Deploying a MSI through GPO

This tutorial will describe how to deploy a MSI on multiple machines by using Group Policy.

• 1. Methods of deployment
• 2. Create a distribution point
• 3. Create a Group Policy Object
• 4. Assign a MSI package
• 5. Publish a MSI package
• 6. Redeploy a MSI package
• 7. Remove a MSI package
• 8. Troubleshooting Active Directory/GPO deployments

1. Methods of deployment

Group Policy supports two methods of deploying a MSI package:

• Assign software – A program can be assigned per-user or per-machine. If its assigned per-user, it will be installed when the user logs on. However, if its assigned per-machine then the program will be installed for all users when the machine starts.
• Publish software – A program can be published for one or more users. This program will be added to the Add or Remove Programs list and the user will be able to install it from there.

2. Create a distribution point

The first step in deploying a MSI through GPO is to create a distribution point on the publishing server. This can be done by following these steps:

• log on to the server as an Administrator user
• create a shared network folder (this folder will contain the MSI package)
• set permissions on this folder in order to allow access to the distribution package
• copy the MSI in the shared folder

In the shared folder you can also perform an administrative install for a MSI package contained by an EXE bootstrapper.

3. Create a Group Policy Object

A MSI package is deployed (distributed) through GPO as a Group Policy Object. In order to create an object for your package, you can follow these steps:

• click on the Start button, go to Programs, select Administrative Tools and then select Active Directory Users and Computers
• right-click your domain name in the console tree and select the Properties context menu
• select the Group Policy tab and click New
• set the name of the policy (for example MyApplication)
• click Properties and select the Security tab
• check the Apply Group Policy checkbox only for the groups to which the policy will be applied
• click on the OK button

4. Assign a MSI package

A package can be assigned per-user or per-machine. Also, if the package is assigned, it will automatically be installed silently. In order to assign a package you can follow these steps:

• click on the Start button, go to Programs, select Administrative Tools and then select Active Directory Users and Computers
• right-click your domain name in the console tree and select the Properties context menu
• go to the Group Policy tab, select the object you want and click Edit
• expand Software Settings under Computer Configuration
• right-click Software Installation, select the New context menu and then click on Package
• in the Open dialog type the full UNC path of the shared package you want to assign
• click on the Open button
• click on Assigned and then click OK (the package will be added to the right pane of the "Group Policy" window)
• close the Group Policy snap-in, click OK and exit the Active Directory Users and Computers snap-in
• when the client computers start, the assigned package will be installed automatically

Do not use the Browse button in the Open dialog to access the UNC location. Make sure that you use the UNC path to the shared package.

5. Publish a MSI package

When using Group Policy, you can publish a package in order to allow the target user to install it by using Add or Remove programs. The steps for publishing a package are:

• click on the Start button, go to Programs, select Administrative Tools and then select Active Directory Users and Computers
• right-click your domain name in the console tree and select the Properties context menu
• go to the Group Policy tab, select the object you want and click Edit
• expand Software Settings under User Configuration
• right-click Software Installation, select the New context menu and then click on Package
• in the Open dialog type the full UNC path of the shared package you want to publish
• click on the Open button
• click on Publish and then click OK (the package will be added to the right pane of the "Group Policy" window)
• close the Group Policy snap-in, click OK and exit the Active Directory Users and Computers snap-in
• test the package:
  • log on to the target computer
  • click on the Start button and go to Control Panel
  • double-click the Add or Remove programs applet and select Add New Programs
  • in the Add programs from your network list select the program you published
  • use the Add button to install the package
  • click OK and then Close

Do not use the Browse button in the Open dialog to access the UNC location. Make sure that you use the UNC path to the shared package.

