Software Deployment

Also would anyone happen to know if I created a MSI package for say Starcraft and made a group policy for that package to be installed on login. Would that work even of the user did not have loacl admin privaledges?

1) Yes, but don't get into making MSIs until you know you can justify the cost savings of making one and the grey area of self healing savings. Making MSIs can eat time which in turn costs money and also most good MSI tools are expensive.

2) Read some high level documents about deploying MSIs. In short yes but there are some system configuration conditions.

Well our biggest problem is our users need to install applications and we dont want to give them System Admin priv. or Power User becuase the users tend to install other software on their own that has brought down othe computers or servers before. The catch is if our users cant install apps when they need to production may be effected. So we will have spend time doing 1 of 2 things. Wither Creating MSIs or giving users install rights then constantly scanning the network for unauthorized software and doing uninstalls. Any thoughts?

The best direction for you is dependent on a few factors that you did not mention. First off, how many users are we talking about? If you're talking 20-30, MSI probably isn't for you. The initial investment required to repackage won't be recovered down the line. Keep in mind that the industry standard for repackaging software is 1.6 applications per person per week, and that's if you know what you're doing and have the good (and expensive) tools. If you do not have anyone skilled in repackaging, or have a $3500 repackaging tool, expect to learn a few things the hard way; most notably how the Self-Repair feature of MSIs can conflict and cause applications to "fight", each trying to "fix" the other every time its launched. Repackaging is not a step 1, step 2, step 3 thing. Experience of the packaging staff makes a huge difference in quality. It also requires a rather substantial initial investment to really do it right. Well worth it in a 1000+ user environment where the reduced long-term TCO is substantial, but not in a small office that can be supported by a single person.

As for the group policies to do proper elevated installs independantly of the user you will likely have to get a Windows Server 2003 infrastructure to support the more complete set of MSIEXEC behavior policies. I cannot really give you a how to because I do not have good documentation on how these policies ultimately behave and the client I am with is not too concerned about looking at revising their current MSIExec policies. However Microsoft does have a Windows Server 2003 Group Policy reference but I find the explanation of some of the MSIExec policies to be lacking. So I guess you might be left with the old trial and error method.

Would that work even of the user did not have loacl admin privaledges

Regarding your question about apps working even if users are not local admins...

This is a very typical enterprise issue. In my experience, more and more companies are locking down their users to minimize support costs.

As to your specific question:

1) unless you have specifically disabled this, MSIs install with elevated rights, so modifying/adding files or reg keys won't be prohibited during installation.

2) some applications may require access to files/keys that ARE locked down, so it's important to have the installation actually grant rights to those files/keys. Wise Package Studio allows this, or you can use command-line utilites like XCacls and RegDacl to do it (again, during installation when the install has admin rights and CAN change permissions)>

3) One more basic suggestion - to figure out WHICH files/keys an app uses (so you can change permissions on them), use RegMon and FileMon - both free from SysInternals.com.

Good luck!

- Sean Roberts