The steps involved in creating Group Policy Software
Installation policies are as follows:
-
Plan an AD DS strategy.
-
Create a software distribution point.
-
Configure Software Installation defaults.
-
Create Software Installation package policies.
-
Configure Software Installation package properties.
Planning an AD DS Strategy
When planning a Group Policy application deployment, you must
review your organization’s software requirements and compare them to
your AD DS organizational structure and your available Group Policy
Objects (GPOs). With this information, you can determine how you
want to deploy your applications. Then create a test environment to
determine exactly how you want to assign or publish software to your
users or computers.
Some of the basic strategies for Group Policy software
deployment that you should consider are as follows:
-
Create organizational units (OUs) based on software
management, rather than security, needs. This strategy enables
you to target applications to the appropriate users.
-
Deploy software close to the root of your AD DS domain.
Deploying software high in the domain hierarchy makes it easier
to provide all of the users in an organization with access to an
application. This reduces administration because you can deploy
the package using a single GPO rather than having to re-create
the object in multiple containers deeper in the AD DS
hierarchy.
-
Deploy multiple applications with a single GPO. In
organizations where users share the same core set of
applications, this practice reduces administration overhead by
enabling you to create and manage a single GPO rather than
multiple GPOs. Also, the user logon process is faster because a
single GPO deploying multiple applications processes faster than
multiple GPOs each deploying one application.
-
Publish or assign applications only once to a given group
of users or computers. Deploying the same application in
multiple configurations is sometimes necessary to support
different types of users. However, you should avoid deploying
multiple copies of the same application in such a way that users
are forced to decide which version they need. Instead, adjust
your deployment strategy wherever possible so that each
configuration is delivered only to the users and computers that
need it.
Creating a Software Distribution Point
A software distribution point is a location on a shared
network drive on which you store the packages you intend to deploy
using Group Policy. When you create a Software Installation policy,
the package you specify is not actually stored in the AD DS
database. The GPO contains only a pointer to the package’s location.
Therefore, the package must be accessible, not only to the computer
where you are running the Group Policy Management Editor, but also
to the computers and users who are to receive it.
You can create multiple distribution points or a single
distribution one for all of your packages as long as you create
separate folders for each application and each version. Configure
the share and NTFS permissions so that administrators have Read and
Write access to the distribution point. Users need only Read
access.
Configuring Software Installation Defaults
The Properties sheets for the Software Installation folders in
Group Policy Management Editor contain configuration settings that
apply to all of the package policies you create in that folder. Some
of the settings establish defaults for parameters you can customize
on individual policies, as shown in Figure 1, while others
enable multiple applications deployed by the same GPO to
coexist.
For example, the File Extensions tab, shown in Figure 2, enables you
to establish priorities for the file associations created by the
deployed applications. If you install two applications that both
create associations for the same file extension, you can specify
which one of the applications should launch when a user opens a file
with that extension.
Creating Software Installation Package Policies
When you browse to the Software Installation folder
under Computer Configuration or User Configuration, right-click it,
and select New | Package from the context menu, you must first
browse to the software distribution point you created and select the
package file you want to deploy. After you do this, the Deploy
Software dialog box appears, as shown in Figure 3, in which you can specify
whether you want to assign or publish the package. When you deploy a
package to computers (as opposed to users), the Published option is
unavailable, and if you select the Advanced option, the package’s
Properties sheet appears.
Caution
MAINTAINING
LICENSES
You must have the appropriate software licenses for
applications written by independent software vendors that you
distribute using Group Policy policies. It is your responsibility
to match the number of users who can access and use the software
to the number of licenses you have on hand. It is also your
responsibility to verify that you are working within the license
agreement included by each independent software vendor.
Configuring Software Installation Package Properties
Double-click a policy package (or select the Advanced option
in the Deploy Software dialog box) to open its Properties sheet, as
shown in Figure 4. On the
Deployment tab, you can switch between Assign and Publish, as well
as configure the following parameters:
-
Auto-Install This Application
By File Extension Activation. Select this check box to use the application precedence
for file name extensions as determined on the File Extensions
page of the Software Installation Properties sheet. When you
deploy the package to computers, the check box is selected and
grayed out because the application is installed automatically
by default.
-
Uninstall This Application When
It Falls Out Of The Scope Of Management. Select this check box to remove the application
at logon (for users) or startup (for computers) if they move
to a site, domain, or OU for which the application is not
deployed in a GPO.
-
Do Not Display This Package In
The Add/Remove Programs Control Panel. Select this check box to specify that this package
should not be displayed in the Get Programs control panel (in
Windows 7 or Windows Server 2008 R2) or the Add Or Remove
Programs control panel.
-
Basic. Select this option to provide only a basic display to
users during the installation process.
-
Maximum. Select this option to display all installation messages
and screens to users during the package installation.
The Properties sheet also includes the following
additional tabs:
-
Upgrades. Enables you to designate packages as upgrades to other
packages already deployed
-
Categories. Enables you to specify the category under which the
package is listed in the Get Programs or Add Or Remove
Programs control panel
-
Modifications. Enables you to add MST package files containing
installation modifications to an existing package
deployment
-
Security. Enables you to specify permissions that control access
to the package you are creating
Note
CHOOSING A LOCAL DEPLOYMENT
METHOD
It is up to each organization to decide which local
application deployment method is best suited to its skills and its
needs. With Group Policy, the deployment process is free and
relatively simple, but the package creation process can be quite
complex. With SCCM 2007, creating packages is a relatively
straightforward process, but installing the SCCM infrastructure is
complicated and expensive.
