Deploying MSI - Is this accurate?

[_Bat_]

Hey all,

 

Little advice needed. Am trying to deploy an MSI over the network for the very first time in my life and am a little bit worried about following the instructions provided by an educational software provider. Though they are extremely basic and easy to follow, I quite frankly just don't trust them.

 

So I wondered if someone here could confirm these details are accurate and they haven't missed any vital info out?

 

1. Go into active directory

2. Select domain >> properties >> group policy tab

3. Select current default domain policy and click edit

4. Select computer configuration then software settings

5. Using 'software installation' select new >> package

6. Enter path to MSI and click open

7. On 'deploy software window' that appears, select 'assigned' radio button.

 

They then go on to talk about file permissions, though I am not sure any of that is needed. I think by default it should inherit the standard permissions?

 

Finally, they say to enter gpupdate /force into run.

 

Cheers!

[Geoff]

For one, don't use the default domain policy. Setup a fresh GPO for software deployments. It keeps things nice and neat and easy to understand.

 

Secondarily, the issue with file permissions is this. When you deploy software this way the machine uses it's computer account to access the MSI. Therefore you must make sure the computer account can actually access the share/directory structure you've stored the MSI in. sysvol and netlogon already have 'Authenticated Users' setup with the correct access so you can use either of these shares without issue. However if you wish to store your MSI's elsewhere (I use a Software$ share) you must setup the ACL's yourself.

[plexer]

I'd also get the group policy management console installed to make creating, editing and troubleshooting gpo's a whole lot easier.

 

Ben

[petectid]

As Geoff mentions set-up new OU's for software installation etc, this way you can separate all your workstations into areas i.e. "IT Suit 1" and LRC this way packages can be sent out to specific classrooms. Your way would install on every PC, though you may wish to do this?

[plock]

Something I've never cleared up...

 

Does the GPO need configuring to use an Admin account to install the software on a machine which is logged on as a restricted user?

[_Bat_]

As Geoff mentions set-up new OU's for software installation etc, this way you can separate all your workstations into areas i.e. "IT Suit 1" and LRC this way packages can be sent out to specific classrooms. Your way would install on every PC, though you may wish to do this?

 

Very good point... I thought of that literally seconds before I saw this. It's too late though, I have already done it. I did it Geoff's way by creating a new GPO, but obviously this will go out to all the domain machines still. For most that is fine, i'm a little bit concerned about the admin machines and worse of all, the servers though?? I haven't forced the update yet, so is there any way that I can change this? I have no idea how to send it out to only certain groups of computers.

[_Bat_]

Okay, I think I got it. Instead of just selecting the domain, select the group of computers. Duh! Haha.

 

I assume its okay if i just remove the policy I just added and re-add it to the group only?

[_Bat_]

Something I've never cleared up...

 

Does the GPO need configuring to use an Admin account to install the software on a machine which is logged on as a restricted user?

 

I'm guessing not taking into account what Geoff said... i'll find out soon enough though.

[Geoff]

Software is installed using the Machine account. So basically with SYSTEM privileges.

[alonebfg]

i change the secuarty and create a group called sayoffice and only deploy to pcs in this group this why i can test the software deployment befory adding all the other pcs to the group also helps me with licences as all i do is count the number of pcs in the deployment group and set the share for that group only. i think it is a bit more secure way of deployment and takes a bit longer but i think it is worth it.

[_Bat_]

Okay I have just had a scoot around the school and deployment appears to have been successful. Thanks everyone

[Ravening_Wolf]

However if you wish to store your MSI's elsewhere (I use a Software$ share) you must setup the ACL's yourself.

 

What is the minimum required permission level for 'Authenticated Users' on the software share of my choice?

[Geoff]

Read and Execute.

[Ravening_Wolf]

Many thanks

[_Bat_]

Geoff mentioned setting permissions for 'authenticated users' on the share that the MSI resides on to 'read and execute'. Is this the only group that needs to have permissions set, or does 'system' need to be set as well? If so, what to?

[Geoff]

No, Authenticated Users is sufficent for the MSI's to work. You might want to add your Technician/Admin group with full Read/Write access for the purposes of MSI administration though.

[_Bat_]

Lol, has that by default anyway. Thanks Geoff!

[_Bat_]

Just one more question before I think I know all I need to ATM about this... will gpupdate /force cause the computers to possibly reboot or just simply install the new msi? It'd be quite worrying if they did, haha.

[Geoff]

If you issue that command and it requires a reboot to implement the GPO changes fully you'll get asked if you want to reboot.

[contink]

Although worth noting that sometimes the new policy doesn't get forced properly so you may have to reboot a couple of times manually to get it to realise there's a new policy.

 

Something I've seen once or twice..