Oracle Virtualbox 7 deploy by GPO and SCCM

[WhiteStar1]

Hi all thanks for reading this. I have moved to a new school and asked to create an oracle Virtualbox vm and deploy by GPO or SCCM. I haven’t any idea how to do this coming from a RM network. I would like to deploy the software and share the image from a server based share for install as that’s the method I use with the RM packager. Any help please?

[6Foot2]

Not easy things to summarize.

 

As I recall (it's been a while!)

 

Deployment via GPO: You could script it, or you could use an MSI (if you have one) An MST may also be required.

 

SCCM: This is a bit of a beast, but you will need to create a task sequence that tells SCCM what software to send to which stations, when, and how to do that.

 

It's difficult to be more specific (I've forgotten a lot of stuff!) I do remember that RM "insulates" you from a lot of the stuff you need to know about running a network without their tools.

 

Perhaps someone who is still managing a vanilla network can give you more details.

[jthompson]

We're still deploying VirtualBox 6 via GPO. Haven't looked at v7 yet to see if this all still works. This is what we do to deploy VirtualBox 6, at any rate.

 

An MSI installer is available from within the regular .exe installer (when running the installer, look in %LOCALAPPDATA%\Temp and take a copy of the msi).

You can then use a computer startup script in a GPO to install it. Something like (version numbers are just what I've got documented, so obviously update accordingly):

 

IF EXIST "C:\Program Files\Oracle\VirtualBox\VirtualBox.exe" GOTO QUIT
msiexec /i "\\path\to\\VirtualBox-6.1.20-r143896.msi" /qr ALLUSERS=1
:QUIT

 

Our VMs are deployed to client machines. They're copyied down from a network location to the local hard drive, where they remain (i.e. not copying down each time, or running across the network). The VMs are configured with an immutable hard drive, so that they return to their original state each time they're started up. I'll leave that step as an exercise for the reader, since the effectiveness of simple batch scripts to copy them down might depend on the size of the VM, the local network setup, etc. User's home folders are available within the VM using the Shared Folders feature.

 

Importantly, we lock down the VirtualBox options available to the end user, so that they can't modify the VM config or add their own VMs. A separate GPO then applies a user start-up script for student users (in this example the VM being locked down is stored locally on the client machine at C:\VirtualBox VMs\SchoolVM). The start-up script makes use of vboxmanage to configure VirtualBox options. It registers the deployed VM with the VirtualBox application and then locks down the menus and other UI stuff to keep things simple.

if exist "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" (
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" registervm "C:\VirtualBox VMs\SchoolVM\SchoolVM.vbox"
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata global GUI/Customizations noSelector
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata global GUI/SuppressMessages remindAboutAutoCapture,remindAboutMouseIntegration,showRuntimeError.warning.HostAudioNotResponding,remindAboutGoingSeamless,remindAboutInputCapture,remindAboutGoingFullscreen,remindAboutMouseIntegrationOff,confirmGoingSeamless,confirmInputCapture,remindAboutPausedVMInput,confirmVMReset,confirmGoingFullscreen,remindAboutWrongColorDepth
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata global GUI/RestrictedGlobalSettingsPages General,Input,Update,Language,Display,Network,Extensions,Proxy
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata "C:\VirtualBox VMs\SchoolVM\SchoolVM.vbox" GUI/RestrictedRuntimeMenus Machine,View,Devices,Help,Debug
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata "C:\VirtualBox VMs\SchoolVM\SchoolVM.vbox" GUI/RestrictedStatusBarIndicators HardDisks,OpticalDisks,FloppyDisks,Network,USB,SharedFolders,Features,Mouse,Keyboard
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata "C:\VirtualBox VMs\SchoolVM\SchoolVM.vbox" GUI/RestrictedCloseActions SaveState,PowerOff,Restore
)

[WhiteStar1]

We're still deploying VirtualBox 6 via GPO. Haven't looked at v7 yet to see if this all still works. This is what we do to deploy VirtualBox 6, at any rate.

 

An MSI installer is available from within the regular .exe installer (when running the installer, look in %LOCALAPPDATA%\Temp and take a copy of the msi).

You can then use a computer startup script in a GPO to install it. Something like (version numbers are just what I've got documented, so obviously update accordingly):

 

IF EXIST "C:\Program Files\Oracle\VirtualBox\VirtualBox.exe" GOTO QUIT
msiexec /i "\\path\to\\VirtualBox-6.1.20-r143896.msi" /qr ALLUSERS=1
:QUIT

 

Our VMs are deployed to client machines. They're copyied down from a network location to the local hard drive, where they remain (i.e. not copying down each time, or running across the network). The VMs are configured with an immutable hard drive, so that they return to their original state each time they're started up. I'll leave that step as an exercise for the reader, since the effectiveness of simple batch scripts to copy them down might depend on the size of the VM, the local network setup, etc. User's home folders are available within the VM using the Shared Folders feature.

