Installing Software Using GPO

http://www.youtube.com/watch?v=jXAz6vrWMP0&feature=related

Steps to prepare computers to install Symantec Endpoint Protection 12.1 client

http://www.symantec.com/business/support/index?page=content&id=TECH163112

Problem

You must prepare your computers for installation before you install Symantec Endpoint Protection 12.1 client.

Solution

These instructions apply to both the Enterprise and Small Business Editions of Symantec Endpoint Protection 12.1 client. For more specific details at any point, please consult the product help or the implementation guides: Symantec Endpoint Protection Implementation Guide or Symantec Endpoint Protection Small Business Edition Implementation Guide

The following steps should be taken on all computers on which you install the client.

Uninstall currently installed virus protection software

Uninstall any third-party virus protection software. In general, you can use the Windows Add or Remove Programs tool to uninstall programs. However, some programs have special uninstallation routines. See the documentation for the third-party software.

Uninstall any legacy Symantec virus protection software if you do not plan to migrate the settings.

Set administrative rights to your client computers

To install the client software, you need administrative rights to the computer or to the Windows domain. If you do not want to provide users with administrative rights to their computers, use Remote Push Installation to remotely install the client software. Remote Push Installation requires you to have local administrative rights to the computers.

Prepare computers for remote deployment and management

Modify firewall settings to allow communication between Symantec Endpoint Protection Small Business Edition components:
■ Push deployment ports, used on management servers and clients: TCP 139 and 445, UDP 137 and 138, and TCP ephemeral ports.
■ For legacy communications, open UDP port 2967 on all computers.
■ General communication: TCP 8014 (HTTP)/TCP 443 (HTTPS) for management servers. These are the default ports, and may be customized. See Symantec Endpoint Protection 12.1: How to Change the ports used for communication between the Manager and clients.

Prepare Windows XP computers that are installed in workgroups: Windows XP computers that are installed in workgroups do not accept remote deployment. To permit remote deployment, disable Simple File Sharing. Note: This limitation does not apply to computers that are part of a Windows domain. Detailed instructions are provided in the following document: http://www.symantec.com/business/support/index?page=content&id=TECH102867

Prepare Windows Vista, Windows Server 2008, or Windows 7 computers: Windows User Access Control blocks local administrative accounts from remotely accessing remote administrative shares such as C$ and Admin$. Perform the following tasks:
■ Disable the File Sharing Wizard.
■ Enable network discovery by using the Network and Sharing Center.
■ Enable the built-in administrator account and assign a password to the account.
■ Verify that the account has administrator privileges.

Prepare Windows Server 2003 computers for installation using a remote desktop connection: The Symantec Endpoint Protection Manager requires access to the system registry for installation and normal operation. To prepare a computer to install Symantec Endpoint Protection Manager using a remote desktop connection, perform the following tasks:
■ Configure a server that runs Windows Server 2003 to allow remote control.
■ Connect to the server from a remote computer by using a remote console session, or shadow the console session.

Article URL http://www.symantec.com/docs/TECH163112

pushing out software that "requires" admin rights

http://social.technet.microsoft.com/Forums/en-NZ/winservergen/thread/1aecdac4-c274-4d14-85ea-432a9674f70d

How did you create a Distribution point ?
To publish or assign a computer program, you must create a distribution point on the publishing server (I am sure, you must have done that already)
However, FYI... Here are the steps

create a distribution point
Log on to the desired server  as an administrator.
Create a shared network folder where you will put the Microsoft Windows Installer package (.msi file) that you want to distribute.
Set permissions on the share to allow access to the distribution package.(Authenticated Users should have READ permissions)
Copy or install the package to the distribution point.
Assign a Package
Computer configuration / Policies / Software Settings / Software installation
Right-click Software installation, point to New, and then click Package.
In the Open dialog box, type the full Universal Naming Convention (UNC) path of the shared installer package that you want. For example, \\FileServer\Share\software.msi

Important: Do not use the Browse button to access the location. Make sure that you use the UNC path to the shared installer package.
Click Open.
Click Assigned, and then click OK. The package is listed in the right pane of the Group Policy window.
Close the Group Policy snap-in, click OK, and then quit the Active Directory Users and Computers snap-in or gpmc.
When the client computer starts, the managed software package is automatically installed.
Along with Software Distribution policy, you can set another policy "Always install with elevated privileges"
User Configuration\Administrative Templates\Windows Components\Windows Installer 
This policy directs Windows Installer to use system permissions when it installs any program on the system.

