Installing MSI's Via GPO's On Windows Startup (Silent Install)

[xwarsawx74]

Hello EDU Geeks!

 

 

I am just getting into using GPO's to distribute MSI packages to our Windows 10 based computer labs. Since I am new to using GPO's, I would like to know if any of you can answer some questions for me?

 

1. On a client machine, do I have to run the command "gpudate \force" every time I apply a new GPO or will the machine pick it up on its own once it gets restarted/turned on?

2. How can I get an MSI to install on a PC on boot or log-on via GPO? Is there scripting needed if so, how do I do I accomplish that?

2. How can I create a Silent Install of an MSI and push it via GPO? I am trying to eliminate Prompts when users log in.

4. How can I convert .EXE to .MSI installers? Can it be done with a built in Windows 10 utility or do I need to buy a 3rd party software for this? Any free softwares?

 

Note: I have already created a Network Share on our Server and have assigned Shared and Security Permissions. I have tested by creating a GPO that installs 7zip and it works. The only issue is that

the GPO did not get processed until I ran CMD and typed the command "gpupdate \force".

 

Thank you so much for all the previous help, Cheers!!!

[mrwoberts]

Just on the point about Group Policy refresh intervals, which I think is what you are referring to, here is a Microsoft article with info about the refresh interval.

In summary, unless you've changed it through Group Policy, a computer will check every 90 minutes, with a random offset of 0 to 30 minutes.

 

https://technet.microsoft.com/en-us/library/cc940895.aspx

 

It is worth notiing that for some reason I have had a few laptops where they just don't seem to be refreshing until I issue a /force command; once that runs it will usually then return to the normal frequency check.

[Katy]

1. On a client machine, do I have to run the command "gpudate \force" every time I apply a new GPO or will the machine pick it up on its own once it gets restarted/turned on?

 

It picks it up by itself, see previous post about refresh interval. Typically though expect to have to give each machine 2 reboots to pick up the policy (as software install only processes at boot up)

 

2. How can I get an MSI to install on a PC on boot or log-on via GPO? Is there scripting needed if so, how do I do I accomplish that?

In a policy expand Computer ->Policies -> Software Settings -> Assigned Applications. Right click and you can then add a new package as either Assigned or Advanced. Advanced is for where you need to apply transforms etc, assigned is usually fine.

 

All this does is run "msiexec /i /qn" at boot up with no prompts etc, plus if you have detailed startup messages turned on it will say "Installing managed software ".

 

You can test if an MSI will work silently by running it /qn and seeing if it works.

2. How can I create a Silent Install of an MSI and push it via GPO? I am trying to eliminate Prompts when users log in.

See above if the MSI is capable of running silently. Some which require things like product keys you can get to run silently by either modifying the MSI or creating a transform in something like orca to add the product key, how to do this varies from MSI to MSI.

4. How can I convert .EXE to .MSI installers? Can it be done with a built in Windows 10 utility or do I need to buy a 3rd party software for this? Any free softwares?

Nothing built in, Winstall LE used to come free on the 2003 Server CD. There are a few programs about although I don't really bother with this - for installers that are EXE based I tend to run a startup script that does a silent install. Alternatively there is a trick which sometimes works - install the EXE installer, then with the UAC prompts left at default try to remove it from the control panel programs/features screen - it will say "Do you want to allow this program to make changes?" and points you at a randomly named MSI somewhere in C:\windows\installer (somewhere like that, off the top of my head). You can then go and nick the MSI out of that folder and use it for deployment on the network. This doesn't always work if the EXE installer does things like configure the licence key though.

[xwarsawx74]

Thank you MrWoberts! This really helps explain the time that it takes for a GPO to get processed. I might change it for 0sec just for testing purposes and back to 90min.

[xwarsawx74]

Hi Katy,

 

 

Thanks! Very descriptive I will try the Advanced Option when creating a package to apply transforms when needed. I am currently applying GPO's to a Test OU just to be safe.

 

I will also give startup scripts a try when running EXE for silent installs.

[Katy]

Hi Katy,

I will also give startup scripts a try when running EXE for silent installs.

Mine are usually along the lines of:

 

if not exist "c:\program files\product\product.exe" setup.exe /silent /etc

 

as they run every startup it just skips the installer if the program's exe is already on the C drive.

[sted]

You can test if an MSI will work silently by running it /qn and seeing if it works.

id suggest for testing use /qb rather /qn as at shows a progress bar so you have some clue if its running or just quit without doing anything

 

so msiexec /i something.msi /qb

[xwarsawx74]

Thank you all for the help! Got MSI's distributed via GPO's. Up and running, cheers!