Deploying and Managing Software by Using Group Policy

1
Deploying and Managing Software by Using Group
Policy

• Chapter Twelve

2
IntelliMirror Components and Change and
Configuration Management Concepts

• Change and configuration management can have a
  significant impact on the bottom line of the
  organization
• Hard costs vs. soft costs
• Hard costs equipment, software
• Soft costs peoples salaries
• IntelliMirror is a tool to help manage change and
  configuration

3
IntelliMirror

• Features
• Data management
• Desktop settings management
• Software installation and maintenance
• Offline Files

4
Understanding the Phases of Software Management

• Preparation Phase
• Distribution Phase
• Targeting Phase
• Pilot Phase
• Installation Phase

5
Preparation Phase

• Will the software be installed locally, or on a
  central server?
• What users will need access to the new
  application?
• Do you have enough licenses?
• Will the network infrastructure support the
  deployment design?
• Will the software be assigned or published?
• Windows Installer service
• Can fully automate software installation and
  configuration process
• Can repair installed applications
• Requires Windows Installer package for each
  application

6
Distribution Phase

• Define distribution points
• Copy the installation files to the distribution
  points or perform an administrative installation
  to the distribution points

7
Targeting Phase

• Determine the needs of the users
• Use Group Policy to create and/or modify GPOs in
  order to target the software to specific users
  and groups

8
Pilot Phase

• A trial phase in a lab environment for
  troubleshooting and debugging
• This phase is often skipped in smaller companies
• Can reduce downtime and inefficiency

9
Installation Phase

• In this phase the software is rolled out to users
  who are set up to receive it
• For native Windows 20003 applications, you will
  probably use Windows Installer
• For third-party software, you will need plug-ins

10
Creating and Configuring Windows Installer
Packages

• Windows Installer technology overview
• Managing Windows Installer settings with Group
  Policy
• Creating Windows Installer packages with
  WinINSTALL LE
• If no .msi file available
• Option to use another file type
• Called ZAP (.zap) file
• .zap file limitations
• Can only be published and not assigned
• Are not resilient and do not repair themselves
  automatically
• Always use permissions of currently logged on user

11
Windows Installer Technology Overview

• New features
• Software diagnostics and repair
• Repair if .dll is deleted or corrupted
• Complete uninstallation of software
• Multiplatform capability

12
Windows Installer Technology Overview

• Windows Installer Packages
• MSI files that contain instructions pertaining to
  the installation and removal of applications
• Windows Installer settings can be managed with
  the Group Policy Editor
• Packages should be saved to SYSVOL for
  replication purposes

13
Windows Installer Technology Overview

• .msi
• Windows Installers Package
• .msp
• Windows Installer Patch
• Windows Installer patch (.msp) file can also be
  provided
• .mst
• Modify default options of Windows Installer
  package
• Windows Installer Transform
• Allows administrator to customize options when
  application is installed

14
Managing Windows Installer Settings with Group
Policy

• Windows Installer settings can be applied to
  either the user or the computer

15
Managing Windows Installer Settings with Group
Policy

• Key settings
• Always Install With Elevated Privileges
• Disable Media Source For Any Install
• Enable User To Use Media Source While Elevated
• Disable Windows Installer

16
Creating Windows Installer Packages with
WinINSTALL LE

• WinINSTALL LE is used to install non-Windows
  20003 certified programs
• When creating packages use a clean operating
  system use an average computer

17
Managing Software Deployment Through the Software
Installation Snap-in

• Through Software Installation, you can manage the
  following
• Deploying applications
• Applying upgrades and patches
• Uninstalling software

18
Requirements for Software Installation

• Group Policy dependency
• Active Directory dependency
• Works best with Windows Installer applications
• Works with non-Windows Installer applications

19
Configuring Software Deployment

• Group Policy can be used to deliver applications
  to
• Users
• Computers
• Application is delivered to user
• Available on every computer used by that user
• Application is delivered to computer
• Remains on that computer and is available to all
  users of that computer

