Clarify for me MSI install using GPO and slient installs...

[kennysarmy]

To reduce our base ghost image I am seriously looking at what software can be repackaged to msi's.

 

As an example I am looking at Google Earth.

 

I can install it using this line of code:

MSIEXEC.EXE /i "V:\GoogleEarth5\Google Earth.msi" /qn REBOOT=ReallySuppress OMAHA=1 TRANSFORMS="1033.MST" SETUPEXEDIR="V:\GoogleEarth5"

 

Also I can install it by creating a software policy which seems to do the same thing.

 

Creation of MST files is a bit out of my knowledge at the moment but I have been browsing the MSI files using ORCA to try and work out what is going on...

 

So, what is the main benefit of using MSI to roll out software over just sticking the silent install code in the login scipts?

 

Cheers

[SYNACK]

MSI packages can be deployed in AD GPOs and so only run when there is a need to apply the software rather than having to run the checks for each package each bootup. I'm assuming you meant startup script as otherwise your users would need admin privilages to run their logons. You can also deploy MSIs to user GPOs so that a certain package will install for a specific user if they happen to use a different machine. There is also a builtin upgrades feature that allows you to set other packages deployied to be removed on installing the new version.

 

Overall I find it much quicker and cleaner than scripting to use, it also gives the user a visible message explaining that it is installing software.

 

You can also use AD to redeploy or remove a package making which is nice.

 

MSIs themselves are also good as they are self healing so if one of the programs becomes damaged (missing file etc) it will automaticly copy a fresh copy from the installer to fix it. You also get this benifit with script installed MSIs

 

It is a good way to quicly see what stuff (above the basic) is installed on each machine and is really helpful for stuff like the Adobe plugin stuff that changes constantly.

 

Your command example showed applying an MST (transform file) which provides a bunch of defaults for the MSI install, you can use these through the software deploy bit in AD also and if I recall there is also the ability to include MSP (patches) into an app deployment although I have never actually used this.

 

Overall it is up to personal prefference but I find the GPO way to be much cleaner and simpler to manage.

[kennysarmy]

Thanks for your reply - appreciated....

I have normally only deployed MSI software when the vendor has provided a pre-written and tested MSI.

 

ORCA allows me to either edit the MSI direct - thus negating the need for the MST file.

 

Or I guess I could deploy the MSI and MST via AD as you suggest.

 

So, I have my AD tree set up thus:

 

curriculum.local

-School Name

-Computers

-Laptops

-Workstations

-1A4

-1A5

-1A6

etc etc

-Testing

 

I guess the best way to proceed is to create the MSI, test it on the "Testing" group and when I am happy either deploy to the room it's required in or delpoy to the whole "Workstation" part of the tree - in which case it goes everywhere...

 

On this I have two questions.

 

1. If the software (like Google Earth) is already installed, in whatever version, will the software NOT auto install - or will it always install, or ONLY install if it does nt find the same version?

 

and

 

2. Is there a better way to structure AD or the deployment of software MSI's so that I gain more granular control?

 

Many thanks.

Jeff

[Guest TheLibrarian]

We've gone whole circle of Ghost Image deployed software through MSI's and MST's deployed via GPO back to Ghost Image deployed software.

 

Two things kill GPO'd software:

1. Too much software needs to be repackaged to deploy via Group Policy - repackaging takes time and is not always very successful.
   
2. New software has (I'll admit we've been unlucky) conflicted with old software and unfortunately the removal of the new software hasn't fixed the problem.
   

So overall we've found that deploying images with software installed is much faster and more reliable than GPO'ing software out.

Particularly so if you keep older images as you update so you can roll back in case of problems - this is very heavy on disk space though.

 

Deployment of the images does take longer, but if you take in to account how long the PC's take to get ready on the software deployment phase of their boot, there's not that much in it either way.

 

There is the added (albeit small) bonus of one less group policy to apply - if of course you have your software deployed in it's own policy object.

 

 

Having spent the last ~6 years deploying software via both methods, I very much prefer Ghost Image deployment.

 

Having said that, when GPO'd software works, it's good, but it relies heavily on the software developer creating GPO friendly installers (if you don't have time to repackage) and said developers cleaning up after their products properly when they are removed.

[srochford]

Microsoft seem to be moving away from using MSIs deployed through group policy - Office can be deployed like this but it's really hard work compared to using a script.

 

Tools like MDT seem to assume that you will have a script which silently installs the software - it might run msiexec, might run setup /silent, might be a batch file or vbscript. I'd guess this has the benefit that you're not tied to one way of working; lots of manufacturers do now release software which can be silently installed, it's just not an MSI.

[Guest TheLibrarian]

I've not read anything about MDT, how well does it work with WXP and older software Office XP etc.?

[Mr.Ben]

I try to do half and half to be honest.

 

For instance, Office and all of the 2 Simple Stuff we own (which will not be updated) will be in the image along with a few other pieces of software that will not be updated.

 

Things like Flash, Java etc which are updated weekly go on as GPO's so that it is easy to recall them

 

Basically you have to weigh up the chances of having to update it (therefore having to script an uninstall) vs the time taken to deploy via a gpo

[SYNACK]

1. If the software (like Google Earth) is already installed, in whatever version, will the software NOT auto install - or will it always install, or ONLY install if it does nt find the same version?

 

If it is a vendor provided MSI it will take the default action defined in the installer which is usually an upgrade. If it is the same software it will do a fast reinstall over the top which just rewrites the MSI entries in the windows installer database and checks all the files are there.

 

2. Is there a better way to structure AD or the deployment of software MSI's so that I gain more granular control?

 

I put OUs under my Workstations OUs that let me add or remove other policies to a smaller subset of computers by deploying the software in a GPO attached to the more specific OU. Main stuff goes in the Main workstations policy but more specilized stuff goes further down. Thanks to inheritance the sub OUs also get all of the stuff from above in the main policy also.

 

I can see where TheLibrarian is comming from in that I have also had an MSI go wrong but that was a repackage that I messed up and I did catch it during testing.

 

One of the huge benifits of repackaging your software if it does not come with an MSI is actually compatibility especially with older software. We have lots of old curriculum software most of which predates my employment which when I arrived could only be deployied by image as it had trouble running under XP due to using Text to Speach stuff designed for Win 95 and took all sorts of hacks to get going on XP. I got sick of this and repackaged the software and its prerequisites in MSIs which made it a two click job.

 

We then moved to Vista and it just installed and worked right off, later we moved to 64bit Windows 7 and it still just installs and works, no OS checks or extra rubbish, it just goes and this is the same software that was a mission to install on XP.

 

I use a moderate weight image with WDS of Windows and Office and Encarta, all the heavy stuff. The rest is applied by MSI as needed meaning we can remove, upgrade or replace something at any time on all stations with just a few clicks.

 

It is a pain to repack MSIs but there are very real benifits and slimming down the image also makes it more universal and in less need of constant updating if one little thing changes. I use this AppDeploy > Downloads > WinINSTALL LE to repack most of my MSIs, it takes a before and after snapshot, compares them then makes an MSI of the changes. You do need to clean these up a fair bit otherwise it does cause issues but once you get it down its really useful if just for portability.

 

Some stuff we push via MSI avalible free from the vendor

Foxit PDF reader

Flash and Shockwave

Firefox CTP

Photostory 3

Expression Encoder 4 (not yet deployed but soon)

MovieMaker2.6 for Win7

and tonnes more that I have repacked.

[witch]

Sorry, can I be a pain and hijack? I need an msi for Google Earth - could do it myself but I really need one that works? Anyone got one I could use? I would be eternally grateful

[mavhc]

Google Earth: Download Google Earth for PC, Mac, or Linux has an advanced option, you can pick not to auto update

Google Earth auto-updates : Fix a Problem - Google Earth Help has 6.0.2 which is out of date

 

Both open with 7zip to show the msi, extract, open with ORCA, View, Summary Information, change Language to just 1033

 

Optionally create an MST, delete some shortcuts from the Shortcuts table, create a row in directory table for your subfolder, eg Geography and point the google dir at it

[gshaw]

I've never liked GPO software deployment; not enough logging or management there to tell me if the deployment succeeded or had errors along the way. Much prefer SCCM that gives more flexibility so I know exactly what's happening

[mavhc]

I like it because it's free. You could probably forward some event logs if you wanted

[woodamand]

I try to do half and half to be honest.

 

For instance, Office and all of the 2 Simple Stuff we own (which will not be updated) will be in the image along with a few other pieces of software that will not be updated.

 

Things like Flash, Java etc which are updated weekly go on as GPO's so that it is easy to recall them

 

Basically you have to weigh up the chances of having to update it (therefore having to script an uninstall) vs the time taken to deploy via a gpo

 

These flash and java updates that you are doing are something that I need to start making work, and I don't really know how. Do you have any links to info on these, since I have not had much luck making anything work with GPOs

thanks much