This policy extends elevated privileges to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add/Remove Programs in Control Panel. This policy lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.

If you disable this policy or do not configure it, the system applies the current user's permissions when it installs programs that a system administrator does not distribute or offer.

Caution : Skilled users can take advantage of the permissions this policy grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this policy is not guaranteed to be secure.

 Important: This policy appears both in the Computer Configuration and User Configuration folders. To make this policy effective, you must enable the policy in both folders.
Hope that helps.

---

How to assign software to a specific group by using Group Policy in Windows Server 2003

http://support.microsoft.com/kb/324750

System TipThis article applies to a different version of Windows than the one you are using. Content in this article may not be relevant to you. Visit the Windows 7 Solution Center

This article was previously published under Q324750

For a Microsoft Windows 2000 version of this article, see 302430

(http://support.microsoft.com/kb/302430/EN-US/ )

.

Expand all | Collapse all

On This Page

• SUMMARY
  • Assign a program to a group
• Properties
• Give Feedback

SUMMARY

You (as an administrator) can use Group Policy to assign or to publish software to users or computers in a domain. Additionally, it is useful to be able to deploy software based on group membership. A Group Policy object (GPO) is usually applied only to members of an organizational unit (OU) to which the GPO is linked. Because a user cannot be located in several OUs at the same time, you must be able to apply Group Policy settings outside the boundaries of OUs. This article describes how to have your software deployment policy applied to users who are not in an OU.

Assign a program to a group

1. Create a folder to hold the Windows Installer package on a server. Share the folder by applying permissions that let users and computers read and run these files. Then, copy the MSI package files into this location.
2. From a Windows Server 2003-based computer in the domain, log on as a domain administrator, and then start Active Directory Users and Computers.
3. In Active Directory Users and Computers, right-click the container to which you want to link the GPOs, and then click Properties.
4. Click the Group Policy tab, and then click New to create a new GPO for installing the Windows Installer package. Give the new GPO a descriptive name.
5. Click the new GPO, and then click Edit.
   
   The Group Policy Object Editor starts.
6. Right-click the Software Settings folder under either Computer Configuration or User Configuration, point to New, and then click Package.
   
   Notes
   • The Software Settings folder under Computer Configuration contains software settings that apply to all users who log on to the computer. This folder contains software installation settings. It may also contain other settings that are put there by independent software vendors.
   • The Software Settings folder under User Configuration contains software settings that apply to users regardless of which computer they log on to. This folder also contains software installation settings. It may contain other settings that are put there by independent software vendors.
7. In the Open dialog box, type the Universal Naming Convention (UNC) path of the Windows Installer file (.msi) for this package in the File name box, and then click Open.
   
   Note If the Windows Installer file resides on the local hard disk, do not use a local path. Instead, use the UNC path of the local computer to indicate the location of the installation files. A UNC path takes the form \\servername\sharename\path\filename.msi.
8. In the Deploy Software dialog box, do one of the following:
   • Click Assigned to specify that the application is deployed as assigned and that default settings are used for deployment properties.
   • Click Advanced to specify that you are manually editing the package properties instead of accepting the defaults. You can also choose between assign and publish for the deployment method.
9. When you are prompted to choose between Advanced and Assigned, click Assigned unless you have to modify the advanced options.
10. Click OK.
    
