Skip to main content

How to deploy a MSI on multiple machines by using Group Policy.


1. Methods of deployment

Group Policy supports two methods of deploying a MSI package:

Assign software - A program can be assigned per-user or per-machine. If its assigned per-user, it will be installed when the user logs on. However, if its assigned per-machine then the program will be installed for all users when the machine starts.
Publish software - A program can be published for one or more users. This program will be added to the Add or Remove Programs list and the user will be able to install it from there.

2. Create a distribution point

The first step in deploying a MSI through GPO is to create a distribution point on the publishing server. This can be done by following these steps:

A.log on to the server as an Administrator user
B. create a shared network folder (this folder will contain the MSI package)
C. set permissions on this folder in order to allow access to the distribution package
D. copy the MSI in the shared folder
E. In the shared folder you can also perform an administrative install for a MSI package contained by an EXE bootstrapper.

3. Create a Group Policy Object

A MSI package is deployed (distributed) through GPO as a Group Policy Object. In order to create an object for your package, you can follow these steps:

A. click on the Start button, go to Programs, select Administrative Tools and then select Active Directory Users and Computers
B. right-click your domain name in the console tree and select the Properties context menu
C. select the Group Policy tab and click New
D. set the name of the policy (for example MyApplication)
E. click Properties and select the Security tab
F. check the Apply Group Policy checkbox only for the groups to which the policy will be applied
G. click on the OK button

4. Assign a MSI package

A package can be assigned per-user or per-machine. Also, if the package is assigned, it will automatically be installed silently. In order to assign a package you can follow these steps:

A. click on the Start button, go to Programs, select Administrative Tools and then select Active Directory Users and Computers
B. right-click your domain name in the console tree and select the Properties context menu
C. go to the Group Policy tab, select the object you want and click Edit
D. expand Software Settings under Computer Configuration
E. right-click Software Installation, select the New context menu and then click on Package
in the Open dialog type the full UNC path of the shared package you want to assign
F. click on the Open button
G. click on Assigned and then click OK (the package will be added to the right pane of the "Group Policy" window)
H. close the Group Policy snap-in, click OK and exit the Active Directory Users and Computers snap-in
when the client computers start, the assigned package will be installed automatically
Do not use the Browse button in the Open dialog to access the UNC location. Make sure that you use the UNC path to the shared package.

5. Publish a MSI package

When using Group Policy, you can publish a package in order to allow the target user to install it by using Add or Remove programs. The steps for publishing a package are:

A. click on the Start button, go to Programs, select Administrative Tools and then select Active Directory Users and Computers
B. right-click your domain name in the console tree and select the Properties context menu
C. go to the Group Policy tab, select the object you want and click Edit
D. expand Software Settings under User Configuration
E. right-click Software Installation, select the New context menu and then click on Package
in the Open dialog type the full UNC path of the shared package you want to publish
F. click on the Open button
G. click on Publish and then click OK (the package will be added to the right pane of the "Group Policy" window)
H. close the Group Policy snap-in, click OK and exit the Active Directory Users and Computers snap-in
test the package:
I. log on to the target computer
J. click on the Start button and go to Control Panel
K. double-click the Add or Remove programs applet and select Add New Programs
in the Add programs from your network list select the program you published
use the Add button to install the package
L. click OK and then Close
Do not use the Browse button in the Open dialog to access the UNC location. Make sure that you use the UNC path to the shared package.

6. Redeploy a MSI package

Sometimes you may need to redeploy a package (for example when doing an upgrade). For redeploying a package you can follow these steps:

A. click on the Start button, go to Programs, select Administrative Tools and then select Active Directory Users and Computers
B. right-click your domain name in the console tree and select the Properties context menu
C. go to the Group Policy tab, select the object you used to deploy the package and click Edit
D. expand the Software Settings element (per-user or per-machine) which contains the deployed package
E. expand the Software Installation element which contains the deployed package
F. right-click the package in the right pane of the Group Policy window
G. select the All Tasks menu and click Redeploy application
H. click the Yes button for reinstalling the application wherever it is installed
I. close the Group Policy snap-in, click OK and exit the Active Directory Users and Computers snap-in

7. Remove a MSI package

Group Policy also allows you to remove packages which have been deployed in the past. Here are the steps for removing a package:

A. click on the Start button, go to Programs, select Administrative Tools and then select Active Directory Users and Computers
B. right-click your domain name in the console tree and select the Properties context menu
C. go to the Group Policy tab, select the object you used to deploy the package and click Edit
D. expand the Software Settings element (per-user or per-machine) which contains the deployed package
E. expand the Software Installation element which contains the deployed package
F. right-click the package in the right pane of the Group Policy window
G. select the All Tasks menu and click Remove
H. select from the following options:
I. Immediately uninstall the software from users and computers
J. Allow users to continue to use the software but prevent new installations
K. click the OK button to continue
L. close the Group Policy snap-in, click OK and exit the Active Directory Users and Computers snap-in


Popular posts from this blog

HOW TO EDIT THE BCD REGISTRY FILE

The BCD registry file controls which operating system installation starts and how long the boot manager waits before starting Windows. Basically, it’s like the Boot.ini file in earlier versions of Windows. If you need to edit it, the easiest way is to use the Startup And Recovery tool from within Vista. Just follow these steps: 1. Click Start. Right-click Computer, and then click Properties. 2. Click Advanced System Settings. 3. On the Advanced tab, under Startup and Recovery, click Settings. 4. Click the Default Operating System list, and edit other startup settings. Then, click OK. Same as Windows XP, right? But you’re probably not here because you couldn’t find that dialog box. You’re probably here because Windows Vista won’t start. In that case, you shouldn’t even worry about editing the BCD. Just run Startup Repair, and let the tool do what it’s supposed to. If you’re an advanced user, like an IT guy, you might want to edit the BCD file yourself. You can do this

DNS Scavenging.

                        DNS Scavenging is a great answer to a problem that has been nagging everyone since RFC 2136 came out way back in 1997.  Despite many clever methods of ensuring that clients and DHCP servers that perform dynamic updates clean up after themselves sometimes DNS can get messy.  Remember that old test server that you built two years ago that caught fire before it could be used?  Probably not.  DNS still remembers it though.  There are two big issues with DNS scavenging that seem to come up a lot: "I'm hitting this 'scavenge now' button like a snare drum and nothing is happening.  Why?" or "I woke up this morning, my DNS zones are nearly empty and Active Directory is sitting in a corner rocking back and forth crying.  What happened?" This post should help us figure out when the first issue will happen and completely avoid the second.  We'll go through how scavenging is setup then I'll give you my best practices.  Scavenging s

AD LDS – Syncronizing AD LDS with Active Directory

First, we will install the AD LDS Instance: 1. Create and AD LDS instance by clicking Start -> Administrative Tools -> Active Directory Lightweight Directory Services Setup Wizard. The Setup Wizard appears. 2. Click Next . The Setup Options dialog box appears. For the sake of this guide, a unique instance will be the primary focus. I will have a separate post regarding AD LDS replication at some point in the near future. 3. Select A unique instance . 4. Click Next and the Instance Name dialog box appears. The instance name will help you identify and differentiate it from other instances that you may have installed on the same end point. The instance name will be listed in the data directory for the instance as well as in the Add or Remove Programs snap-in. 5. Enter a unique instance name, for example IDG. 6. Click Next to display the Ports configuration dialog box. 7. Leave ports at their default values unless you have conflicts with the default values. 8. Click N