Deployment of MSIs via GPO is killing our laptop trolleys! Can I throttle it?

[JCB]

Hello all,

I'm using AD and assigned GPOs to send application installs to our laptops (90) and desktop (60)computers. This technical process works a treat on wired machines, and also works just fine on wireless machines as they pick up the package before the logon prompt appears.

I work in a primary school. All our class and ICT suite desktops are fine - they pick up the package quickly. Even the teacher laptops work fine as they are switched on at staggered intervals and our wireless is strong enough to cope with pumping out a quick install package per user.

But ... (you knew that bit was coming! ;-) )

We have three laptop trolleys with 16 laptops in each. The nature of these is that they are taken to a classroom and then the laptops are all switched on at once. Suddenly a 100Mb install package becomes 16 times bigger and all the machines (and sometimes the WAPs too) grind to a stop. This is even with each trolley having its own pair of dedicated WAPs on a separate SSID that are plugged into wall points in the classroom when the trolley is used.

Is there any way of throttling the install behaviour of MSI deployments via GPO? I'm finding that any time I need to do an install of more than a few Mb, out come the 3 trolleys, so that's 48 laptops for me to nanny a few at a time through the install process (log on, run gpupdate, reboot and wait for install to finish. then shut down and pick the next few.)

Any solution you can suggest appreciated, even if it means moving to commercial software, though this would need to be a very affordable solution due to the nature of the site.

Note that I'm using BITS to successfully throttle patch (Windows update) downloads to prevent the same problem occuring on Microsoft's monthly patch day, but that doesn't seem to affect the app deployment side.

Many thanks in advance

Julian

[ricki]

Hi

I know these will be silly questions but why are you using seperate ssid's. What I used to do was fix the wifi points round the building in or on the ceilings and set the same ssid. But set each one on different channels about 3 channels apart with wifi points that are near together. This allows you to connect to any wifi point anywhere in school and will link to the best access point for it depending on signal and interferiance.

I dont know of a way to throttle the downloads but what I used to do was when I was deploying a msi. I would turn then on in small batches. Then it would install correctly and not overload the wifi. The other thing you could look at is the wifi point plugged into a 1 gig switch and is it an n point. Please note to get maximum wifi connection the access point and the wifi card in the machine have to be the same n rating otherwise it throttles it down to the speed it can connect.

Please note that if you ghost over the network at full speed it will kill your wifi.

Richard

[ricki]

Sorry I forgot

You might also be work having a look at slow link connections. This post talks about deploying office which is big and slow connections

Deploying Microsoft Office Using Group Policy - O'Reilly Media

Richard

[januttall]

the universaty i went to used to fully cable the cabinets so that if an update or msi came out it could be done over a wired connection in the cabinet before going on the wi-fi and while charging. i dont know how they handeld it with the lids being closed and keeping tempritures regulated etc. but it might be something to look into..

a Quick search on my faverate serch provider google.
Laptop Security Cabinets and Trolleys
i know you wont want to buy new cabinets but you may be able to adapt the ones you have. E.G. Puting a wired switch in the bottem and a fan say for cooling.

just an idea.

but richard is right abought the wi-fi use the fastest switch and AP you can use the same ssid and encription and space them out to channels 1,3,5,7,9,11. or 2,4,6,8,10,12 and keep them to 20MHz chanels (radio bandwith) not 40Mhz as 2 AP's Will swamp everything with overlap, wich slows connections down to next to nothing. you can reuse chanels but only when fully out of range of other AP's.

and if your msi's are all stored one a machine not used for any other purpose you could put it on the other side of a linux box and throtle the bandwith to and from the server via iptables or firehol but only if thats all it is serving (could include win updates[WSUS]) and thats the only way i can think of of slowing downloads, at least from the top of my head.(this sugestion is Not recomended as it may break things)

[sparkeh]

I don't believe you can throttle msi deployed via GPO like that (though happy to be proved wrong).
Management software like SCCM uses BITS to deploy packages and avoids this problem, though that might be a bit overkill for your needs? Though I do use it in my largest primary school and its awesome.

[localzuk]

I don't think you'll have any luck doing it via GPO if you want to do any throttling. However I would see a few courses of action:

1. Invest in a proper managed wireless network, with fixed access points positioned for optimal signal everywhere in your building. Make sure these have gigabit connections to the network. Also, ensure they are wireless N, and that any future laptops have wireless N enabled (you could also see if you can replace the mini-pcie wireless cards in your laptops with N ones).

2. You can break your trolleys up into a couple of sub-OUs and deploy the software to an OU at a time.

3. Deploy the software and boot groups of laptops yourself, rather than waiting for it to do it on staff time.

4. Look at a different deployment system which deploys using a controllable mechanism. SCCM is such a system but is complex.

Hope that helps somewhat.

[pete]

SCCM or (if you don't mind getting hands dirty) Local Update Publisher (free, requires some faffing, uses WSUS API) will let you push things out using Windows Update.

[Mr.Ben]

SpecOps Deploy is on the expensive side, but uses BITS to transfer (like WSUS and SCCM). It is also very easy to use and yet has some powerful options.

[Oaktech]

if we have to fire off stuff like that we just take everything out of the cab of an afternoon, hook it up to a spare 24 port switch on a gig line and let the app install!

[MYK-IT]

Could you not change the GPO for the OU that the laptops belong to; so that WSUS updates are not automatically downloaded/installed and then just schedule to visit them when the laptops are not being used and log on and download/install the updates accordingly?

You could also try changing the WSUS settings within the GPO so that updates are just downloaded but not installed (then you would just have to log in and install as per above suggestion)