    The software package appears in the details pane of the Group Policy Object Editor.
11. Close the Group Policy Object Editor.
12. In the GPO Properties dialog box, click the GPO, and then click Properties.
13. Click the Security tab.
14. Click Authenticated Users in the Group or user names list, and then click Remove.
15. Click Add, select the security group that you want this policy applied to, and then click OK to add the security group to the list.
16. Select the security group, and then under Permissions for Users, click to select the READ and the Apply Group Policy check boxes in the Allow column.
17. Click Apply, click OK, click Apply, and then click OK.

Changes to a GPO are not immediately applied on the target computers. Instead, changes are applied according to the current Group Policy update interval. You can use the Secedit.exe command-line tool to impose GPO settings upon a target workstation immediately. For more information about how to use Secedit.exe, see the Windows Server 2003 Help and Support Center.

How to assign software to a specific group by using Group Policy

http://support.microsoft.com/kb/302430

System TipThis article applies to a different version of Windows than the one you are using. Content in this article may not be relevant to you. Visit the Windows 7 Solution Center

This article was previously published under Q302430

For a Microsoft Windows Server 2003 version of this article, see

324750

(http://support.microsoft.com/kb/324750/ )

How to assign software to a specific group by using Group Policy in Windows Server 2003

Notice

This article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center

(http://support.microsoft.com/?scid=http%3a%2f%2fsupport.microsoft.com%2fwin2000)

is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy

(http://support.microsoft.com/lifecycle/)

.

Expand all | Collapse all

On This Page

• SUMMARY
  • Assign a program to a group
• REFERENCES
• Properties
• Give Feedback

SUMMARY

You can use Group Policy to assign or to publish software to users or computers in a domain. Additionally, it is useful to be able to deploy software based on group membership. A Group Policy object (GPO) is usually applied only to members of an organizational unit (OU) to which the GPO is linked. Because a user cannot be located in several OUs at the same time, you must be able to apply Group Policy settings outside the boundaries of OUs. This article describes how to have your software deployment policy applied to users who are not in an OU.

Assign a program to a group

1. Create a folder to hold the MSI package on a server. Share the folder by applying permissions that let users and computers read and run these files. Then, copy the MSI package files into this location.
2. From a Windows 2000-based computer in the domain, log on as a domain administrator, and then start Active Directory Users and Computers.
   
   Note You can apply Group Policy settings to domains, sites, and OUs.
3. In Active Directory Users and Computers, right-click the container to which you want to link the GPO, click Properties, and then click the Group Policy tab.
4. Create a new GPO for installing your MSI package, and then give the new GPO a descriptive name.
5. While the new GPO is selected, click Edit. This starts the Group Policy Object Editor.
6. Open and then right-click Software installation in the GPO, and then click New Package.
7. You are prompted for the path of the Windows Installer file (.msi) for this package. View the network location that contains the Windows Installer file, click the file, and then click Open.
   
   Warning If the Windows Installer file resides on the local hard disk, do not use a local path. Instead, use the UNC path of the local computer to indicate the location of the installation files. A UNC path takes the form \\servername\sharename\path\filename.msi.
8. When you are prompted to choose between Assigned and Advanced Published or Assigned, click Assigned unless you have to modify the advanced options. You should now see the software package in the details pane of the Group Policy Object Editor.
9. In Active Directory Users and Computers, click the container to which you linked your GPO. Right-click that container, click Properties, and then click the Group Policy tab.
10. Click your GPO, and then click Properties.
11. Click the Security tab, and then remove Authenticated Users from the list.
12. Click Add, and then select the security group which you plan to have this policy applied to add it to the list.
13. Select your security group, and then give them Read and "Apply Group Policy" permissions.

