Teams Desktop Version on School PC's

[jimmckenna]

Hi, quick question. Has anybody installed the desktop Version of Teams on their network? Interested if you have, how you achieved this and issues encountered? TIA

[DalekSec]

Yepp we've been pushing it out since Christmas via Intune. No issues so far!

[3s-gtech]

I've done it by using Robocopy from a share

 

Because the default install copies across from Program Files to their Appdata, it just would not work for us - Applocker, SRPs etc have long been setup here to stop anything like that! I found that if I created a network deployment share that staff could read from, put the files in there from my install on my PC, then used Robocopy MIR to copy them to their profile on logon it worked fine. The beauty of MIR is that it will only copy differences, so once it has worked once it doesn't need to do it again until I put an updated set of files in the deployment share.

 

Totally not how MS want it to work, but work it does.

[jimmckenna]

Hi thanks for the reply. Not using Intune at this time for devices. Using AD for local PC's on domain. Looking to deploy via GPO and configure Teaching staff would prefer this to using the web browser version. Thanks again!!

[chazzy2501]

The Teams app is just the website in a chromium wrapper. Using the new chromium Edge browser should give the same experience.

[keyboards]

We got asked for this, does the desktop version add much?

[Zammo]

From https://docs.microsoft.com/en-us/microsoftteams/limits-specifications-teams

 

1 To give and take control of shared content during sharing, both parties must be using the Teams desktop client. Control isn't supported when either party is running Teams in a browser. This is due to a technical limitation that we're planning to fix.

2 Blur my background isn't available when you run Teams in a browser. This feature is only available in the Teams desktop client.

3 Teams meetings on browsers are limited to a single incoming video feed of active speaker.

 

We are a Google shop here, so I may be wrong but I also seem to recall the web version of teams limits the amount of people you can see at once to a smaller number?

[ITGuyNW]

Using PDQ and the msi off Microsoft website.

[smarties11]

Yes, we are using the desktop client. If you use a recent build of the Office 365 Pro Plus on your clients, it gets installed by default on user logon. We used to block it from installing with AppLocker but now we are using it we've removed this rule. If you use AppLocker too, in whitelist mode as you should be doing, then you need a bunch of rules in place to allow it to install and run, as it installs and runs from user's AppData. Why they didn't make it install to Program Files I don't know?! Presumably to make automatic updates run without any IT input? I can share our rules if you need them.

 

Also when it auto-updates, it downloads the .nupkg file to the users download folder. So if you have Staff who take laptops home, you need to ensure you are NOT redirecting the downloads folder to the network, as that prevents Teams updating and borks the Teams install when users are at home. Downloads must be redirected to the local user profile. Found that out the hard way!

[VXR]

I can share our rules if you need them.

Hi, I'm struggling to get it to install please could you share your applocker rules?

 

Thank you!

[smarties11]

Hi, I'm struggling to get it to install please could you share your applocker rules?

 

Thank you!

 

Yes of course, this is what we allow in AppLocker.

 

Executable Rules

%OSDRIVE%\PROGRAMDATA\*\SQUIRRELTEMP\*

%OSDRIVE%\PROGRAMDATA\*\MICROSOFT\TEAMS\*

%OSDRIVE%\USERS\*\APPDATA\LOCAL\SQUIRRELTEMP\*

%OSDRIVE%\USERS\*\APPDATA\LOCAL\MICROSOFT\TEAMS\*

%PROGRAMFILES%\TEAMS INSTALLER\*

 

DLL Rules

%OSDRIVE%\USERS\*\APPDATA\LOCAL\MICROSOFT\TEAMS\*

%OSDRIVE%\PROGRAMDATA\*\MICROSOFT\TEAMS\*

 

Also make sure if you already have a block rule in place (we used to block *\teams.exe) that you remove this too as a block overrides an allow.

[VXR]

Yes of course, this is what we allow in AppLocker.

 

Executable Rules

%OSDRIVE%\PROGRAMDATA\*\SQUIRRELTEMP\*

%OSDRIVE%\PROGRAMDATA\*\MICROSOFT\TEAMS\*

%OSDRIVE%\USERS\*\APPDATA\LOCAL\SQUIRRELTEMP\*

%OSDRIVE%\USERS\*\APPDATA\LOCAL\MICROSOFT\TEAMS\*

%PROGRAMFILES%\TEAMS INSTALLER\*

 

DLL Rules

%OSDRIVE%\USERS\*\APPDATA\LOCAL\MICROSOFT\TEAMS\*

%OSDRIVE%\PROGRAMDATA\*\MICROSOFT\TEAMS\*

 

Also make sure if you already have a block rule in place (we used to block *\teams.exe) that you remove this too as a block overrides an allow.

