1

This how-to article describes how to deploy software via Group Policy. NB. All installers must be .msi files

Step 1: Locate you MSI file on a network share

Your MSI file to deploy needs to be located on a share that is accessible for the user. A hidden share is recommended:
\server1\deploy$ or \dfsname\deploy$. Users will need read access to this share

Step 2: Create some security groups in AD for distributing the software

Create an AD Security group, 1 for each MSI package you are wanting to deploy. (e.g. APP_DEPLOY-Adobe Reader, APP_DEPLOY-Adobe Flash, etc). Try to keep the naming conventional the same.

Step 3: Create GPO and assign to the user group

Open Group Policy and Create a new Policy. Once created, in the right pane, ensure that only the group you create canh ave the policy applied (e.g. Adobe Reader install can only be applied to APP_DEPLOY-Adobe Reader)

Step 4: Edit the GPO to specify the installer

Open up the GPO and go to - Computer Configuration, Policies, Software Settings, Software Installations. Right click and go new Package.
Type the UNC path to the MSI file and then choose to either assign or publish (assigning the app installs it at login, publishing makes it available to install in add/remove programs)
Right click on the newly created Package and go to properties, ensure the Install application on logon is ticked on the deployment tab if you are assigning the package

NB> If deploying RemoteApp MSIs, it would be better to use User Configuration, Policies, Software Settings, Software Installations (this way the remote apps follow the user)

Step 5: Additional Options

You may also redeploy the app or remove it from the GPO, by going to the package in the GPO, right clicking and choosing all tasks. Redploying is good if there is a new version available.

You should now have a working MSI that will deploy on login to the people in your chosen group.

15 Spice ups
2

Great work!

3

Thanks Antal

4

Nice! Thanks

5

will this work, we’re on 2008 r2 domain, and our Win7 domain users cannot even install, for instance, Java updates, due to permissions? will this force permissions for the “assigned” app? or is there more, to allow the update? we have java updates all the time, i’d like to solve without touching each workstation, nor giving user ability to install crapware either. thanks.

6

I think Group Policy is a poor choice here:

  • Group Policy would not work if computers are not on local network (e.g. remote laptops).
  • Group Policy does not provide any feedback - was installation successful or not
  • Group Policy requires that all computers should be in Active Directory domain

So I recommend you to use free cloud-based tool Action1 to install software remotely on multiple computers.
Cloud-Native Software Deployment Tool | Action1