Okay.
In this module, I'm going to talk about deploying software using group policy.
So one of the capabilities of group policy is the ability to deploy or install software.
It's sort of a I would call it a rudimentary software distribution capability.
So unlike products like system centered configuration manager or other third party software distribution
products, the group policy software installation feature in the group policy engine is fairly limited
in what it can do.
So what it does provide, other than that basic software distribution capability is you're going to
only install MSI or Windows Installer packages so that the setup has to be in an MSI format in order
for it to work with the group policy software installation feature.
There's a small fringe exception to that that I'm really not going to cover because it kind of limits
the capabilities of the search function.
But and it's called zap packaging.
And it's it goes way back to the very beginning of group policy and really isn't used anymore.
But it does provide a limited amount of capabilities around non MSI deployment.
You can do either per computer or per user targeting as is normal with group policy.
So you can deploy a package to a computer or group of computers, or you can deploy it to users.
So whenever a user logs on to a computer, if they have a package deployed to them and it's not already
installed, it gets installed on that computer.
You can do some level of lifecycle support with the group policy software deployment feature.
So that includes things like upgrades, patches and removals.
You can also redeploy software.
So if you if it's been deployed and for whatever reason, it's not getting there or it's not triggering
a deployment on the target system, you can actually do a redeploy.
Now let's look at what it doesn't provide, which is probably more relevant.
I will say that to put it in context, a group policy software deployment feature is really designed
for small or medium shops that don't want to spend the money of a big, you know, software distribution
package like system center configuration manager and just need some basic software deployment capability.
So what software deployment and group policy does not provide is, as I've mentioned, support for,
you know, full featured support for other types of setup packages other than MCI.
So Daddy Yankee or whatever deployment packages you might have, you know, a good example might be
the new modern app format within Windows eight and above.
No support for any of those kinds of packages, no inventory or reporting on the distribution of software.
So you there's no way centrally to find out if you know, if you've deployed to 100 computers in an
O you, there's no way to know that all 100 of those computers have gotten the package.
There's no reporting back.
There's you know, the upgrade feature is not what I would call easy in group policy software deployment.
It's quite brittle and somewhat limited.
So there's really not, what I would say, robust upgrade capability within the product and there's
no concept of kind of per node management of the deployed software.
So you can't go in and, you know, re push a package to just one system.
It's limited by virtue of the fact that with group policy targeting you're typically generally targeting
a whole oyu or a group of computers or users.
And so it's not, there's no real concept of being able to manage a single nodes softer deployment state
redeploy to just that node out of the 100 that have been targeted by that GPO.
So really kind of limited in that respect.
Now let's look at some of the features that are in group policy software installation.
So there's this notion of per user assignment or publishing, and I'll talk more about assigning and
publishing and the differences of those in a bit.
There's the support for upgrade relationships and this is how they're referred to in Zealand.
It's basically this ability to say that if you'd already deployed version one in oh eight, you can
create an upgrade relationship to version two of the same package in GPO B and have all the clients
that have installed, you know, the version one get the upgrade.
There's support for something called Transforms, which is a feature of Windows Installer MSA packages
that allow you to modify a vendor's MSI set up to do custom installation.
So as a typical example might be in the old days you could deploy Microsoft Office when it shipped as
an MSI, and if you only wanted to install PowerPoint, you could write a transform for the office setup
that would only install PowerPoint.
Per computer assignment is another feature.
This is the ability to assign applications to the computers.
You also get automatic elevation of privileges during installation.
So if the user if the application requires admin rights and the user doesn't have it, then Gypsy takes
care of that.
And then this kind of ability to do what's called install on first use, which is that the application
is not really fully installed on the target, whether it's a computer or a user, until the user triggers
something that requires it.
For example, they click on a word document in an email attachment and word gets installed on demand.
So to define software installation policy, you can find it under computer configuration or user configuration
in these paths for computer packages can only be assigned.
So you can only do assignment of a per computer package and it does require a reboot of the computer
to trigger the install per user packages can be published or assigned.
Published is for kind of install on first use or install by the user types of packages where you don't
necessarily need the software right there right now.
Assigned packages do require a re log on by the user to get the install.
So let's take a look at this and like dig in on a real system and see what this actually looks like.