Systems Management

If you mean using the 'Upgrade' tab, I've always avoided that, as I've not always had a great deal of success with it. For GP deployments, I would recommend using one GPO per product instance, e.g. one for Acrobat Reader 9.0, another for 9.1 and so on. Users are then moved from the deployment group assigned to 9.0 to the 9.1 group, meaning that on log-on, 9.0 is uninstalled followed by 9.1 being installed. Long-winded? Yes. Reliable? Certainly.

At my last client, one product slipped through the net (you know who you are, Mr W!) and trying to force-install the next point release of the product was a total nightmare. I had to create all kinds of uninstallation MSIs, exception groups (to which the GP was denied)...as the app was a globally-delivered one, they're still even now - 4 months after we started - wading through the various BUs, trying to eliminate the last vestiges before the next point release arrives from the vendor.

VBScab u r correct, I was referring to the upgrade tab. So u use a separate GPO for the version upgrade. Do u turn off/un apply the older version and turn on/apply the new version or do u use the uninstall when GPO falls out of the scope of management?
thx again

The latter, uninstall when the user/group falls out of scope.

does anyone else have any experience/knowledge they can share?

personally i have a web apps gpo. i add stuff like shockwave, flash and java installers to this. when they expire and a new version is out, i will remove the software package from the gpo - tell it to uninstall immediately (they're actually removed at reboot of course) when prompted and then add the new installers to do fresh installs again - yeah upgrading all the time seems rather didgey to me too, and they're all small apps anyway so doesn'n take too long at boot for the apps to uninstall and reinstall.

This has worked flawlessley for me so far. You don't have to remove and re-install all installers at the same time, the GPO seems to happily live with updating as the updates come out.

I'd reccomend this path as it sounds like you're trying to do exactly as i have worked out and will simplify the number of GPOs to manage. Unless anyone has some really really valid reason why not to of course, if so, let me know!

Squeakstar, If I understand u correctly u use one GPO software installation for all your active x installations. Therefore, you'll have 3 or 4 differenent msi's(flash, reader, shock, java) in the same GPO software installation. When a a new release is available u remove the existing msi, select the option to uninstall immediatley and add the new msi to the existing web app GPO. When the computer restarts it uninstalls the old version and installs the new.
Just curious how long have you been using the current web app GPO and how approx how many uninstalls/reinstalls has it seen?
Whats the scope of your deployment?

yep you read me correctly!

It's been going for at least 18 months and gone through about 10 versions of java MSIs; shockwave and flash not quite so many, just when i notice there's a new version of one or the other and tend to check and update both at the same time.

Actually I keep Adobe Reader in a different GPO with it being a different breed of application, but i have done the same uninstall-reinstall in the same GPO. I've also used the Adobe Customization Wizard to tweek the setup too so dudes can't read PDFs directly in their browsers and not pester them with the EULA each time there's an update.

I think there's not much reason for things to go wrong unless for whatever reason, the MSI had bugs in it (java had one about 6r11ish which prevented it uninstalling correctly), or the original MSIs are unavailable for the clients computer to actually uninstall the applications.

The way I see it the GPOs are the triggers to fire the install/unistall only and all the hardwork is done by the actual MSI package and related services on the clients. I tend to keep in my "deploy" share the current MSI and the MSI's two previous versions, just in case there are some straggler clients that haven't been powered up for some time.

Again, I'm kinda self taught with this so if anyone sees any potential problems with my methodology speak up, but so far skislowski, it's been running completely fine!

Hi All,

This thread is exactly what I am trying to do as well, but I'm having trouble wrapping my head around one thing; how to uninstall a package so I can install an newer release. For Example, I've already pushed out Adobe Flash 9.x succesfully and now want to deploy Adobe Flash 10.x, but I'm unsure how to uninstall 9.x first.

VBScab,

You recommended to use the "uninstall when GPO falls out of the scope of management" option. I am looking to use this also, but I'm not sure what it means for the package to be "out of scope". Per Microsoft (http://technet2.microsoft.com/WindowsServer/en/library/817b822a-8958-4e13-91
08-81a5b4e023a61033.mspx), they state the following:

"Plan ahead for removal when you initially deploy the software. If you want the application to be removed when a GPO is no longer applicable, select the Uninstall this application when it falls out of the scope of management option. You can configure this option on the Deployment tab in the Properties dialog box. Right-click the managed software in Group Policy, and then click Properties."

I'm not sure though what is meant by "when a GPO is no longer applicable". How do I configure, or initiate rather, the GPO to be "no longer applicable"? The way I've been handling Adobe Flash updates so far was to simply replace the exising MSI in my deploy share with the latest downloaded from Adobe and making sure to rename it the same as my original deployement. I think this is causing problems though as some of my users keep getting prompted to re-install Flash every time they login and I'd like to approach my deployments with a little more granulatiy to ensure the old package is removed and the new one installed.

Sorry if that was long-winded. So to wrap up, I'm really just unsure on how to initiate the removal of an already successfully deployed app if I enable "uninstall when GPO falls out of the scope of management".

Any help that can be offered would be greatly appreciated.

Thanks,
Rob

"Plan ahead for removal when you initially deploy the software. If you want the application to be removed when a GPO is no longer applicable, select the Uninstall this application when it falls out of the scope of management option. You can configure this option on the Deployment tab in the Properties dialog box. Right-click the managed software in Group Policy, and then click Properties."

if you had the above setting in place on an OU, either you would have to delete the GPO or move the computer out of the applied OU to uninstall the software

If you just manipulated the software install section of the GPO and deleted the entry to uninstall say flash.msi you would be prompted two options:
1) leave this software in place and don't uninstall (words to that effect anyway)
2) immediately unnstall this software and prevent users from using it (words to that effect again)

selecting the 2nd of these options will uninstall the software using the MSI from your deployment share the next time computers are restarted. you can then add the new version of flash.msi to your GPO.

setup a VM and play dude!!!!

Good information everyone, thanks

For what it's worth, I've been using the upgrade tab for my Adobe reader upgrades without any problems. I'll be sure to post if that changes.
I'm going to use either VBscab recommendation of utilizing the uninstall when it fall out of scope feature or Squeakstars experience removing the msi and immediatley uninstall upon reboot for Java JRE. For some reason Java seems to leave the older version behind, with either one of these methods it should uinstall the old version. I'm not sure why Java does that?

yeah java is a bit sucky in that respect - I always remove.

JREs not at all sucky: they're designed to be able to live side-by-side. I have always left them in-situ, in order to cater for those brain-dead apps which think they require a specific version.

not ever experienced that in our place so multiple JREs sucky here [;)]

Thanks Squeakstar,

I didn't realize that I would be prompted to "Immediately uninstall" since I had never tried removing an app. I'll go your route....


.... oh, and working on my VM skills at the same time. I'm a bit of a newby there, but making progress.

Thanks again.

Nice one [:D]

It makes more sense to me to maintain a GPO instead of continuously deleting policies or moving computers/users out of OUs so they "fall out of policy scope" especially for free software. I tend to use the other option (falling out of scope) actually for those apps we have a strict number of licenses for - horses for courses at the end of the day and everyone's situation always has it's elements of uniqueness. useful to know all the options though innit !!!