Chapter 20 – Software Deployment (MSI) with Group Policy
Windows Server Group Policy (GPO) Master Handbook
Chapter 20 – Software Deployment (MSI) with Group Policy
Learning Objectives
Deploy, upgrade, and remove enterprise software by using Group Policy Software Installation (GPSI).
1. Overview
GPSI distributes Windows Installer (.msi) packages to users and computers from a shared network location. It is suitable for many traditional Windows applications.
2. GPO Path
Computer Configuration → Policies → Software Settings → Software Installation
User Configuration → Policies → Software Settings → Software Installation
3. Assigned vs Published
Assigned software installs automatically (computer startup or user logon). Published software is available for users to install from Programs and Features where supported.
4. Preparing the Share
Store MSI files on a highly available UNC share such as \\FS01\Software$. Grant read access to target computers/users and avoid using local drive paths.
5. Deployment Steps
Create a GPO, browse to Software Installation, choose New → Package, select the MSI using a UNC path, choose Assigned or Published, then link the GPO.
6. Upgrades & Removal
Use package upgrades to replace old versions. Configure software removal when the GPO no longer applies if required by policy.
7. MST Transforms
Apply MST transform files to customize installations such as Office, Adobe Reader, or internally packaged applications.
8. Best Practices
Test in a pilot OU, use version-controlled folders, document package versions, digitally sign packages where possible, and maintain rollback plans.
9. PowerShell & Verification
gpupdate /force
gpresult /h report.html
Get-Package
Get-WmiObject Win32_Product (avoid routine use in production)
Get-Item \\FS01\Software$
10. Troubleshooting
Verify the UNC path, share and NTFS permissions, DNS resolution, MSI integrity, Event Viewer (Application and GroupPolicy logs), and confirm the computer can access the package before logon.
11. Common Deployment Errors
Package unavailable, access denied, incorrect UNC path, MSI corruption, architecture mismatch (x86/x64), reboot pending, and conflicting application versions.
12. Enterprise Scenario
Deploy 7-Zip, Notepad++, Microsoft Visual C++ Redistributables, and internally developed MSI packages to all domain computers using separate GPOs and pilot testing.
13. Interview Questions
What is the difference between Assigned and Published software? Why must a UNC path be used? How do you upgrade an MSI package? How do you troubleshoot failed software deployment?
14. Practical Lab
Create a Software Deployment share, deploy an MSI package to a test OU, restart the client, verify installation, upgrade the package to a newer version, then remove it using Group Policy.
Software Deployment Reference
Setting | Recommendation | Purpose |
Package Path | UNC Path | Reliable deployment |
Deployment Type | Assigned | Automatic installation |
Transforms | Use MST when needed | Customized installation |
Upgrade | Use package upgrade | Version management |
Removal | When GPO no longer applies | Lifecycle management |
Pilot OU | Always | Testing before production |
Share Permissions | Read for targets | Package access |
Official Microsoft Learn References
Comments
Post a Comment