6. Redeploy a MSI package

Sometimes you may need to redeploy a package (for example when doing an upgrade). For redeploying a package you can follow these steps:

• click on the Start button, go to Programs, select Administrative Tools and then select Active Directory Users and Computers
• right-click your domain name in the console tree and select the Properties context menu
• go to the Group Policy tab, select the object you used to deploy the package and click Edit
• expand the Software Settings element (per-user or per-machine) which contains the deployed package
• expand the Software Installation element which contains the deployed package
• right-click the package in the right pane of the Group Policy window
• select the All Tasks menu and click Redeploy application
• click the Yes button for reinstalling the application wherever it is installed
• close the Group Policy snap-in, click OK and exit the Active Directory Users and Computers snap-in

7. Remove a MSI package

Group Policy also allows you to remove packages which have been deployed in the past. Here are the steps for removing a package:

• click on the Start button, go to Programs, select Administrative Tools and then select Active Directory Users and Computers
• right-click your domain name in the console tree and select the Properties context menu
• go to the Group Policy tab, select the object you used to deploy the package and click Edit
• expand the Software Settings element (per-user or per-machine) which contains the deployed package
• expand the Software Installation element which contains the deployed package
• right-click the package in the right pane of the Group Policy window
• select the All Tasks menu and click Remove
• select from the following options:
  • Immediately uninstall the software from users and computers
  • Allow users to continue to use the software but prevent new installations
• click the OK button to continue
• close the Group Policy snap-in, click OK and exit the Active Directory Users and Computers snap-in

8. Troubleshooting Active Directory/GPO deployments

Here is an article that shows how to troubleshoot an Active Directory/GPO installation: How do I create an installation log?

The End

This concludes our tutorial.

Source: Deploying a MSI through GPO

Registry Based GPO Setting to force displaying small icons in taskbar

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]

"TaskbarSmallIcons"=dword:00000001

How to create a Central Store for Group Policy Administrative Templates in Window Vista

This article describes how to use the new .admx and .adml files to create and to administer registry-based policy settings in Windows Vista. This article also explains how the Central Store is used to store and to replicate Windows Vista policy files in a domain environment.

Back to the top

MORE INFORMATION

Overview Windows Vista uses a new format to display registry-based policy settin…

Overview

Windows Vista uses a new format to display registry-based policy settings. These registry-based policy settings appear under Administrative Templates in the Group Policy Object Editor. In Windows Vista, these registry-based policy settings are defined by standards-based XML files that have an .admx file name extension. The .admx file format replaces the legacy .adm file format. The .adm file format uses a proprietary markup language.
In Windows Vista, Administrative Template files are divided into .admx files and language-specific .adml files that are available to Group Policy administrators. The changes that are implemented in Windows Vista let administrators configure the same set of policies by using two different languages. Administrators can configure policies by using the language-specific .adml files and the language-neutral .admx files.

Back to the top

Administrative Template file storage

In earlier operating systems, all the default Administrative Template files are added to the ADM folder of a Group Policy object (GPO) on a domain controller. The GPOs are stored in the SYSVOL folder. The SYSVOL folder is automatically replicated to other domain controllers in the same domain. A policy file uses approximately 2 megabytes (MB) of hard disk space. Because each domain controller stores a distinct version of a policy, replication traffic is increased.
Windows Vista uses a Central Store to store Administrative Template files. In Windows Vista, the ADM folder is not created in a GPO as in earlier versions of Windows. Therefore, domain controllers do not store or replicate redundant copies of .adm files.

Collapse this tableExpand this table

Note
If you use a client that is running an earlier version of Windows to modify a policy that is created or administered on a Windows Vista-based computer, the client creates the ADM folder and replicates the files.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

816662 (http://support.microsoft.com/kb/816662/ ) Recommendations for managing Group Policy Administrative Template (.adm) files

Back to the top

The Central Store

To take advantage of the benefits of .admx files, you must create a Central Store in the SYSVOL folder on a domain controller. The Central Store is a file location that is checked by the Group Policy tools. The Group Policy tools use any .admx files that are in the Central Store. The files that are in the Central Store are later replicated to all domain controllers in the domain.
To create a Central Store for .admx and .adml files, create a folder that is named PolicyDefinitions in the following location:

\\FQDN\SYSVOL\FQDN\policies

Collapse this tableExpand this table

Note
FQDN is a fully qualified domain name.

