TheFopp Posted November 17, 2008 Posted November 17, 2008 Just in the process of locking down our servers a bit more and noticed that the share on which our MSI Packages for deployment via GPO isn't hidden (... no $ after the share name). Would like to change the share from \\server\MSIPackages to \\server\MSIPackages$ . Is there anyway of doing this without having to remake all the GPOs and therefore forcing the system to all PCs to uninstall and then reinstall the MSI'd software? Obviously we don't want out students to be able to browse to the share from their own PCs and start installing software that they aren't licenced for. Am I correct in thinking that access permissions for this share need to be set at Everyone to Read so that the networked PCs can read the MSI Packages and install them before anyone is logged on? What are the permissions on your shares for your MSI deployments? Cheers in advance Adrian
jsnetman Posted November 17, 2008 Posted November 17, 2008 We share our application folder without the hidden attribute. It's no problem as staff and pupils cannot install software, they do not have permisions.
Ric_ Posted November 17, 2008 Posted November 17, 2008 I did the share moving recently, after a lot of deliberation I decided it would be best to allow the re-installation to occur. The way that the re-installation works is that it checks the installed software and then only updates what it has to (i.e. it isn't a full installation). I simply removed the old software from teh GPOs and told them computers not to uninstall it and then added the new software paths. At reboot the re-installation occurred but it only took about 5-10 minutes... I did this after school too. As for the permissions, I'm not sure.
dgsmith Posted November 17, 2008 Posted November 17, 2008 We share our application folder without the hidden attribute. It's no problem as staff and pupils cannot install software, they do not have permisions. Can they not copy the contents onto a pen drive and use for personal use, thus illegally using the school's licenced software, if they are able to view the folder?
jsnetman Posted November 17, 2008 Posted November 17, 2008 I suppose so, but then they would be using software illegally.
powdarrmonkey Posted November 17, 2008 Posted November 17, 2008 Why not set a deny on the share for your student security group?
TheFopp Posted November 17, 2008 Author Posted November 17, 2008 Why not set a deny on the share for your student security group? Seems like a good idea... but... As a boarding school many students have their own laptops. As the MSI share has to be Read enabled to Everybody so that PCs on our domain can get install the MSIs before anyone logs on. Therefore if a student uses his own laptop what is to stop them browsing the network on that laptop (not logged on to our domain) to find the share which will let them get access to the files as they won't be logged in as Students to be denied access, and would just come under the 'Everybody' permissions and be able to Read the files.
TheFopp Posted November 17, 2008 Author Posted November 17, 2008 I did the share moving recently, after a lot of deliberation I decided it would be best to allow the re-installation to occur. The way that the re-installation works is that it checks the installed software and then only updates what it has to (i.e. it isn't a full installation). I simply removed the old software from teh GPOs and told them computers not to uninstall it and then added the new software paths. At reboot the re-installation occurred but it only took about 5-10 minutes... I did this after school too. As for the permissions, I'm not sure. Interesting... in the past I've found that trying to re-install an MSI over the same program already installed causes it to try to install everytime the PC is booted up. It usually goes through the Installing Software bit a lot faster than it would if it was installing it properly, but I presume it must fail as it retries each time...... ... however this has been when I've already had the software manually installed. It may be different if the software was originally installed via GPO in the first place.
apeo Posted November 17, 2008 Posted November 17, 2008 Seems like a good idea... but... As a boarding school many students have their own laptops. As the MSI share has to be Read enabled to Everybody so that PCs on our domain can get install the MSIs before anyone logs on. Therefore if a student uses his own laptop what is to stop them browsing the network on that laptop (not logged on to our domain) to find the share which will let them get access to the files as they won't be logged in as Students to be denied access, and would just come under the 'Everybody' permissions and be able to Read the files. Why do you need Everybody permissions again? thought these msi's are for gpo deployment. If that is the case the you only need Domain Computer rights and not user rights.
TheFopp Posted November 17, 2008 Author Posted November 17, 2008 Why do you need Everybody permissions again? thought these msi's are for gpo deployment. If that is the case the you only need Domain Computer rights and not user rights. Ahhhh... hadn't thought of that! Brilliant stuff. Cheers.
kmount Posted November 17, 2008 Posted November 17, 2008 What would happen if you did this and then ran office for the first time ... it looks to the MSI to do the "first run" stuff, would it use the users permissions or the machines? An alternative would be to remove the "List" permission from everyone which is how we stop nosy users browsing our shares.
CyberNerd Posted November 17, 2008 Posted November 17, 2008 We have ours setup using computer rights rather than user rights. I don't bother using $ shares at all anymore, it is folly. If you want shares hidden - use SAMBA.
powdarrmonkey Posted November 17, 2008 Posted November 17, 2008 What would happen if you did this and then ran office for the first time ... it looks to the MSI to do the "first run" stuff, would it use the users permissions or the machines? An alternative would be to remove the "List" permission from everyone which is how we stop nosy users browsing our shares. I'm not sure. I don't know whether the engine will use its local cache of the MSI if it can't reach the share, or whether it runs as system or the user if it can. You could suck it and see, but removing List would be a good compromise.
kmount Posted November 17, 2008 Posted November 17, 2008 Does the local PC hold a copy of the MSI? Our experience is that if a machine is "away" from the domain and someone tries to use something like an Outlook Import tool or something converter not already installed it fails looking for our server... Same principle I guess?
User3204 Posted November 17, 2008 Posted November 17, 2008 If the Students laptops are on a different IP range than the servers, with a router in between the ranges, then you could amend the security on the Router/Firewall to block access to this server. Or change the routing on the Server so that the IP range is not visible. This assumes that: a) the IP ranges are different. b) there's nothing on the server that the users would need. c) the firewall/router between them is clever enough. d) there's nothing else within this workstation range that would need access to the server in question.
srochford Posted November 17, 2008 Posted November 17, 2008 Does the local PC hold a copy of the MSI? Our experience is that if a machine is "away" from the domain and someone tries to use something like an Outlook Import tool or something converter not already installed it fails looking for our server... Same principle I guess? It depends on the particular package. If you do this with Office 2007 then it will work fine - the first part of a 2007 install is building the local installation source (basically, it caches the entire CD on the C: drive and then installs from there). Earlier versions of Office don't work so well; they need access to the server. I think that MSI installs generally run in the context of the machine account, not the user, so even when you do add components you should be OK if you only give computers access (but I'm not absolutely sure; I've just installed a package and watched the processes - there seem to be 2 msiexec processes working, 1 running as me, 1 as local system; both "do stuff") I do know that in the past I've had the network set up so that users didn't have read access to the MSI share and it did all work.
powdarrmonkey Posted November 17, 2008 Posted November 17, 2008 I'm inclined to agree. The whole MSI model is supposed to be that users can install things without needing special permission to, like adding extra features, but by the same token I've never conclusively tested it.
Roopert Posted November 19, 2008 Posted November 19, 2008 In answer to OP, though discussion has moved on from this, the link below has a document explaining how to alter an msi file location without recreating the msi. It is part way through the document and it is not very fun to do, but here it is home.fnal.gov/~jklemenc/dl/AD-MSI-for-Dummies.doc
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now