After configuring the .ini template file, run the PowerShell script to configure the OVA and deploy VMware Tunnel. The PowerShell script provides validation checks that are not available when deploying the OVA using vSphere.


Configure the INI file to pass the VMware Tunnel configuration to the OVA file.

The following tools are required:
  • Windows administrator privileges
  • PowerShell 4

    The PowerShell script runs on Windows 8.1 or later machines or Windows Server 2008 R2 or later.

    The machine can also be a vCenter Server running on Windows or a separate Windows machine.

  • VMware OVF Tool 4.1 (available on
  • Configured .ini template file to pass the configuration values to the appliance (part of the OVA download package available on Workspace ONE UEM Resources at
  • PowerShell script to configure the appliance (part of the OVA download package available on Workspace ONE UEM Resources at
  • Communication between the Windows machine used to deploy the OVA and your vSphere instance
  • Supported Hypervisor:
    • vSphere v5, 5.1, 5.5, or 6 - vSphere ESX host with a vCenter Server
    • Microsoft Hyper-V - Windows Server 2012 R2 or Windows Server 2016


  1. Open PowerShell as an administrator.
  2. Navigate to the folder containing your PowerShell script and modified .ini template.
  3. Enter the following command: .
    1. For vSphere deployments: .\uagdeploy.ps1 <Ini file name>
    2. For Hyper-V: .\uagdeployhv.ps1 <Ini file name>
    .\uagdeploy.ps1 AWTunnel.ini
  4. Enter the password for each prompt:
    Setting Description
    Appliance Password Enter password for the root user.
    REST API Enter the admin UI password.
    API server password Enter the API server password.
    Outbound proxy Optional. If using a proxy with authentication, enter outbound proxy.
    vSphere User password If using vSphere, enter the password for the vSphere User that can deploy VMs.


After entering each password, PowerShell validates the entered password.

Once all passwords are entered, the Unified Access Gateway uploads to the hypervisor and the machine configures itself and installs. You must wait for the script to finish for the network to initialize. Progress can be tracked by viewing the machine from vSphere or Hyper-V.

Running the PowerShell with the values matching an existing instance in vSphere destroys the existing appliance and deploys a new instance instead. You cannot run the same INI template for Hyper-V. The Unified Access Gateway name must be different each time you deploy through PowerShell.

After a successful deployment, the Workspace ONE UEM Appliance Agent starts immediately and the monitoring services for VMware Tunnel start after 60 seconds.