Implementing MSI over GP

[cooka]

Hi Guys,

 

First post! woo!

 

I would like to be able to install applications through group policy using MSI's. I'm not sure weather someone could step me through the procedure. At the moment, I have the MSI in a shared, accessible folder on our school server, then setting the group policy to install when user logins. But when I log into the new account, this does not install.

 

Cheers

[localzuk]

Software installation only happens during boot when you're using GP to do it. So, your policy has to be assigned in such a place as to apply to computers, not users.

[sted]

Software installation only happens during boot when you're using GP to do it. So, your policy has to be assigned in such a place as to apply to computers, not users.

 

it is possible to assign softweare to users so it installs at logon but its more hasslw than its worth (as every time say dave goes to a pc it will install for example smartboard)

 

open up your group policy and its under

computer config\doftware settings\assigned applications. Right click on nthe right and add ths msi and if nesescary mst and that should be it as long as the pc has read access to the share (so either auth users or domain computers) and the policy needs to applied to pcs (and appropriate permissions/ and scope for the pc to get the policy)

[themightymrp]

You also have the choice of setting the software as 'assigned' or 'published'. If you assign the software then it will get installed on the next boot, if you publish the software then you get links to the software in 'Add and Remove Programs' and the user can choose whether or not to install it. I have never tried the publishing method so someone correct me if I'm wrong

[cooka]

it is possible to assign softweare to users so it installs at logon but its more hasslw than its worth (as every time say dave goes to a pc it will install for example smartboard)

 

open up your group policy and its under

computer config\doftware settings\assigned applications. Right click on nthe right and add ths msi and if nesescary mst and that should be it as long as the pc has read access to the share (so either auth users or domain computers) and the policy needs to applied to pcs (and appropriate permissions/ and scope for the pc to get the policy)

 

Thanks for your quick replys guys!

 

OK, say if I didnt have an MSI for all the applications that I wanted to install at start up, could I create a small silent .Bat? would this work the same way?

 

 

Thanks

[themightymrp]

You can create a .bat to do the installs yes (I prefer to rename them as .cmd these days as Windows 7 seems to be a bit picky, maybe thats just me). Instead of adding them to the software installation part of group policy you would go to Computers --> Policies --> Windows Settings --> Scripts --> Startup and add them into here.

 

It is always worth writing a couple of extra lines into a .bat install to check if the software already exists, otherwise you might have it reinstalling at every boot!

[sted]

yes you can do scripts something simple like

 

if exist "c:\program files (x86)\something\something.exe" goto end

"\\server\share$\something\setup.exe" /Q

:end

 

is often enough to work depends on the software

[cooka]

Hi again,

 

Thanks for your reply. I'm a little confused, at the moment i'm applying a group policy to install a program (using silent .cmd) as the at computer boot, but how does the computer know to install at start up if the group policy is assigned to a user? If that makes sense? Instead of applying the GP to a user on the domain, do I need to add the user computers instead?

[themightymrp]

Ideally, you should seperate your policies to apply to either a computer or users and only fill out the relevant GPO sections. So in your case you would assign the software to the PC's that the people would use.

 

There is a policy however under computer configuration (can't remember the full path to it) that is called User Group Policy Loopback Processing. Enabling this and setting the value to Merge might have the desired effect

[sonofsanta]

Is there a reason you want to install at login or for specific users rather than just installing onto machines? Generally you just create a GPO, tie it to an OU containing computers, and add the MSI package under Software Installation in Computer Config. If you want to limit to certain users, you're probably better just limiting access to the shortcut, using file permissions or using a Software Restriction Policy for certain users.

 

You may also want to set Computer Config > Admin Templates > System > Verbose messages to enabled, as that way Windows 7 actually tells you what it's installing instead of just mentioning that it's installing something. Makes troubleshooting much easier.

[sted]

Hi again,

 

Thanks for your reply. I'm a little confused, at the moment i'm applying a group policy to install a program (using silent .cmd) as the at computer boot, but how does the computer know to install at start up if the group policy is assigned to a user? If that makes sense? Instead of applying the GP to a user on the domain, do I need to add the user computers instead?

 

it wont if you want it to install at bootup it needs to be in the computer part of the gpo and applied to computers not users

[cooka]

Yep - I got this to work in the end. I was being a twonk and trying to apply the GP to execute the .cmd file at computer start-up on the user account in active Dir. Instead I added the computer to an OU and applied the GP to the computer which installed VLC silently no problem. Many thanks again people!