Software & Group Policies

[Edu-IT]

I'm planning on deploying some software using group policy. I've never done this before but it doesn't appear to be difficult. I'm just wondering if there is anything important that I should know before I go ahead with this. Any good tutorials would be appreciated.

 

I'm going to be assigning the software to computers. Will this mean that the software is installed once and that's it or will it install each time a user opens the program? I hope that makes sense.

[sahmeepee]

I'm going to be assigning the software to computers. Will this mean that the software is installed once and that's it or will it install each time a user opens the program?

 

Thankfully the former. You'll see it installing it before the logon prompt appears when the machine next boots after you set up the GPO (in the same box where it says "applying security settings" or "preparing network connection" etc.)

 

Once you've set up the software in the GPO, open up the settings and have a poke around - there's not much to see. Possibly the most significant setting is the one about removing the software when the PC moves out of the "scope of management", ie. out of an OU with that policy on.

 

You might want to think about using DFS to store the MSIs on the network. If you don't and you decide to change where they're stored (i.e. a different UNC path), the software will be reinstalled on all machines.

 

Obviously make sure there are sufficient read permissions on the share with the MSIs in.

 

Can't think of any more pitfalls.. like you say it's pretty easy

[ajbritton]

If this is your first software roll-out with GP then I would say the best advice is to test first. There are several ways to do this. You could create a complete test environment with servers and clients either using physical hardware or virtual machines, but this is probably overkill. I would create a 'Test' OU and move the computer account for a test PC into it. Create your policy and configure it to roll out the required MSI and then link the policy to the Test OU. Reboot the test PC and the software should be installed. Check it thoroughly. Reboot the PC several times and log on as different users to make sure the software behaves as you would expect. Once you are happy with this you are ready to look at rolling out. Depending on how long an install takes and how many PCs you are rolling out to, you may need to do a staged roll-out. If you have a large number of PCs and you assign the policy to them all at the same time, then they will all attempt to install on the next boot cycle. This may cause network problems and lots of PCs boot simultaneously (eg in a suite). To avoid this, either assign the policy to OUs containing smaller numbers of computer accounts or do 'policy filtering' based on group membership. To do this, you create an 'app' group and use it to filter the application of the policy. You can then add the computer accounts to the 'app' group a few at a time over days or even weeks until the software is rolled out to all PCs.

 

Sahmeepee's point about using DFS is well made. When you have lots of GP assigned software, moving the installation share point can be a real nightmare.

 

I hope this helps.

[Edu-IT]

I'm not sure I quite understand Distributed File Systems and what I should do. My plan was to put the MSI files in a shared location that already exists. I understand that if they then have to be moved then it is going to be more hassle but are there any other implications?

 

In your opinion and based on your experiences how many computers would you suggest rolling the software out to at any one time? (After I've tried and tested to make sure that everything is working on my own machine)

Edited February 1, 2008 by Edu-IT

[djones]

What about altering Start Menu shortcuts during/post GPO install? I use redirected start menus and disable local start menu shortcuts so it shouldn't matter but I'm curious! Is there a way to prevent or customise local start menu shortcuts during the install process?

 

Dave.

[Lithium]

Currently I use just a standard share, although, the DFS advantage was mentioned.

 

If you ever decide you want to use servera for something else - because it's better suited to what you want, you have to reinstall all the software again - we deploy...like...everything via it..., if you have a DFS share, you can remove servera and add serverb to it (I assume...) and it if you use more than one from the start, it balances (I think.. never used them...)

 

 

As for start menu stuff, I don't know... Could you use a TRANSFORM to drop the rows which create start menu icons? that's what I did with Adobe Reader 8 because I wanted to put it somewhere I wanted, not where it wanted - but then, AR8 has the ACW so I'm not totally sure, but I can't see it being that different.

[Edu-IT]

Thanks for your help.