Removing Applications

You can remove applications from users or computers in several ways. First, under some circumstances, users can manually remove applications, but, as an administrator, you hold the reigns. Therefore, you can set applications to automatically or forcefully be removed.

Users Can Manually Change or Remove Applications

If an application is Assigned or Published to a user , they can use the Add or Remove Programs folder to change the installed options or remove the bits to save space. There seems to be no way to prevent this. However, Microsoft's position is that it provides the best of both worlds : the user can remove the binaries, but if the application is Assigned, the icons and program names are forced to appear on the Start ˜ All Programs menu.

But, in practice, I've found that this is a bad thing. Users remove their applications and then go on the road with their laptops. Well, on the other hand, if they do this, they deserve what's coming to them. Note, however, that applications Assigned to the computer cannot be changed or uninstalled by anyone but local computer administrators. This is a good thing.

Automatically Removing Assigned or Published .msi Applications

Applications can be automatically uninstalled when they no longer apply to the user. Earlier in the "Advanced Published or Assigned" section, you saw that in the Deployment tab of the Software Installation Properties dialog box you can check the "Uninstall This Application When It Falls out of the Scope of Management" check box. This was back in Figure 10.11. You can specify that the application is to be uninstalled if either of the following occurs:

• The user or computer is moved out of the OU to which this software applies.

• The GPO containing the package definition is deleted.

The software is never actually forcibly removed while the user is logged on to the current session but is removed a bit later in the following manner:

• Applications Published to users are removed upon next logon.

• Applications Assigned to users are removed upon next logon.

• Applications Assigned to computers are removed upon next reboot.

• Applications Assigned to computers that are currently not attached to the network are removed the next time the computer is plugged in to the network, rebooted, and the computer account "logs on" to Active Directory.

• Applications Assigned or Published to users on computers that are currently not attached to the network are removed the next time they log on and are validated to Active Directory.

In these cases, the software is automatically removed upon next logon (for users) or upon next reboot (for computers). For example, Figure 10.20 shows what happens when a computer is moved out of an OU and then rebooted. Moving users and computers in and out of OUs might not be such a hot idea if lots of applications are being Assigned.

Figure 10.20: When applications fall out of the scope of management, they uninstall.

Note 

These rules assume that the target system is Windows 2000, Windows 2003, or Windows XP and Fast Boot is not enabled. If Fast Boot is enabled, these rules don't apply; expect two logons or two reboots for the change to take effect.

One final warning about the automatic removal of applications. GPSI cannot remove the icons and programs names for the application if the GPO has been deleted and the user has a Roaming Profile and has roamed to a machine after the application was uninstalled. In this case, there is not enough uninstall information on the machine, and, hence, the icons and program names will continue to exist, though they will be nonfunctional.

Forcefully Removing Assigned or Published .msi Applications

You have seen how applications can be automatically removed from users or computers when the user or computer object moves out the scope of management. But what if you want to keep the user or computer in the scope of management and still remove an application? You can manually remove Published or Assigned applications. To do so, simply right-click the package definition, and choose All Tasks ˜ Remove, as seen in the following graphic. This will open the "Remove Software" dialog box. The options presented in this dialog box depend on whether you deployed .msi or .zap applications.

If you are removing a .msi file, you have two options, as discussed in the next sections.

Immediately Uninstall the Software from Users and Computers

If you choose this option, all connected computers receive a signal to uninstall the software, and they follow the rules for uninstalling as in the previous section.

The signal to remove an application (such as Office XP) lives in the actual GPO definition. Therefore, if you're looking for success in the forceful removal of applications, don't delete the GPO right after selecting this option. If you do, the signal to remove the application won't be available to the workstations. Rather, remove the application, and leave the GPO definition around for a while to ensure that the computers get the signal to remove the software. If you remove the GPO before the target user receives the signal (upon next logon) or the computer receives the signal (upon next reboot), the application is orphaned on the Desktop and must be manually unloaded via the Add or Remove Programs applet in Control Panel or by some other means (for instance, MSIEXEC as described later in this chapter).

Warning 

This is a second warning in case you overlooked the ominous message in the previous paragraph: if you remove the GPO definition before a target user or computer receives the signal, the application is orphaned on the Desktop. You can, however, likely get out of this trap if the application was specified with the "Uninstall This Application When It Falls out of the Scope of Management" check box. You can move the user or computer out of the scope of management to remove the application and then bring it back in when the application removal is completed. It's a bit rough, but it should work.

Allow Users to Continue to Use the Software, but Prevent New Installations

When you remove applications using this option, current installations of the software remain intact. Users to which this edict applies, however, will no longer be able to install new copies of the software. Therefore, those who do not have the software will not be able to install it. Those who do have it installed will be able to continue to use it.

The self-repair features of the Windows Installer will still function (for example, if Winword.exe gets deleted, it will come back from the dead), but the application cannot be fully reinstalled via the Add or Remove Programs applet in Control Panel for fixing an application en masse.

Warning 

Once you use this option, you will no longer be able to manage the application and force it to uninstall from the machines on which it is installed.

Removing Published .zap Applications

You have only one option for removing .zap applications. When you right-click the package definition and select Remove (as seen earlier in previous graphic), you'll have to answer but one question: "Remove the Package but Leave the Application Installed Everywhere It Is Already Installed."

Remember that since the .zap file really calls only the original Setup.exe program, ultimately, that Setup.exe is in charge of how the application is uninstalled. Therefore, once applications are deployed using .zap files, the power to forcibly uninstall them is out of your hands.

Troubleshooting the Removal of Applications

Sometimes, applications refuse to leave the target system gracefully. Usually, this is because an application has been Published or Assigned, and the user has "double-dipped" by throwing in the CD and installing a program on top of itself. Sometimes, the Windows Installer becomes confused . When you then try to remove the application from being Published or Assigned, the application doesn't know what to do.

If an application refuses to go away (or you're left with entries in the Add or Remove Programs applet in Control Panel), you have two tools at your disposal: The Windows Installer Clean Up Utility (also known as MSICUU) and MSIZAP. Both were originally in the Windows 2000 Support Tools located in the \SUPPORT folder of the Windows 2000 Server CD. Updates are now available at Microsoft's download site. Both do essentially the same thing: they manually hunt down all Registry settings for an application and delete them. This should remove all vestigial entries in the Add or Remove Programs applet in Control Panel.

Windows Installer Clean Up Utility (also known as MSICUU) This tool has a GUI, Programs displayed in the Installed Products list, as shown in Figure 10.21, are the same as those in the Add or Remove Programs applet in Control Panel. At last check, the download was available at http://tinyurl.com/9cml4 .

Figure 10.21: The MSICUU program in the Windows 2000 Support Tools can whack entire programs off your system.

MSIZAP MSIZAP is a command-line tool with a similar function. You must specify a specific .msi product code (GUID) to hunt down and destroy. At last check, additional reference and download for MSIZAP is at http://tinyurl.com/l9eb . However, you'll have to download and install the monstrous Windows Installer SDK just to get it.