Changes to a GPO are not immediately applied on the target computers. Instead, changes are applied according to the current Group Policy update interval. You can use the Secedit.exe command-line tool to impose GPO settings upon a target workstation immediately. For more information about how to use Secedit.exe to force a Group Policy update, click the following article number to view the article in the Microsoft Knowledge Base:

227302

(http://support.microsoft.com/kb/227302/ )

Using SECEDIT to force a Group Policy refresh immediately

Converting exe to msi

http://www.advancedinstaller.com/

WinInstall 7.50 free download - convert exe into msi

http://www.symantec.com/business/support/index?page=content&id=TECH18273

How to assign software to a specific group by using Group Policy in Windows Server 2003

http://support.microsoft.com/kb/324750

System TipThis article applies to a different version of Windows than the one you are using. Content in this article may not be relevant to you. Visit the Windows 7 Solution Center

This article was previously published under Q324750

For a Microsoft Windows 2000 version of this article, see 302430  . 

On This Page

Expand all | Collapse all

SUMMARY

You (as an administrator) can use Group Policy to assign or to publish software to users or computers in a domain. Additionally, it is useful to be able to deploy software based on group membership. A Group Policy object (GPO) is usually applied only to members of an organizational unit (OU) to which the GPO is linked. Because a user cannot be located in several OUs at the same time, you must be able to apply Group Policy settings outside the boundaries of OUs. This article describes how to have your software deployment policy applied to users who are not in an OU.

Back to the top

Assign a program to a group

1. Create a folder to hold the Windows Installer package on a server. Share the folder by applying permissions that let users and computers read and run these files. Then, copy the MSI package files into this location.
2. From a Windows Server 2003-based computer in the domain, log on as a domain administrator, and then start Active Directory Users and Computers.
3. In Active Directory Users and Computers, right-click the container to which you want to link the GPOs, and then click Properties.
4. Click the Group Policy tab, and then click New to create a new GPO for installing the Windows Installer package. Give the new GPO a descriptive name.
5. Click the new GPO, and then click Edit.
   
   The Group Policy Object Editor starts.
6. Right-click the Software Settings folder under either Computer Configuration or User Configuration, point to New, and then click Package.
   
   Notes
   • The Software Settings folder under Computer Configuration contains software settings that apply to all users who log on to the computer. This folder contains software installation settings. It may also contain other settings that are put there by independent software vendors.
   • The Software Settings folder under User Configuration contains software settings that apply to users regardless of which computer they log on to. This folder also contains software installation settings. It may contain other settings that are put there by independent software vendors.
7. In the Open dialog box, type the Universal Naming Convention (UNC) path of the Windows Installer file (.msi) for this package in the File name box, and then click Open.
   
   Note If the Windows Installer file resides on the local hard disk, do not use a local path. Instead, use the UNC path of the local computer to indicate the location of the installation files. A UNC path takes the form \\servername\sharename\path\filename.msi.
8. In the Deploy Software dialog box, do one of the following:
   • Click Assigned to specify that the application is deployed as assigned and that default settings are used for deployment properties.
   • Click Advanced to specify that you are manually editing the package properties instead of accepting the defaults. You can also choose between assign and publish for the deployment method.
9. When you are prompted to choose between Advanced and Assigned, click Assigned unless you have to modify the advanced options.
10. Click OK.
    
    The software package appears in the details pane of the Group Policy Object Editor.
11. Close the Group Policy Object Editor.
12. In the GPO Properties dialog box, click the GPO, and then click Properties.
13. Click the Security tab.
14. Click Authenticated Users in the Group or user names list, and then click Remove.
15. Click Add, select the security group that you want this policy applied to, and then click OK to add the security group to the list.
16. Select the security group, and then under Permissions for Users, click to select the READ and theApply Group Policy check boxes in the Allow column.
17. Click Apply, click OK, click Apply, and then click OK.

Changes to a GPO are not immediately applied on the target computers. Instead, changes are applied according to the current Group Policy update interval. You can use the Secedit.exe command-line tool to impose GPO settings upon a target workstation immediately. For more information about how to use Secedit.exe, see the Windows Server 2003 Help and Support Center.

227302  Using SECEDIT to force a Group Policy refresh immediately

HOW TO CREATE A SECURITY PATCH GPO

http://www.windowsitpro.com/article/tips/jsi-tip-4989-how-do-i-use-group-policy-to-apply-security-patches-in-windows-2000-#4

JSI Tip 4989. How do I use Group Policy to apply security patches in Windows 2000?

