Systems Management

ORIGINAL: Bladerun

Just started a new packaging job, and they use GPO to deploy packages. I came from an SMS environment, so I feel like my hands are tied in comparison. :(

Couple basic questions:

- When apps are installed via GPO, are they installed with user rights?

- ^ if thats the case, is there a way to install them as local admin short of hacking the registry?

- What are some good resources to learn more about this (besides google)?

- Can I use GPO to install an msi from an administrative install (ie uncompressed)?

- Is it just my lack of knowledge, or is GPO very limited in its software deployment abilities?


Thanks.



Apps do not install with user rights unless they are published to a user account and not assigned to a computer account.
There is an Elevated priviledges applications launcher provided by Microsoft, it can be useful
http://www.microsoft.com/technet/prodtechnol/windows2000serv/downloads/epal.mspx
Appdeploy is one of the best resources for packaging, but lacks the meat and potatoes when it comes to high detail in GPO deployment, I suggest you check these sites:

http://grouppolicy.editme.com/
http://www.gpanswers.com/community/
http://www.gpoguy.com/

You can only use a GPO to deploy software that is in MSI format, therefore if your administrative install is MSI based then you may be able to create a transform file to deploy it, if it is Setup.exe based and supports silent install and uninstall switches then I suggest you take a look at Windows Installed Wrapper Wizard (WIWW), it can be found here:
http://www.sywan.nl/metatraffic2/track.asp?mtr=/download/WIWW_0.0.0.1.zip
These guys also make a utility that allows you to modify the order in which multiple applications in a single GPO are installed, this can also be very useful:
http://www.sywan.nl/metatraffic2/track.asp?mtr=/download/ASSM_0.3.zip

Be sure to do you homework before just jumping into this stuff, the last thing you want to do is to create dirty packages, or non functional packages.

Good Luck,

Chad

Good info, thanks.

I'm going to buy some books tonight to learn more about this.

One more thing...

What permissions are used an app is installed via GPO? If its not user privleges, can I assume local Admin?

I actually won't be working with GPO that much, more on the packaging side. I just need to know if there's any limitations as to where on the hard drive or in the registy I can drop files/keys.

You cannot assume Local admin, but you could assume System. It all depends if the user initiates the install or not. I personally assign software to machines and not to users, this way the software automatically installs before the login screen is even presented to the user, in this case it installs as the local system account.

That's what I needed to know.

I should have specified that we will also be assigning per computer rather than per user.