+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 20
Windows Thread, Deploying MSI - Is this accurate? in Technical; Hey all, Little advice needed. Am trying to deploy an MSI over the network for the very first time in ...
  1. #1

    Join Date
    May 2006
    Posts
    1,319
    Thank Post
    101
    Thanked 25 Times in 18 Posts
    Rep Power
    25

    Deploying MSI - Is this accurate?

    Hey all,

    Little advice needed. Am trying to deploy an MSI over the network for the very first time in my life and am a little bit worried about following the instructions provided by an educational software provider. Though they are extremely basic and easy to follow, I quite frankly just don't trust them.

    So I wondered if someone here could confirm these details are accurate and they haven't missed any vital info out?

    1. Go into active directory
    2. Select domain >> properties >> group policy tab
    3. Select current default domain policy and click edit
    4. Select computer configuration then software settings
    5. Using 'software installation' select new >> package
    6. Enter path to MSI and click open
    7. On 'deploy software window' that appears, select 'assigned' radio button.

    They then go on to talk about file permissions, though I am not sure any of that is needed. I think by default it should inherit the standard permissions?

    Finally, they say to enter gpupdate /force into run.

    Cheers!

  2. #2

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,804
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Deploying MSI - Is this accurate?

    For one, don't use the default domain policy. Setup a fresh GPO for software deployments. It keeps things nice and neat and easy to understand.

    Secondarily, the issue with file permissions is this. When you deploy software this way the machine uses it's computer account to access the MSI. Therefore you must make sure the computer account can actually access the share/directory structure you've stored the MSI in. sysvol and netlogon already have 'Authenticated Users' setup with the correct access so you can use either of these shares without issue. However if you wish to store your MSI's elsewhere (I use a Software$ share) you must setup the ACL's yourself.

  3. #3

    plexer's Avatar
    Join Date
    Dec 2005
    Location
    Norfolk
    Posts
    13,661
    Thank Post
    658
    Thanked 1,624 Times in 1,453 Posts
    Rep Power
    422

    Re: Deploying MSI - Is this accurate?

    I'd also get the group policy management console installed to make creating, editing and troubleshooting gpo's a whole lot easier.

    Ben

  4. #4
    petectid's Avatar
    Join Date
    Jun 2005
    Posts
    298
    Thank Post
    2
    Thanked 15 Times in 13 Posts
    Rep Power
    20

    Re: Deploying MSI - Is this accurate?

    As Geoff mentions set-up new OU's for software installation etc, this way you can separate all your workstations into areas i.e. "IT Suit 1" and LRC this way packages can be sent out to specific classrooms. Your way would install on every PC, though you may wish to do this?

  5. #5

    Join Date
    Nov 2006
    Location
    Reading, UK
    Posts
    487
    Thank Post
    30
    Thanked 14 Times in 8 Posts
    Rep Power
    18

    Re: Deploying MSI - Is this accurate?

    Something I've never cleared up...

    Does the GPO need configuring to use an Admin account to install the software on a machine which is logged on as a restricted user?

  6. #6

    Join Date
    May 2006
    Posts
    1,319
    Thank Post
    101
    Thanked 25 Times in 18 Posts
    Rep Power
    25

    Re: Deploying MSI - Is this accurate?

    Quote Originally Posted by petectid
    As Geoff mentions set-up new OU's for software installation etc, this way you can separate all your workstations into areas i.e. "IT Suit 1" and LRC this way packages can be sent out to specific classrooms. Your way would install on every PC, though you may wish to do this?
    Very good point... I thought of that literally seconds before I saw this. It's too late though, I have already done it. I did it Geoff's way by creating a new GPO, but obviously this will go out to all the domain machines still. For most that is fine, i'm a little bit concerned about the admin machines and worse of all, the servers though?? I haven't forced the update yet, so is there any way that I can change this? I have no idea how to send it out to only certain groups of computers.

