Group policy based on software installed

[Blue_Cookeh]

Hi All,

 

I'm trying to get a GPO to apply user settings only when my users are logged into a computer with certain software installed.

 

Now, I've never used Loopback processing before but I assume this is what I need?

 

I'm thinking if I create an OU with groups in (one of the groups is computers with the software installed) and enable merged loopback processing this would work? Obviously I would use security filtering to ensure it is only applied to the particular software group.

 

Or am I totally overthinking this?

 

Thanks!

Edited April 11, 2015 by Blue_Cookeh

[Ephelyon]

Are any of these settings Preferences or are they all Policies? You can target Preferences by e.g. MSI presence or the existence of the application's installation directory.

 

If they're all Policies, you might be able to work out which Registry entries they change and deploy those as targeted Registry Preferences instead.

[Norphy]

Loopback polices are completely the wrong way of going about this. @Ephelyon has made a good post, that's certainly one way of going about it. However, I'd use a WMI filter to detect the presence of the software in question. As long as it's been installed with an MSI, it would be quite easy to set up.

 

If you want more details from me, let me know and I'll post something on Monday once I have access to a Windows Computer again

[Arthur]

You can target Preferences by e.g. MSI presence or the existence of the application's installation directory.

This is what I would do too, since the alternative - using WMI to query Win32_Product - is not recommended.

 

http://i.imgur.com/ljQ3oCS.png

 

http://i.imgur.com/1cnaNW1.png

[Norphy]

This is what I would do too, since the alternative - using WMI to query Win32_Product - is not recommended.

 

 

Indeed, which is why I used the instructions in that article to create a custom class to search against. Depending on what the OP is trying to do, a policy may preferable to a preference as they can't be overridden as easily.

[Blue_Cookeh]

They're all policies unfortunately... if the other "supported" way is to deploy custom MOFs I think I'll just go the Preferences route, it's only for staff users anyway and no one has regedit access as it is.

[Ephelyon]

Which Policies are they?

[Blue_Cookeh]

They're policies for the CleverTouch Lynx software that carry the license key etc.

 

May just apply a reg file during SCCM deployment of the program...

[spc-rocket]

Hiya,

 

When you say w32 class is not recommended, does this apply to detecting OS type and using WMI filter to apply GPOs based on wmi filter? I wonder if we can use the preferences this way.

 

Ash.

 

This is what I would do too, since the alternative - using WMI to query Win32_Product - is not recommended.

 

http://i.imgur.com/ljQ3oCS.png

 

http://i.imgur.com/1cnaNW1.png

[Norphy]

It's just Win32_Product that's not recommended. If you're using a different class in your filter, you'll be OK.

[spc-rocket]

Hiya,

 

We're just using the root\CIMv2 with the following

 

select * from Win32_OperatingSystem where version like "6.3%" (for win 8 onwards)

 

select * from Win32_OperatingSystem where version like "6.1%" (for win 7)

 

so might be okay on this. no mention of the win32_product.

 

Thanks for your quick reply.

 

Ash.