Group Policy for Software Deployment

[Xikejn]

Hey Guys, have a little question:

 

I would like to create a group policy that deploys software to users in the company so that I won't have to install them one by one on each machine. (Windows Server 2016)

 

The current users already have all the software they need, so this GPO will be used for new users.

 

My question is... let's say the current users have Firefox installed, if I create a GPO that will deploy the firefox.msi installer, will it reinstall firefox on their system or will it continue as usual?

 

Thanks

[bcguru9384]

message leadeater as he has link to short article on similiar subject

[leadeater]

31 minutes ago, Xikejn said:

Hey Guys, have a little question:

 

I would like to create a group policy that deploys software to users in the company so that I won't have to install them one by one on each machine. (Windows Server 2016)

 

The current users already have all the software they need, so this GPO will be used for new users.

 

My question is... let's say the current users have Firefox installed, if I create a GPO that will deploy the firefox.msi installer, will it reinstall firefox on their system or will it continue as usual?

 

Thanks

If the MSI version you use in the GPO is already on the computer then no it'll pass the installation check and do nothing.

[Xikejn]

6 minutes ago, leadeater said:

If the MSI you use in the GPO that is already on the computer then no it'll pass the installation check and do nothing.

Thanks!

[leadeater]

6 minutes ago, Xikejn said:

Thanks!

Also GPO software installs only happen on machine startup so the risk and impact is very low, worst case is like a couple minutes longer startup next time they reboot the device while no the network.

[chiller15]

Whilst GPO software deployment is an option, I've personally found it a little cumbersome. It's good that it will deploy the software to the targeted machine OU and you have the option for it to be removed if the machine is moved out of that OU...but other software (albeit paid for) is just simply better. I use SCCM in my workplace, which may be overkill for you...I have heard a lot of good things about PDQ Deploy. There is a free version of it, which is limited. The Pro version isn't that expensive if I remember correctly. If you can't fork out on a dedicated solution, then GP's software deployment can do it.

 

If you deployed Firefox manually using the MSI, then use GPO to deploy the same version of the MSI, it may be a case that GPO will simply reinstall Firefox with the new MSI.

If you deployed Firefox manually with the .exe installer than the MSI...it will depend on the install locations. We don't deploy Firefox, so I don't know it's install locations. The reason I bring this up, is because Google Chrome installs to one location (AppData I think) with the .exe installer and the enterprise MSI installs to another (Program Files). Then you could end up with two versions of Firefox installed at the same time.

 

To save any issues like described above, it might be worth creating a new machine OU for your new machines, or using a custom WMI filter and limit the GPO to that WMI filter.

[leadeater]

43 minutes ago, chiller15 said:

Whilst GPO software deployment is an option, I've personally found it a little cumbersome. It's good that it will deploy the software to the targeted machine OU and you have the option for it to be removed if the machine is moved out of that OU...but other software (albeit paid for) is just simply better.

Also not everything comes in a native MSI installer and some software that does isn't properly implemented in a way for it work nicely with GPO software install, MYOB being one of the worst culprits of this. Handling MSI dependencies and install orders can be annoying and take a fair amount of time to figure out.

 

In my previous job we did support for the education sector and the way we handled software installation for most clients was a combination of GPO software install and PowerShell startup scripts for the more complex software, for the PowerShell ones we used custom reg keys to handle versioning/installation status.

 

I by far prefer to use SCCM, been using it since SCCM 2007 original release but it's typically too complicated for most schools and the average desktop support technician without proper training and long term experience with it to retain the knowledge. SCCM for universities on the other hand is fantastic.