[sims] Best way of allowing Staff to update SIMS?

[Sam_Brown]

One of the pains we have is that when one of the major updates comes out we have to manually go round everyones computer and logon as an admin user and update SIMS manually.

 

How are other people getting around this issue at other schools short of making all ends users local admins on workstations?

 

We tend to lose half a morning the day after an update just going round manually updating workstations and I was hoping for some advice on a better weay to do it!

[Steve21]

Custom launcher that uses raised priv to check for updates, but then launches SIMs normally.

 

Steve

[SHimmer45]

staff have raised access on teacher workstations, this have only been needed for this and the previous upgrade.

found that a shortcut had been modified so it would start in the users home dir rather than program files..

[Ghostgame]

Do I dare mention SOLUS3?

[36Degrees]

(Windows XP) - Added all staff to the Power Users group. Doesn't give them rights to install anything but does give them enough to update SIMS.

[vikpaw]

Group policy permissions applied to give the users read write access to various locations they need e.g. program files\sims , and even to specific files.

Works okay on Win7. the only issue we have is that they miss the UAC prompt sometimes - mostly primary who don't use it often. That pops up three times during an upgrade and if they ignore it or press No, then it won't upgrade. otherwise all's good.

[Grey-gear]

We have a group that all of the staff are members of and then that group is put into the power users of the computers that have sims on.

[Chuckster]

WIndows 7...

 

Admin staff are in the Administrators group and have no SRP applied to them, therefore are able to upgrade their SIMS automatically.

 

Teaching staff, on the other hand, are on a lockdown and do have SRP applied to them, nor are they part of the Administrators group. Giving them Full NTFS control permission to the SIMS folder and adding an entry to SRP with %LocalAppData%\Temp\* and \\simsserver\dosapps\* allows them to upgrade SIMS.

[Ashm]

We have Staff as standard domain users & still using SOLUS 2 they are able to update SIMS successfully themselves.

 

Give Staff modify rights on the following:

 

%ProgramFiles%\SIMS\
%SystemRoot%\Sims.ini

 

You can create a computer GPO to do this using the File System security setting.

[Ashm]

Group policy permissions applied to give the users read write access to various locations they need e.g. program files\sims , and even to specific files.

Works okay on Win7. the only issue we have is that they miss the UAC prompt sometimes - mostly primary who don't use it often. That pops up three times during an upgrade and if they ignore it or press No, then it won't upgrade. otherwise all's good.

I think if you add the SIMS server UNC path to the IE Intranet zone that should prevent the popups from occurring.

[Theblacksheep]

SCCM2012

[vikpaw]

I think if you add the SIMS server UNC path to the IE Intranet zone that should prevent the popups from occurring.

- it didn't work.

[FN-GM]

SCCM2012

 

We do it this way now. Are you using SIMSperm.bat?

 

 

@vikpaw dont you have to add it to the trusted sites?

[Theblacksheep]

We do it this way now. Are you using SIMSperm.bat?

 

We remove the simsload from their shortcut and just update the application, pushed out via a collection based on the installed SIMS number AND via a supercedance of the old application.

[vikpaw]

what's more trusted than my intranet ?

[tmcd35]

SCCM2012

 

I'm looking at creating an App-V package and then deploying that through SCCM2012. That way I only ever have to update the program once each release!

[vikpaw]

Do I dare mention SOLUS3?

I don't think they heard you - maybe if @matt40k shouts it!

[Rawns]

I don't think they heard you - maybe if @matt40k shouts it!

 

Allow me...

 

SOLUS3!!!

[Ephelyon]

I use a startup script to check the version of Pulsar.exe, and if it's below the right version, run SIMSInfrastructureSetup.exe, -ApplicationSetup, -ManualSetup.exe and -AMPARKSetup.exe straight from the server as SYSTEM. That sorts the lot out and I just change the version string in the batch file when I've upgraded on the server.

[matt40k]

Yer, SOLUS3 is the way forward. Never had to turn off UAC, give users admin or power user rights, full control of a folder in a protected folder (program files), run an out of date batch file, write something bespoke that requires extra documentation.

 

Only other option is SCCM or CentraStage which is like using the backdoor to get into your house rather then SOLUS3 which would be the frontdoor - nothing wrong with using the back door, other then it has a toll, just takes a bit of extra effect to get into your house. Other options are like climbing in via the windows - depending on how you do it defines if its the ground floor window which you left open or if you're climbing up the drain pipe and using your fist to break the bedroom window.

[vikpaw]

I use a startup script to check the version of Pulsar.exe, and if it's below the right version, run SIMSInfrastructureSetup.exe, -ApplicationSetup, -ManualSetup.exe and -AMPARKSetup.exe straight from the server as SYSTEM. That sorts the lot out and I just change the version string in the batch file when I've upgraded on the server.

You can check a line in simsload.ini against the version of server side simsapplicationsetup - and this will work without needing to change your script each time. Assuming you can get the script to do it. I compiled this into an app for laptops - so the user gets warned and has the chance to plug in to a wired connection. Would be really useful for you if you can recreate that version checking part.

[Theblacksheep]

Yer, SOLUS3 is the way forward. Never had to turn off UAC, give users admin or power user rights, full control of a folder in a protected folder (program files), run an out of date batch file, write something bespoke that requires extra documentation.

 

Only other option is SCCM or CentraStage which is like using the backdoor to get into your house rather then SOLUS3 which would be the frontdoor - nothing wrong with using the back door, other then it has a toll, just takes a bit of extra effect to get into your house. Other options are like climbing in via the windows - depending on how you do it defines if its the ground floor window which you left open or if you're climbing up the drain pipe and using your fist to break the bedroom window.

 

Trouble is the front door doesn't let many people through, the automation system cannot be trusted, when it goes wrong it'll jam for days and the dedicated engineers take ages.

[Ashm]

- it didn't work.

I think you may also need to enable the "Launching programs and unsafe files" setting in "Computer Configuration/Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone"

[Ghostgame]

Trouble is the front door doesn't let many people through, the automation system cannot be trusted, when it goes wrong it'll jam for days and the dedicated engineers take ages.

 

To be honest, its better to bite the bullet now and get all the issues out of the way instead of a year down the line when you are fighting all the other schools for help with SOLUS3. Capita are planning to drop support for SOLUS2.

 

Planned to be dropped after Spring 2014

Edited May 20, 2013 by Ghostgame

[tmcd35]

To be honest, its better to bite the bullet now and get all the issues out of the way instead of a year down the line when you are fighting all the other schools for help with SOLUS3. Capita are planning to drop support for SOLUS2.

 

Or find a way that means you only have to install SOLUS3 on one device that you can 150% guarantee will be turned on when you run an update. I'm hoping an virtual machine with App-V sequencer will be that one machine for us. The other option is host the thing on a terminal server...