20
Assigned vs. Published Applications

• Assigned applications appear in the Start menu or
  as desktop icons and reappear even if users
  uninstall using Add/Remove Programs Computer
  User Configuration
• Published applications are made available through
  Add/Remove Programs, but a user must explicitly
  install them in order to use them User
  Configuration Only

21
Assigned Applications

• Assigned to computer
• Application automatically installed next time
  that computer is started
• Visible to all users of computer
• Self-healing if associated files are deleted
• Assigned to user
• Applications shortcut(s) advertised on Start
  menu
• By default, application is not actually installed
• Application follows user around
• Self-healing if associated files are deleted
  (.dlls)

22
Published Applications

• Can only publish to users
• User can install application
• By accessing Add or Remove Programs in Control
  Panel
• User can use document invocation to install
• Application installed when use opens document

23
Assigned vs. Published Applications

• Assigned applications are automatically installed
  if assigned to a Computer
• Assigned applications are automatically installed
  when user selects application from start menu
• Published applications are installed selectively
  by user

24
Using the Software Installation Snap-in

• Configuring Software Installation properties

25
Using the Software Installation Snap-in

• Configuring package properties
• General
• Deployment
• Upgrades
• Categories
• Modifications
• Security

26
Using the Software Installation Snap-in

• Categories to make published software easier to
  locate by organizing into meaningful groups in
  Add or Remove Programs
• Software categories created in one GPO are
  available to all other GPOs in domain
• Create an extension to all automatic installation
  of software. (.html for browser)

27
Configuring the Software Installation Properties
28
Software Categories in Add or Remove Programs
29
Maintaining Deployed Software

• Auto-install this application by file extension
  activation
• Uninstall this application when it falls out of
  the scope of management
• Do not display this package in the Add/Remove
  Programs control panel
• Install this application at logon
• Installation user interface options

30
Mandatory Upgrade

• New major version of software package available
• All users must upgrade to new version
• Old package is removed
• New package is installed
• Not suitable for deploying service packs or hot
  fixes

31
Optional Upgrade

• Used when new major version of software package
  available
• Optional
• User with older version installed
• Must install upgrade using Add or Remove Programs
• User without software installed
• Installs newer version

32
Redeployment

• Force application to reinstall itself everywhere
  that it is already installed
• Used for service pack or hotfix
• New .msi file can be copied right over old one

33
Using the Software Installation Snap-in

• Deploying a new package

34
Using the Software Installation Snap-in

• Deploying a new package

35
Configuring Automatic Operating System Updates

• Configure Group Policy to automatically update
• Windows 2000
• Windows XP Professional
• Windows Server 2003
• Must be running automatic update client
• Configure computer to automatically download
  operating system updates from
• Microsoft Windows Update Web site
• Local Software Update Services (SUS) server

36
SUS

• Allows administrator to manage operating system
  updates for every client from single location
• Automatically contacts Windows Update Web site
• Downloads available operating system updates

37
SUS Requirements

• Running Windows 2000 Server with Service Pack 2
  or higher
• Internet Information Server 5 or higher must be
  installed
• Internet Explorer 5.5 or higher must be installed

38
Example SUS Infrastructure
39
Removing Deployed Software

• Application must have been originally installed
  using a Windows Installer package
• Removing software when user or computer moves out
  of scope
• User or Computer moved from OU where package was
  assigned

40
Forced Removal

• Automatically uninstalls application from all
  computers
• Takes place either
• Next time the computer restarts
• For computer-based policies
• When the user logs on
• For user-based policies

41
Optional Removal

• Does not remove any of installed copies of
  software
• Does not perform any future installations either
• Applications that were never installed
• No longer appear in Add or Remove Programs
• If users remove the application
• They are not able to reinstall it

42
Removing Deployed Software
43
Troubleshooting Software Deployment

• First step
• Troubleshoot Group Policy
• Check
• No Override option
• Block Inheritance option
• ACL permissions
• Loopback Processing Mode
• WMI filters