Jerold Schulman

Windows IT Pro

InstantDoc ID #76295

Rating: (0)

inShare

NOTE: The text in the following Microsoft Knowledge Base article is provided so that the site search can find this page. Please click the Knowledge Base link to insure that you are reading the most current information.

Microsoft Knowledge Base article Q314273 contains:

IN THIS TASK

• SUMMARY

How to Create a Security Patch .msi Package

How to Create a Security Patch Distribution Point

How to Create a Security Patch GPO

• REFERENCES

SUMMARY

This step-by-step article describes how to use Group Policy to apply security patches. You must be a member of the Administrators group on a computer that is running either Windows 2000 Server or Windows 2000 Advanced Server to perform all of the procedures that are described in this article.

NOTE : Download the security patches that are referred to in this article before you start the procedures that are described in this article.

back to the top

HOW TO CREATE A SECURITY PATCH .MSI PACKAGE

NOTE : You use Windows Installer to convert the .exe patch file to an .msi file. Windows Installer is located at the following path on the Windows 2000 installation media.

Valueadd\3rd Party\Mgm\Winstle\Swiadmle.msi

1. Click Start , point to Programs , point to Veritas Software, and then click Veritas Discover .



2. Click Next .



3. Type either the name of the patch or a general label (for example, type security patches ) in the Specify the name of the application for which you are building the installation box.



4. Type the path to the new package and the name for the new package (for example, typec:\adminpackages\securitypatch.msi ) in the Specify the Path and file name for the data file where the information on this installation will be kept box, and then click Next .



5. Click the drive on which you want to store the temporary work files for Windows Installer, and then click Next .



6. Under Available Drives , click the drive on which you want to install the .msi package, click Add , and then click Next .



7. Accept the defaults, and then click Next .



8. Wait for the program to take a snapshot of your computer (this action may take several minutes depending on the size of your computer), and then click OK when this action is completed.



9. In the Look in box, click the location of the .exe file that you want to convert, and then click Open .



10. After the .exe file completes the installation, click Reboot Later , and then run Windows Installer again.
    
    NOTE : Do not restart the computer after the .exe file completes the installation.



11. Click Start , point to Programs , point to Veritas Software, and then click Veritas Discover .



12. Click Perform the After snapshot now , and then clickNext .
    
    Windows Installer takes the After snapshot, and then creates the new .msi file in the specified location.


NOTE : You receive an error message if problems occur during the conversion process. If you receive an error message, you may have to repeat this procedure to convert the .nai file to an .msi file.

back to the top

HOW TO CREATE A SECURITY PATCH DISTRIBUTION POINT

1. Click Start , point to Programs , point to Administrative Tools , and then click Computer Management .



2. Right-click Computer Management (Local) , and then clickConnect to another computer .



3. Click the computer on which the patch package is located in the Name box, and then click OK .



4. In the console tree, click to expand System Tools , click to expand Shared Folders , right-click Shares , and then clickNew File Share .



5. Type the path to the patch package distribution point in theFolder to share box.



6. Type the name for the distribution point in the Share namebox.



7. Type a description for the distribution point in the Share description box.



8. Click Next , and then click Yes to create the shared folder.



9. Click Finish .



10. Click No when you receive the message that asks if you want to create another shared folder.

back to the top

HOW TO CREATE A SECURITY PATCH GPO

To create a security patch Group Policy object (GPO):

1. Click Start , point to Programs , point to Administrative Tools , and then click Active Directory Users and Computers .



2. Right-click your domain name, and then click Properties .



3. Click the Group Policy tab, and then click New .



4. Type the name of the new GPO (for example, type Security Patches ) in the Group Policy Objects Links box (replace the existing name).