 

Importantly, we lock down the VirtualBox options available to the end user, so that they can't modify the VM config or add their own VMs. A separate GPO then applies a user start-up script for student users (in this example the VM being locked down is stored locally on the client machine at C:\VirtualBox VMs\SchoolVM). The start-up script makes use of vboxmanage to configure VirtualBox options. It registers the deployed VM with the VirtualBox application and then locks down the menus and other UI stuff to keep things simple.

if exist "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" (
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" registervm "C:\VirtualBox VMs\SchoolVM\SchoolVM.vbox"
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata global GUI/Customizations noSelector
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata global GUI/SuppressMessages remindAboutAutoCapture,remindAboutMouseIntegration,showRuntimeError.warning.HostAudioNotResponding,remindAboutGoingSeamless,remindAboutInputCapture,remindAboutGoingFullscreen,remindAboutMouseIntegrationOff,confirmGoingSeamless,confirmInputCapture,remindAboutPausedVMInput,confirmVMReset,confirmGoingFullscreen,remindAboutWrongColorDepth
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata global GUI/RestrictedGlobalSettingsPages General,Input,Update,Language,Display,Network,Extensions,Proxy
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata "C:\VirtualBox VMs\SchoolVM\SchoolVM.vbox" GUI/RestrictedRuntimeMenus Machine,View,Devices,Help,Debug
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata "C:\VirtualBox VMs\SchoolVM\SchoolVM.vbox" GUI/RestrictedStatusBarIndicators HardDisks,OpticalDisks,FloppyDisks,Network,USB,SharedFolders,Features,Mouse,Keyboard
"C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata "C:\VirtualBox VMs\SchoolVM\SchoolVM.vbox" GUI/RestrictedCloseActions SaveState,PowerOff,Restore
)

 

Just marvellous! Thanks so much for your help! I really like how you laid down the gauntlet - for the user to figure out! A challenge it is, although new job and all I am nervous but I intend to get it done.

[WhiteStar1]

We're still deploying VirtualBox 6 via GPO. Haven't looked at v7 yet to see if this all still works. This is what we do to deploy VirtualBox 6, at any rate.

 

An MSI installer is available from within the regular .exe installer (when running the installer, look in %LOCALAPPDATA%\Temp and take a copy of the msi).

You can then use a computer startup script in a GPO to install it. Something like (version numbers are just what I've got documented, so obviously update accordingly):

 

IF EXIST "C:\Program Files\Oracle\VirtualBox\VirtualBox.exe" GOTO QUIT
msiexec /i "\\path\to\\VirtualBox-6.1.20-r143896.msi" /qr ALLUSERS=1
:QUIT

 

Our VMs are deployed to client machines. They're copyied down from a network location to the local hard drive, where they remain (i.e. not copying down each time, or running across the network). The VMs are configured with an immutable hard drive, so that they return to their original state each time they're started up. I'll leave that step as an exercise for the reader, since the effectiveness of simple batch scripts to copy them down might depend on the size of the VM, the local network setup, etc. User's home folders are available within the VM using the Shared Folders feature.

 

Importantly, we lock down the VirtualBox options available to the end user, so that they can't modify the VM config or add their own VMs. A separate GPO then applies a user start-up script for student users (in this example the VM being locked down is stored locally on the client machine at C:\VirtualBox VMs\SchoolVM). The start-up script makes use of vboxmanage to configure VirtualBox options. It registers the deployed VM with the VirtualBox application and then locks down the menus and other UI stuff to keep things simple.

if exist "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" (
   "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" registervm "C:\VirtualBox VMs\SchoolVM\SchoolVM.vbox"
   "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata global GUI/Customizations noSelector
   "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata global GUI/SuppressMessages remindAboutAutoCapture,remindAboutMouseIntegration,showRuntimeError.warning.HostAudioNotResponding,remindAboutGoingSeamless,remindAboutInputCapture,remindAboutGoingFullscreen,remindAboutMouseIntegrationOff,confirmGoingSeamless,confirmInputCapture,remindAboutPausedVMInput,confirmVMReset,confirmGoingFullscreen,remindAboutWrongColorDepth
   "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata global GUI/RestrictedGlobalSettingsPages General,Input,Update,Language,Display,Network,Extensions,Proxy
   "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata "C:\VirtualBox VMs\SchoolVM\SchoolVM.vbox" GUI/RestrictedRuntimeMenus Machine,View,Devices,Help,Debug
   "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata "C:\VirtualBox VMs\SchoolVM\SchoolVM.vbox" GUI/RestrictedStatusBarIndicators HardDisks,OpticalDisks,FloppyDisks,Network,USB,SharedFolders,Features,Mouse,Keyboard
   "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata "C:\VirtualBox VMs\SchoolVM\SchoolVM.vbox" GUI/RestrictedCloseActions SaveState,PowerOff,Restore
)

 

I am having a hell of a time with this. I can't get students to launch the vm. They can't run batch files. Although the disk is set to immutable, a snapshot is created and remains on the drive which is only 120GB. I need to get the student to launch the vm from a menu shortcut. I don't even get a message to reset the disk. Any help would be deeply appreciated. Thanks

[jthompson]

When you say that students aren't able to run batch files, do I take it that that prevents you from having a login script run those vboxmanage commands? That's going to be risky for you, since you'll need those in order to prevents students from modifying the VM to give it network access, or switch the disk to something else that they've brought in, etc.

 

The logon script also registers the VM with VirtualBox, so that the vm can then be started from a shortcut. The shortcut will be running VirtualBox with parameters to start that VM, but the VM needs to have been registered for that to work. That all needs to be done in the user's context (which is why it's a logon script).

 

We use AppLocker to allowlist batch scripts for our end users, so that logon scripts can be run successfully but the end users can't just run random bat files.

[WhiteStar1]

When you say that students aren't able to run batch files, do I take it that that prevents you from having a login script run those vboxmanage commands? That's going to be risky for you, since you'll need those in order to prevents students from modifying the VM to give it network access, or switch the disk to something else that they've brought in, etc.

 

The logon script also registers the VM with VirtualBox, so that the vm can then be started from a shortcut. The shortcut will be running VirtualBox with parameters to start that VM, but the VM needs to have been registered for that to work. That all needs to be done in the user's context (which is why it's a logon script).

 

We use AppLocker to allowlist batch scripts for our end users, so that logon scripts can be run successfully but the end users can't just run random bat files.

 

Thanks. It's been difficult trying to do this. I have worked on an RM Network for years and not had this issue. Now working on a vanilla Windows network makes somethings harder to deal with. I will have a look at AppLocker.