiServerUrl=https://null
    apiServerUsername=domain\apiusername
    apiServerPassword=*****
    outboundProxyHost=
    outboundProxyPort=
    outboundProxyUsername=proxyuser
    outboundProxyPassword=*****
    hostEntry1=192.168.1.1 cgbackend.acme.com
    trustedCert1=c:\temp\CA-Cert-A.pem
    ntlmAuthentication=false
    reinitializeGatewayProcess=false
    airwatchServerHostname=cg.acme.com
    
    [SSLCert]
    pemPrivKey=
    pemCerts=
    pfxCerts=
    pfxCertAlias=
    
    [SSLCertAdmin]
    pemPrivKey=resources\\test-key.pem
    pemCerts=resources\\test-chain.pem
    pfxCerts=
    pfxCertAlias=

    [SSLCert1]
    identifier=cert1
    defaultSSL=true
    pemPrivKey=resources\\test-key1.pem
    pemCerts=resources\\test-chain1.pem

    [SSLCert2]
    identifier=cert2
    defaultSSL=false
    pemPrivKey=resources\\test-key2.pem
    pemCerts=resources\\test-chain2.pem

    [RADIUSAuth]
    authPort= 
    authPort_2= 
    authType= 
    authType_2= 
    directAuthChainedUsername= 
    enabledAux= 
    hostName= 
    name= 
    numAttempts= 
    radiusDisplayHint= 
    serverTimeout= 
    sharedSecret= 
 
    [SecurIDAuth]
    accessKey= 
    authenticationTimeout= 
    hostname= 
    name= 
    pemCerts= 
    serverHostname= 
    serverPort= 

    [CertificateAuth]
    caCertificatesDetails= 
    crlLocation= 
    enableCertCRL= 
    enableCertRevocation= 
    enableOCSP= 
    enableOCSPCRLFailover= 
    name= 
    pemCerts= 
    requestTimeout= 
    userIdSource= 
    validateUpn= 
    
    [WorkspaceONEIntelligenceRiskScoreEndpointComplianceCheckSettings]
    allowLow=true
    allowMedium=true
    allowHigh=true
    allowOthers=false
    complianceCheckInterval=5
    name=Workspace_ONE_Intelligence_Risk_Score
    workspaceOneIntelligenceSettingsName=RISK_SCORE
    
    [JWTSettings1]
    publicKey1=
    publicKey2=
    publicKey3=
    name=JWT_1
    
    [JWTSettings2]
    publicKey1=
    publicKey2=
    name=JWT_2
    
    [JWTIssuerSettings1]
    issuer=issuer-1
    jwtType=PRODUCER
    name=issuerJWT_1
    pemPrivKey=
    pemCerts=
    pfxCerts=
    pfxCertAlias=
    
    [JWTIssuerSettings2]
    issuer=issuer-2
    jwtType=PRODUCER
    name=issuerJWT_2
    pemPrivKey=
    pemCerts=
    pfxCerts=
    pfxCertAlias=
    
    [AdminUser1]
    enabled=true
    name=monitoringUser1
    
    [AdminUser2]
    enabled=true
    name=monitoringUser2
    
    [OutboundProxySettings1]
    proxyUrl=
    name=
    proxyType=HTTP
    includedHosts1=
    includedHosts2=
    trustedCert1=
    
    [OutboundProxySettings2]
    proxyUrl=
    name=
    proxyType=HTTP
    includedHosts1=
    includedHosts2=
    trustedCert1=
    
    [adminSAMLSettings]
    enable=true
    entityId=https://www.entityid.com
    
    [IDPExternalMetadata1]
    allowUnencrypted=false
    certChainPem=
    privateKeyPem=
    encryptionCertificateType=
    entityID=<entityID>
    forceAuthN=false
    metadataXmlFile=<Path of IDP metadata xml file>    
    signingCertificateType=
    signingPrivateKeyPem=
    signingCertChainPem=
    
    [OPSWATEndpointComplianceCheckSettings]
    allowInCompliance=
    allowEndpointUnknown=
    complianceCheckFastInterval=
    complianceCheckInitialDelay=
    complianceCheckInterval=
    allowNotInCompliance=
    allowOutOfLicenseUsage=
    allowAssessmentPending=
    allowOthers=
    hostName=
    name=
    clientSecret=
    clientKey=
    
    [PackageUpdates]
    packageUpdatesScheme=OFF|ON_NEXT_BOOT|ON_EVERY_BOOT
    packageUpdatesURL=
    trustedCert1=
    
    [OidcProviderSetting]
    oidcClientId=
    oidcConfigUrl=
    oidcConfigurationId=
    oidcForceAuthPrompt=
    oidcTimeoutSeconds=
    
    [SyslogServerSettings1]
    sysLogType=TCP
    syslogCategory=ALL
    syslogFormat=TEXT
    syslogSettingName=
    syslogSystemMessagesEnabledV2=true
    syslogUrl=
    
    [SyslogServerSettings2]
    hostname=
    port=6515
    sysLogType=TLS
    syslogCategory=ALL
    syslogClientCertKeyPemV2=
    syslogClientCertPemV2=
    syslogServerCACertPemV2=
    syslogFormat=TEXT
    syslogSettingName=
    syslogSystemMessagesEnabledV2=false
    
    [SyslogServerSettings3]
    mqttClientCertCertPem=
    mqttClientCertKeyPem=
    mqttServerCACertPem=
    mqttTopic=
    sysLogType=MQTT
    syslogCategory=ALL
    syslogFormat=TEXT
    syslogSettingName=
    syslogSystemMessagesEnabledV2=true
    syslogUrl=

What to do next

If you want to upgrade Unified Access Gateway while preserving the existing settings, edit the .ini file to change the source reference to the new version and rerun the .ini file: uagdeploy.ps1 uag1.ini. This process can take up to 3 minutes.


[General]
name=UAG1
source=C:\temp\euc-unified-access-gateway-2512-xxxx_OVF10.ova

If you want to upgrade with zero service interruption, see Upgrade with Zero Downtime.

Was this page helpful?

Run PowerShell script to deploy

Parameters

Prerequisites

Procedure

Sample of the `INI` File

What to do next

Provide feedback for this topic

Write your review

Parameters

Prerequisites

Procedure

Sample of the INI File

What to do next

Sample of the `INI` File