5. Click the newly created GPO, and then click Edit .



6. In the console tree, under the User Configuration node, click to expand Software Settings .



7. Right-click Software Installation , point to New , and then click Package .



8. In the Look in box, type the Universal Naming Convention (UNC) name for the security patch package Setup program that you created in the "How to Create a Security Patch .msi Package" section, and then click Open .
   
   NOTE : If Windows does not use the UNC name to locate the security patch .msi package, you receive the following message:




Cannot verify path is a network location message. If this package is not available on a network share, client are not able to install it. Are you sure you want to deploy this package.

9. Click Assigned in the Deployment Method box, and then click OK .



10. In the Group Policy dialog box, click Software Installation , right-click the GPO that you created in step 4 in the details pane, and then click Properties .



11. Click the Deployment tab, and then click Auto-install this application by file extension activation in the Deployment Options box.

back to the top

REFERENCES

For additional information about the procedures that are described in this article, click the article numbers below to view the articles in the Microsoft Knowledge Base:

Q224330 Assigning a Windows Installer Package with Minimal Interaction

Q302430 How to Deploy Software to a Specific Group By Using a Group Policy

back to the top

Related Content:

• Get Updates on Microsoft Updates
• Protect AD from Administrative Errors
• The Reader to Reader 'Tool Time' Reference
• Tool Time: 175 Free Tools for the Taking
• Tool Time: Export PDF Text with Pdftotext

如何远程安装Windows软件[译文135]

http://louishan.com/articles/how-to-remote-install-windows-software.html

以前我总是不得不直接在每台电脑上安装应用程序，至少要说这是很耗费时间的工作。后来我开始使用 Windows 2000 下的 Dameware 帮助我远程安装应用程序，软件不仅价格昂贵而且还难以使用。

        然后随着 Windows XP 专业版的发布，系统自带了远程桌面功能，我可以远程登陆每台机器来安装 Windows 程序，不过这仍然很耗费时间。现在我可以自动向电脑分发应用程序，还可以向用户分发应用程序，这样不管用户是不是在我的域中，都可以获取到需要的软件。

        下面我将做一个 Windows Microsoft Office 软件的远程安装，告诉你怎么进行。首先你要安装的软件必须有一个 MSI 文件进行部署，MSI 文件简单说就是一个微软安装工具。如果没有的话有很多方法可以创建。当获得 MSI 文件之后，我们可以创建符合要求模板选择需要的选项，这可以帮助我们设定安装过程自动进行。

        当你有成千上万的电脑需要处理，每天电脑有成百上千的需求，这样做是非常必要的。现在我们可以用 OU 或者说叫做组织单元部署应用程序。

首先我们打开活动目录用户和计算机帐户。

选择你想要向谁部署应用程序，右击那个 OU 选择属性。

点击窗口右上角的组策略标签页，然后需要点击打开进入管理界面。

不管在 OU 中你是点击的计算机还是用户，都会得到响应。也就是说他们会让软件部署到自身。

接下来回到下面的屏幕。

这个是组策略管理界面。两个步骤之前你选择的 OU 会在左侧高亮显示，分发给它的任何策略会在右侧面板显示。你可以看到我有一个 GPO（组策略对象） 叫做 OfcStd，是我的 Office Standard 缩写。

这个组策略分发 Office 2003 标准版到这个 OU 里面的所有计算机。现在让我们从头开始看看是怎么工作的。

右击这个 OU 并选择在这里创建和连接一个GPO。

这会引导你到达一个为 GPO 命名的屏幕，如下所示。

为你的 GPO 起一个易于理解的名字.我将自己的命名为测试软件安装。这将会带我们回到同一个屏幕，增加了新添加的空 GPO。你需要右键点击然后选择编辑。

点击编辑之后会打开组策略对象编辑器。根据你是要将软件分发给计算机还是用户（计算机总是会安装到同一台机器，用户会跟随其正在使用的机器），展开 计算机配置→ 软件设置 或者 用户配置→软件设置，如下所示。

