Pretty basic GPO question for the more experienced

[Steve09]

Hi,

Thought this would be better suited in here than the general Windows section.

I've inherited a bit of a messy setup so when I have time, I am sorting it all out. I'm playing around with 'Software Installation' in Computer Configuration which I have working for updating Flash and so on, but my questions are:

Does the software install get applied each time the computer cold boots? i.e. it re-installs Flash for example therefore making boot times longer? How does this scenario work?

Is there a better way to distribute software/update software from a 2008 R2 server?

Thanks for any help.

 

[Steve09]

Maybe instead of calling the installation executable directly from the GPO, call a script which runs and checks for the correct version of the software then if not correct running the installer?

I had come across this method when searching the Internet.

Typically if it's an MSI it will apply the once and that's it. You do have the option to re-deploy to all that already have it if you so wish.

It's a good way to deploy programs to be fair although some programs you may find won't install because of language settings.

I thought it would only be applied once.

From my understanding on boot the GPO will list present GUID's and if any one is missing it will then look to install said application.

How big is the company you are working for? If it is a small organisation scripting can be the best way to distribute software, I recommend PSEXEC for this purpose.

If you're medium to large you'll want a more manageable solution; there are plenty of remote management tools out there that fit your purpose; Certero, GFI MAX, Microsoft Intune etc

Managed AV solutions often come with software distribution such as Kaspersky, what AV are you using?

It's a small organisation, only around 60 computers, but obviously I don't fancy going round each one just to install/update Flash etc.

We use Sophos anti virus at the moment and that has been installed on each computer in turn.

Hiya,

I've been using GPOs to deploy software for about 6 months, the usual suspects such as Java, Adobe Reader, Flash included.

Anything that comes packaged in an MSI can easily be deployed by GPO. And the software is only deployed on the PC once. You have some options advanced with the GPO, like uninstalling the software when the PC is moved out of scope (N.B moved somewhere else in active directory where the GPO no longer applies). You can also set the GPO up so it will install the MSI irrespective of any language conflicts, however I've not yet had to do anything like that.

If it's a smallish network (<100 users) it's probably not worth spending additional $$$ on tools to help you handle deployments.

Other non-MSI installers can sometimes be wrapped in an MSI or might even, when expanded, contain an MSI. The Windows Installer Wrapper Wizard is a useful tool for wrapping .EXEs.

It can take a bit of trial and error to get right. I've found machines hadn't really been maintained with current versions of software and my GPOs to upgrade applications sometimes conflicted with user pre-installed versions. It's taken a few iterations of updates to ensure things are in a known state when an update starts. (Unfortunately some of our userbase has a solid case for having administrative rights over their machines).

I would suggest using a test PC (could be a VM) in it's own org unit to test your new/updated GPOs before rolling them out company wide.

Yeah, I was thinking about this the other day. I don't know what version of Flash and Java etc the computers are running, unless I go round and check.

I had set up an old laptop as a test computer before I started putting it out to user computers.

If it's a pure Microsoft network I would handle things like;
(Through GPO's)

Test first on a dummy machine then boot all the systems up manually or use WOL depends on how many systems you talking about here.

... Do an un-install first then an install ...

> Adobe Acrobat Reader
> Adobe Flash
> Adobe Shockwave
> Microsoft Silverlight
> Java

Got any tips for un-installing old versions?

I'm fairly sure Flash updates the current installed version to the latest, but Java installs itself again and leaves the old one installed too. I don't fancy going round un-installing it on each computer.

Also, like I said above, I don't know exactly what version of Java for example each computer is running.

Thank you all for your help.

 

[Steve09]

ah I'm not at work at the moment and everything is saved in a location there. Use something like MSIEXEC {APP SID} /U (If you know the application sid).

I can't be precise at the moment as I'm off work for 2 weeks! It CAN be done though because we deploy it to 3K workstations +

This seems to be the method a lot of people are using, if you re-check this thread, could you post yours from work?

I think there is a Java download to remove older versions.
It might be necessary to script something up?

How many PCs are we talking about?

There's only about 60 odd computers, but checking each one would be time consuming and tedious!

I checked 6 computers today for their current Java version and there was only 3 different versions in total, which isn't too bad. I'm going to check another 8-10 tomorrow, hoping they use those 3 versions, then I can do a script (like mrbell1984's method) for uninstalling those after I get their uninstall IDs.