Security

Ask something
Question Locked

Assign software using Group Policy and Security Groups?

0 helpful
17 replies

by mrtoikka

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Hello all! If anyone can help me figure this out faster it would be much appreciated. At my last job when we wanted to push software to users we (I'm almost positive) had a group policy for that specific software package, and somehow had a security group linked to it, so when we wanted to have it installed for a specific user, all we did was open what appeared to me to be a security group in AD, and then added the user's AD account to it, apply, ok, close out the AD window, and have the user log-off and log-on again and viola, the software installed itself. Removing the user from the group and doing a log-off/in cycle also removed the software from the computer. I am trying to set this up at my new job and not having a whole lot of luck. Can anyone help?

17 replies

by mrtoikka

Shasca, thanks for the reply. The information pointed to by your link is all information I have already read and know. The article mentioned that assigning applications to users places shortcuts and extention registrations in the OS for the user but the software does not install until used. I seem to remember, the way we did it at my last job, that when the user logged on, after being added to the security group, a message was displayed on the logon window before you got to the desktop that read "Installing managed software: Microsoft office" for example. Does any of this ring a bell? Much appreciated.

by tmalo627

All the client machines need to have Windows Installer 3.1 installed on them for software deployment to work successfully. The service for Windows Installer also must be enabled. It can be set to manual and the Deployment should start it. If that doesn't work right away, make sure the users aren't logging on with cached credentials.

Hope this helps.

by mrtoikka

Thanks for the tips, these are all things I took for granted, but will double check. Re: cached credentials... wouldn't running a forced gpupdate avoid having to flush local credentials? Would seem like deploying software with a GPO would be pointless if I still had to go to every machine and blow away the local copy of a user's profile to install/uninstall software... defeats the purpose, no?

by tmalo627

Forcing the gpupdate should get you the desired results as well. But eliminating cached credentials isn't blowing away a local copy of the profile itself. The cached credentials are just like handstamps for the user profile to get back on to the domain without authenticating at the domain controller every time. The profile will be stored where ever it is set up to be stored (local machine or file server depending if they have roaming profiles or not).

by shasca

When I played around with app deployement on 2K3, the only way I was able to get software to autoinstall was pre boot. It had no display. It just acted like the system was frozen. This seemed to give us concern it would create panick when users saw nothing and their system seemed to be locked up. I found no way to automate the process after the desktop loaded, and the only way it worked was with an .msi file.

Is that how you remeber it working before?

We chose instead to go with an aftermarket product from KACE, called KBOX. Quite expensive, but still cheaper than sms at the time.

by mrtoikka

The way I remember it...if it was pushed for the machine, meaning anyone who logged on could use it, after loading windows...before being presented with the logon screen, a small window came up that said "installing managed software: " - If it was pushed at the user level, meaning only the users in the security group somehow linked to the GPO could use the software, after being presented with the logon screen and typing in username and pass...the same window would come up and display the same message. I don't think we used any third party software... it looked like windows to me...the windows that would display the message had the windows logon images on them and such...

by mrtoikka

Been there and done that... but the setup still does not seem to be working... I got software to push down to the computer following the steps listed in that link, but then when I tried to remove the software it wouldn't go... I made sure that as the user I ran the software on the machine before i made the change on the server, just to make sure installation completed. Nothing. If I manually un-installed the program that pushed as the user, ran a gpupdate, rebooted (while the GPO was still in effect on the server) the software would not automatically re-install...

by shasca

That sounds about what I saw. Been a year or so. You need an .msi file for any app you want to deploy. There is an area for software ditribution in GP. I was pretty sure I saw that in the documentation I linked to for you. It does what we are both talking about. SMS, and MOM were MS server apps that enhanced the ability to deploy since GPO deployment is so clunky. But it is free if you buy Server 2003.

(One more try to get you the right deployment info.because it can be done.)

http://www.windowsnetworking.com/articles_tutorials/Group-Policy-Deploy-Applications.html

by mrtoikka

Haha, I've read that link before too. I am using .msi files...I'm also glad you're remembering the same things I saw - and yes it did take a while for some software. It would just sit there with the same name for a while...but if memory serves correct, windows displayed a moving orange/blue gradient bar that indicated that the machine had not yet completely locked up which kept our employee's sanity. Did you ever try creating a security group, and placing it under the security for the GPO? then adding and removing users from that? That's what I thought would work, and I believe I did get software to install doing that, but when i remove a user from that security group the software does not uninstall from the computer. Even after a forced gpupdate and a reboot. The package I created was an assigned package. I wonder if maybe there should be another group that the user should be placed in specifically for the purpose of removing software, while the group for installing takes precedence...that way when the user gets removed the permissions from the denied software group take over and remove the software? that's a pretty glitchy thing for MS to do... ideas?

by shasca

You can create a second install package with the same .msi file. When you run an .msi file for a program that is already installed it triggers a prompt for repair uninstall (depending on package design). Most .msi files have switches that can be added to run specific functions, such as uninstall. Those also differ from each software developer.

This site has alot of excellent .msi info

http://www.appdeploy.com/

by mrtoikka

I see - my mistake. check out my post "re: hhmmm" in response to sascha. Ideas??

by mrtoikka

Just wanted to come back and report I figured it out...What I had to do was create the normal GPO as assigned software...in the security for the software GPO, remove the authenticated users group, and add the security group I created for the specific software users. Also make sure to check the fall out of scope option in the software GPO. The problem I was having was with Vista. I tried this out on Win XP and it worked perfectly fine. Another point lost for Vista... Also for those curious...all my GPOs were linked to the top of the domain tree...and I created an OU titled "software" under the tree, and put the security groups in there. Hope this helps someone.

This discussion is closed to new replies.