oreilly.comSafari Books Online.Conferences.


AddThis Social Bookmark Button

How to Deploy Software Using Group Policy

by Mitch Tulloch, Chris Sanders

In the previous article Implementing Mandatory Roaming Profiles, we looked at one part of Microsoft IntelliMirror technologies that helps make the job of administering a network of Windows desktop computers easier. In this article, Chris Sanders, a network administrator for one of the largest public school systems in Kentucky, continues his discussion of how to leverage the power of Intellimirror technologies by showing you how to deploy software effectively using Group Policy.

"Deploying software is something that is typically a pretty simple task. However, this is not necessarily the case when the software you are deploying must be installed to dozens, hundreds, or even thousands of computers. The headache involved in doing this tends to increase as the number of computers goes up. The thought of physically going to every single machine and installing the necessary software can really get you feeling down. Fortunately for us, Microsoft provides a much easier method through group policy-based software installation."

The Scenario

"Our story begins on an average Wednesday morning. As you sit going through proxy server logs, a new email pops up from your Chief Information Officer. Apparently, the current virus protection solution is set to expire and a new product has been purchased. As things go in information technology, purchasing the new product has been put off until the very last minute. This being the case, your current virus software will expire and be ineffective first thing Friday morning. The CIO has challenged you with the task of installing the new virus protection software by Friday morning before the current coverage expires. You have 300 computers and no other technicians who can be pulled away from their current projects. How can group policy help us to get this job done on time?"

Prepping the Installation

"The use of group policy-based software installation is going to make this job easier to the point that you can complete the entire installation without getting up out of your chair. But before we can begin creating our policy, there are a few prerequisite steps we need to take care of.

"The first step in any group policy-based software installation is obtaining the installer file for the software you are deploying. It is a requirement that this installation file be in Microsoft Software Installer (MSI) format. Luckily for us, the new virus protection software is installed through a valid MSI file.

"Once you have obtained the appropriate MSI file, you must create a distribution point for the software to be deployed from. Your distribution point needs to be a centralized location, preferably on a server, where a shared folder can be created that all users have read access to. Once you have created this shared folder, you need only to copy the MSI file into it."

Creating the GPO

Figure 1: Creating a New Software Installation Package GPO

Figure 1: Creating a New Software Installation Package GPO

"Now that we have prepared our installation file we are ready to create the group policy object that will push out the installation. To do this, we will be using the Group Policy Management Console (GPMC), which is a free download from Microsoft. Create a new GPO by opening the GPMC, clicking on 'Group Policy Objects' in the left pane, and right-clicking in the center pane and clicking 'Create New Group Policy Object.' Finally, type a name for this GPO and hit the Enter key. The name of your GPO should be something brief but descriptive, such as a 'Virus Protection Installation.'

"Having a fresh clean GPO to work with, we can now proceed to assigning the installation packing to it. You will begin this by right-clicking your newly created GPO and clicking 'Edit.' Under the Computer Configuration heading, expand 'Software Settings.' Right-click 'Software Installation,' point to 'New,' and click 'Package' (Figure 1). In the open dialog box, type the full UNC path to the shared MSI file and click 'Open.' Click 'Assigned' and then click 'OK.' The software package should now be displayed in the right pane of the GPMC window.

"In order to complete your setup, all that is left to do is link the GPO to the appropriate container. In the GPMC, right-click on the container that holds of the workstations you wish for the software to be deployed to and click 'Add Existing GPO.' Select the GPO you just created and click 'OK.' Your software should then be installed the next time your users restart their computers."

Removing Software via Group Policy

Figure 2: Selecting the option to uninstall software with group policy

Figure 2: Selecting the option to uninstall software with group policy

"You thought we were done already? Try again! Apparently your CIO was not satisfied at all with the new virus coverage software and has decided he wants to get rid of it. Just like before, he wants it done ASAP. The great thing for you is that any software package installed with group policy can be uninstalled just as easily.

"In order to remove the software we just installed, we begin by firing up our Group Policy Management Console. Once inside GPMC, browse to the listing of all the Group Policy Objects and find the GPO we just created. Right-click this GPO, and click 'Edit.' Once again, browse to the 'Software Settings' heading under the Computer Configuration section. Click on 'Software Installation,' and you should see the package we just created listed in the right pane. Right-click this package, point to 'All Tasks,' and select 'Remove.' A prompt will pop up, presenting you with two options (Figure 2). Select 'Immediately uninstall the software from users and computers' and click 'OK.' The next time your computers restart, the new policy should take effect and uninstall the software."

Wrapping It All Up

"Amazingly enough, that is all there is to installing software with group policy. We have successfully installed and removed a software package in a matter of minutes. Although it is beyond the scope of this article, with Group Policy you can extend this by performing certain levels of maintenance and upgrades on software as well. So there you have it; you have gotten your task done in record time and managed to put a smile on your CIO's face...for now anyway."

Additional Resources

Here are some additional resources you may want to review before implementing Group Policy software installation in your own networking environment:

Mitch Tulloch is the author of Windows 2000 Administration in a Nutshell, Windows Server 2003 in a Nutshell, and Windows Server Hacks.

Chris Sanders is the network administrator for one of the largest public school systems in the state of Kentucky. For more about Chris, you can view his personal blog at

Return to the Windows DevCenter.