点击软件设置文件夹下面的软件安装项之后会看到如下。

右击右侧面板，如上图所示选择新建→软件包。

        选择 Office 2003 便准版安装文件 STD11.msi，就搞定了。就是这么简单！你已经学会了部署第一个软件安装包，试想如果使用合理这将节省多少时间！

        如果你上面选择的是用户配置，你可以登陆其中的一个用户进行测试；如果你选择的计算机配置，需要使用 OU 中的一台计算机登录。有时候需要重启计算机或者极端情况下重启两次才能看到程序安装。当你成功之后，登入系统直接就可以看到一个界面，告知你安装部署好的应用程序。是不是很酷？

How To Do A Remote Install Of Windows Software

http://www.makeuseof.com/tag/remote-install-windows-software/

I have recently covered how to create your own Windows domain and how to push out group policy to your domain computers. Today we will visit how to remote install Windows software on your domain computers using group policy.

In the past I have had to install applications directly on each user’s computer. This was time consuming to say the least. Then I started using Dameware for Windows 2000 that helped me remotely install applications. It was far from free and was difficult to use.

Then Remote Desktop came around with Windows XP Professional and I was able to remotely log into each machine and install the  Windows applications. This was still time consuming. Now I am able to assign applications to computers automatically. I can also assign applications to users so no matter where they are on my domain they will have the software they need.

I do a remote install our Windows Microsoft Office software, and I will show you how. The application that you want to install will need to have a MSI file to deploy it. An MSI file is simply a Microsoft installer. If you do not have one there are methods to creating one like this. Once you have the MSI file we can create answer templates to choose the options we want to pick. This helps us customize the installations while keeping it automated.

When you are dealing with thousands of computers with hundreds of different requirements this is a necessity. Now we can use our OUs or organizational units to deploy applications.

Ads by Google

Download Google Chrome www.google.com/chrome
Searching is fast and easy with Google's web browser.

Best 10 Web Hosting 2011 www.Consumer-Rankings.com/Hosting
Compare and Buy Top10 Web Hosting ! Free Setup & Domain, from $4.95/m

Web Hosting Service Provider www.hostway.com
100GB Web Space Unlimited Monthly Traffic

Simple Project Management www.launchcycle.com
Manage tasks, teams and projects simply with LaunchCycle.

Let’s open up our Active Directory Users and Accounts.

Pick who you want to deploy the applications to.  Right click on that OU and choose properties.

Then click on the group policy tab at the top right of the window and then we need to clickopen to get to the management interface.

Whatever is in the OU you choose, computers or users, they will all be affected. In this situation it means they will have the software deployed to it.

We will next be taken to this screen:

This is called the group policy management screen.  The OU you selected two steps back will be highlighted on the left hand side and any policies assigned to it will appear in the right pane. You can see I have a GPO called OfcStd, which is my shorthand for Office Standard.

This group policy deploys Office 2003 standard to the machines in this OU. Now let’s see how to do it from scratch.

Right click on the OU and choose create and link a GPO here.

That will take you to a screen that will ask you to name your GPO. It looks like this:

Name your GPO something that is helpful in understanding what it does. I named mine test software installation. That will take us to the same screen with the new blank GPO added. You will want to right click on it and choose edit like so:

After clicking edit we will be in the group policy object editor. Depending on if you want the software assigned to the computer or the user (computer will always install to the same machine and user will follow the user to whatever machine they are using). Expand eithercomputer configuration ““> software settings or user configuration software settings like you see below:

After clicking on the software installation item below the software settings folder you will see this:

Right click on the right pane and choose new ““> package as shown above.

I chose Office 2003 standard’s installer called STD11.msi. and I am done. That is really it! You have deployed your first software package. Imagine how much time this can save if used properly!

Now you can test it by logging in as a user, in that OU, if you choose the user configuration above. If you choose the computer configuration you would use a computer in that OU. Sometimes it takes a reboot and in extreme cases two to see the installation.  When you are successful you will see a screen directly after logging in telling you that it is installing your applications. How cool is that?

How do you remote install Windows software? Do you have any tips or tricks for us?