Final Thoughts

In this chapter we inspected Software Installation using Group Policy, or just GPSI for short. GPSI works with Active Directory and Windows 2000, Windows XP, and Windows 2003 clients. Use Microsoft SMS (or other tool) for non-Windows 2000, Windows 2003, and Windows XP clients . Use WSUS for patch management because patches to Windows are not deployable using GPSI.

In order to make the most of GPSI, you really need to leverage MSI applications. You can either get MSI applications from your software vendor, or wrap up your own with third-party tools (listed in this chapter and also in the Appendix and "Third-Party Group Policy Tools" on this book's website).

Share a folder on a server you want to send the package from. Plop the application in its own subfolder, and use both share and NTFS permissions to crank down who can read the executables and install files. Remember, though that not all MSI applications are ready to be deployed. Some are, indeed, ready-to-go (like the .NET Framework), others require an Administrative Installation (like Office XP), and still others ship as MSI files but cannot be deployed via GPSI (such as older versions of Adobe Acrobat Writer).

Once you have your package, you can Assign or Publish your applications.

Assign applications when you want application icons to appear on the Start ˜ All Programs menu; Publish applications when you want users to dive into the Add or Remove Programs folder to get the application. You can leverage Microsoft Transform Files (MST files) to hone an MSI and customize it. You can patch existing MSI applications with Microsoft Patch Files ( .msp files) but afterward, you need to redeploy the application.

Try not to orphan applications by removing the GPO before the target computer gets the "signal" upon the next reboot (for computer) or logon (for user ). If you think you might end up doing this, it's best to ensure that the "Uninstall This Application When It Falls out of the Scope of Management" check box is checked, as seen in Figure 10.11.

WMI Filters are used to change the scope of management for when a GPO will apply. You can use WMI Filters for any GPO you createnot just ones that leverage GPSI. However, the most common use for WMI Filters is usually for GPOs that leverage GPSI. Don't forget that Windows 2000 clients don't honor WMI filters. Additionally, Windows XP and Windows 2003 clients set to evaluate a WMI filter will take some extra processing time for each filter they need to work through. Be sure to test all your WMI Filters in the test lab first.