 

Amazing!! It works now thanks for sharing, much appreciated!

[johnathanadams]

thank! should I use this or certificate based rules?

[smarties11]

No problem @VXR!

 

@johnathanadams - this is completely your choice. Publisher rules are in theory more secure, as they require files to be digitally signed, however you might find it more difficult to limit the rule just to the Teams files you want, plus they require tweaking when new versions are released.

 

Maybe eventually MS will make Teams a program that is installed for all users and run from the Program Files folder instead, like they should have done in the first place!

[jthompson]

Yes of course, this is what we allow in AppLocker.

 

Thanks for sharing these. I'm wondering if this creates a security risk, though. I'd worry about the risk of malware written to exploit appdata paths used by well known applications like Teams.

 

You'd think MS could only use appdata for user data, rather than the executable portions of the app.

[johnathanadams]

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/executing-code-using-microsoft-teams-updater/

[NicholasEsping]

You can download the teams msi from the following website and use the ALLUSERS=1 option to install to program files.

https://docs.microsoft.com/en-us/microsoftteams/msi-deployment

[3s-gtech]

That doesn't always work - it still just copies Teams to the local AppData on logon which for many of us just breaks due to Applocker and SRPs. Teams doesn't actually run from Program Files.

[mavhc]

Yeah, have to whitelist multiple certificates all named Microsoft Corporation.

 

Microsoft should ask Google how to write Windows software.

[NicholasEsping]

That doesn't always work - it still just copies Teams to the local AppData on logon which for many of us just breaks due to Applocker and SRPs. Teams doesn't actually run from Program Files.

 

Got it did not realize it did not actually run out of Program Files. That's a bummer.

Heres a uservoice with some comments stating they were able to get it to run from program files by using this command

msiexec /i /l*v ALLUSER=1 ALLUSERS=1

https://microsoftteams.uservoice.com/forums/555103-public/suggestions/34768153-improve-install-options-install-for-all-users-an

[kennysarmy]

In case anyone finds this useful:

 

AppLocker application control policies in Microsoft Teams

 

https://docs.microsoft.com/en-us/microsoftteams/applocker-in-teams

[smarties11]

In case anyone finds this useful:

 

AppLocker application control policies in Microsoft Teams

 

https://docs.microsoft.com/en-us/microsoftteams/applocker-in-teams

 

Many thanks for posting this, this has been on my to-do list for a while. I'd considered using publisher rules before however I wasn't sure how many different combinations would need to be on the allow list. Having this official confirmation from Microsoft is perfect.

 

I've just put into place here and removed the path rules we had set up previously and test, works perfectly.

 

Thank you!

[Nblakey96]

Would you be able to share the Robocopy command you used to get this to work? Currently looking at this now and would like to avoid using Appdata if possible

 

 

I've done it by using Robocopy from a share

 

Because the default install copies across from Program Files to their Appdata, it just would not work for us - Applocker, SRPs etc have long been setup here to stop anything like that! I found that if I created a network deployment share that staff could read from, put the files in there from my install on my PC, then used Robocopy MIR to copy them to their profile on logon it worked fine. The beauty of MIR is that it will only copy differences, so once it has worked once it doesn't need to do it again until I put an updated set of files in the deployment share.

 

Totally not how MS want it to work, but work it does.

[Katy]

We've let the machine installer go on with Office 365 and it just installs into AppData (gave up trying to fight it to get it to do anything sensible). I removed the RunOnce entry off the default profiles to stop it auto installing for every user, instead we have a shortcut that links to a batch script which installs it if it isn't already there, otherwise it just launches it, so that it's only installing for people who want to use the desktop app.

 

There's too many differences between the desktop app and the web version now to believe the app is just a wrapper round the website any more (UI elements in different places, unsupported features in web vs app e.g. breakout rooms)

[Steve21]

There's too many differences between the desktop app and the web version now to believe the app is just a wrapper round the website any more (UI elements in different places, unsupported features in web vs app e.g. breakout rooms)

 

Just to confirm, all those things you mention are locked down in the VDI install (if you're using alluser install flag). It's not that the installers are different, just the install method restricts them.

 

Even with the computer based installer you can get all the items, if you don't enable VDI:

http://www.edugeek.net/forums/cloud-services/219574-microsoft-teams-new-meeting-experience.html#post1880600

 

Steve