  7. #7

    Join Date
    May 2006
    Posts
    1,319
    Thank Post
    101
    Thanked 25 Times in 18 Posts
    Rep Power
    25

    Re: Deploying MSI - Is this accurate?

    Okay, I think I got it. Instead of just selecting the domain, select the group of computers. Duh! Haha.

    I assume its okay if i just remove the policy I just added and re-add it to the group only?

  8. #8

    Join Date
    May 2006
    Posts
    1,319
    Thank Post
    101
    Thanked 25 Times in 18 Posts
    Rep Power
    25

    Re: Deploying MSI - Is this accurate?

    Quote Originally Posted by plock
    Something I've never cleared up...

    Does the GPO need configuring to use an Admin account to install the software on a machine which is logged on as a restricted user?
    I'm guessing not taking into account what Geoff said... i'll find out soon enough though.

  9. #9

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,804
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Deploying MSI - Is this accurate?

    Software is installed using the Machine account. So basically with SYSTEM privileges.

  10. #10
    alonebfg's Avatar
    Join Date
    Aug 2006
    Location
    south west some of the time
    Posts
    834
    Thank Post
    12
    Thanked 34 Times in 21 Posts
    Blog Entries
    5
    Rep Power
    24

    Re: Deploying MSI - Is this accurate?

    i change the secuarty and create a group called sayoffice and only deploy to pcs in this group this why i can test the software deployment befory adding all the other pcs to the group also helps me with licences as all i do is count the number of pcs in the deployment group and set the share for that group only. i think it is a bit more secure way of deployment and takes a bit longer but i think it is worth it.

  11. #11

    Join Date
    May 2006
    Posts
    1,319
    Thank Post
    101
    Thanked 25 Times in 18 Posts
    Rep Power
    25

    Re: Deploying MSI - Is this accurate?

    Okay I have just had a scoot around the school and deployment appears to have been successful. Thanks everyone

  12. #12
    Ravening_Wolf's Avatar
    Join Date
    Oct 2006
    Location
    Essex :(
    Posts
    290
    Thank Post
    1
    Thanked 3 Times in 3 Posts
    Rep Power
    18

    Re: Deploying MSI - Is this accurate?

    Quote Originally Posted by Geoff
    However if you wish to store your MSI's elsewhere (I use a Software$ share) you must setup the ACL's yourself.
    What is the minimum required permission level for 'Authenticated Users' on the software share of my choice?

  13. #13

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,804
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Deploying MSI - Is this accurate?

    Read and Execute.

  14. #14
    Ravening_Wolf's Avatar
    Join Date
    Oct 2006
    Location
    Essex :(
    Posts
    290
    Thank Post
    1
    Thanked 3 Times in 3 Posts
    Rep Power
    18

    Re: Deploying MSI - Is this accurate?

    Many thanks

  15. #15

    Join Date
    May 2006
    Posts
    1,319
    Thank Post
    101
    Thanked 25 Times in 18 Posts
    Rep Power
    25

    Re: Deploying MSI - Is this accurate?

    Geoff mentioned setting permissions for 'authenticated users' on the share that the MSI resides on to 'read and execute'. Is this the only group that needs to have permissions set, or does 'system' need to be set as well? If so, what to?

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. deploying software
    By projector1 in forum How do you do....it?
    Replies: 17
    Last Post: 11th March 2009, 04:27 PM
  2. Deploying An MSP For PagePlus
    By UBBERgoose in forum Windows
    Replies: 4
    Last Post: 17th October 2008, 04:14 PM
  3. Deploying IE7
    By OverWorked in forum Windows
    Replies: 21
    Last Post: 24th May 2007, 07:54 AM
  4. Deploying MSI - Is this accurate?
    By _Bat_ in forum Windows
    Replies: 3
    Last Post: 18th December 2006, 05:34 PM
  5. Replies: 1
    Last Post: 9th July 2006, 04:52 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •