Software deployment GPO, target only certain OU's?

[dany2010]

Hi,

 

We have 5 sites and just looking at deploying reader to all machines. At 120mb we dont want to transfer over the vlan but we are trying to only keep one msi installer for all machines.

 

Is it possible to setup a install and only target to certain machines like GPP can do?

 

Many thanks,

 

Dan.

[FN-GM]

Yep. I assume you deploying via group policy? If so just create a GP on the OU and then deploy.

[ChrisH]

Just create the gpo and link it to each OU you want to target.

[ihaveaproblem]

As others have said link the GPO to the OU's that require it ( Providing your OU's are structured in a way this is possible )

Or you could apply the GPO at top level and narrow it down using security filtering.

[dany2010]

Hi,

 

Thanks all. Luckily we have just re-arranged our AD so each site has its own OU now.

 

Im guessing that although the domain controller is located at one of the sites, if we put in the installation path in the GPO to another server the workstation will go direct to the server on site for the installation files and not throught the vlan and the DC.

 

The DC's are both located on one site and the servers onsite are just file print servers.

 

Seems to take ages for it to add the msi to the gpo on our slow connections.

Edited July 31, 2012 by dany2010

[FN-GM]

Hi,

 

Thanks all. Luckily we have just re-arranged our AD so each site has its own OU now.

 

Im guessing that although the domain controller is located at one of the sites, if we put in the installation path in the GPO to another server the workstation will go direct to the server on site for the installation files and not throught the vlan and the DC.

 

The DC's are both located on one site and the servers onsite are just file print servers.

 

Seems to take ages for it to add the msi to the gpo on our slow connections.

 

You are correct.

 

If you have multiple sites and slow collections and regularly send out software you should look at SCCM it will help.

[Duke5A]

You don't necessarily have to segregate computer objects into separate organizational units to do this. Look into WMI filters for you group policy objects. Anything that can be queried through WMI can be used to filter which machines get what policy. AD Site can also be queried through WMI.

[ZeroHour]

Also a different way to lock down who gets what policy is via the security permissions of the GP. Make a security group and add the machine accounts to the group. Then modify the GP permissions and remove the everyone read group and add the security group you just created with read and apply permissions. WMI is probably neater and the event log does not a policy couldnt be applied on pc's that are not in the group but its not a big issue and permissions should be faster then using WMI filters.

The same technique can be used to filter user GP's as well.