For example, to create a Central Store for the Test.Microsoft.com domain, create a PolicyDefinitions folder in the following location:

\\Test.Microsoft.Com\SYSVOL\Test.Microsoft.Com\Policies

Copy all files from the PolicyDefinitions folder on a Windows Vista-based client computer to the PolicyDefinitions folder on the domain controller. The PolicyDefinitions folder on a Windows Vista-based computer resides in the same folder as Windows Vista. The PolicyDefinitions folder on the Windows Vista-based computer stores all .admx files and .adml files for all languages that are enabled on the client computer.
The .adml files on the Windows Vista-based computer are stored in a language-specific folder. For example, English (United States) .adml files are stored in a folder that is named "en-US." Korean .adml files are stored in a folder that is named "ko_KR." If .adml files for additional languages are required, you must copy the folder that contains the .adml files for that language to the Central Store. When you have copied all .admx and .adml files, the PolicyDefinitions folder on the domain controller should contain the .admx files and one or more folders that contain language-specific .adml files.

Collapse this tableExpand this table

Note
When you copy the .admx and .adml files from a Windows Vista-based computer, verify that the most recent updates to these files and to Windows Vista are installed. Also, make sure that the most recent Administrative Template files are replicated. This advice also applies to service packs if applicable.

Back to the top

Group Policy administration

Windows Vista does not include Administrative Templates that have an .adm extension. Additionally, earlier versions of Windows cannot use the new administrative format. Therefore, client computers that are running earlier versions of Windows cannot administer new policies that are included with Windows Vista. We recommend that you use computers that are running Windows Vista or later versions of Windows to perform Group Policy administration.

Back to the top

Updating Administrative Template Files

In Group Policy for versions of Windows earlier than Windows Vista, if you change Administrative template policy settings on local computers, the Sysvol share on a domain controller within your domain is automatically updated with the new .ADM files. In turn, those changes are replicated to all other domain controllers in the domain. This might result in increased network load and storage requirements. In Group Policy for Windows Server 2008 and Windows Vista, if you change Administrative template policy settings on local computers, Sysvol will not be automatically updated with the new .ADMX or .ADML files. This change in behavior is implemented to reduce network load and disk storage requirements, and to prevent conflicts between .ADMX files and. ADML files when edits to Administrative template policy settings are made across different locales. To make sure that any local updates are reflected in Sysvol, you must manually copy the updated .ADMX or .ADML files from the PolicyDefinitions file on the local computer to the Sysvol\PolicyDefinitions folder on the appropriate domain controller.
To download the Administrative template files for Windows Server 2008, see Administrative Templates (ADMX) for Windows Server 2008 (http://go.microsoft.com/fwlink/?LinkId=116434) .

Back to the top

---

APPLIES TO

• Windows Vista Ultimate
• Windows Vista Enterprise
• Windows Vista Business
• Windows Vista Home Premium
• Windows Vista Home Basic
• Windows Vista Starter

Source: How to create a Central Store for Group Policy Administrative Templates in Window Vista

Group Policy: To configure "Open File – Security Warning" prompt behavior in Windows Server 2008

 

 

olicy Details

Policy Class
Machine

Supported On
At least Internet Explorer 7.0

ADMX File
inetres.admx

Requires Reboot
False

Requires Log Off
False

Registry Location

The following registry values are involved in this policy.

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones!1806

 

Explanation

This policy setting controls whether or not the "Open File – Security Warning" prompt is shown when launching executables or other unsafe files.

For instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.

If you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.

If you disable this policy setting, files will not be opened.

If you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones.

 

Reference:

• Group Policy: Launching Programs and Unsafe Files