Train Signal Training - Free Computer Training Videos » Organizational-Units

Installing Software Using GPOs on Windows Server 2008

Gosia Grabowska — Tue, 11 Nov 2008 14:00:08 +0000

Imagine for a minute that your boss came in one day, gave you a Foxit DVD and said that everyone in your organization needs to get that DPF software that’s on this DVD installed today.

You think, well that’s great but are you sure you want all 500 people to get the software today?

That’s almost impossible, isn’t it? There isn’t enough time for you to walk around with the DVD and install it 500 times.

Sure there is! But you won’t be walking around with the DVD in your hand, that’s for sure.

The solution I’m going to show you today is quite simple, and much less time consuming

You are going to copy that software on a Shared Folder on your network. Then, you’re going to create a Group Policy Object, aka GPO, (aren’t you happy you installed Active Directory?) that will take that software and install it on everyone’s machines.

Easy, huh? Of course it is and it is not going to take you days, I promise.

What You Need Before Installing Software Using GPOs

There are 3 things you will need in order to have a successful Software Installation GPO:

1. The most important thing you will need is a Microsoft installer file, called .msi — you cannot use the .exe file that is on the DVD.

You will need to get a packaging utility to turn that .exe file into .msi file. Many of them are available for instant download from internet.

There are a few that will cost money but there are also free downloads. Here is an example from each:

MSI Studio (30 day free trial) — http://www.scriptlogic.com/products/msi-studio/

EXE-to-MSI — http://juice.altiris.com/download/1355/exe-to-msi

2. The second thing you will need to create is a Shared Folder on your network for the software to live in. You need to make sure that every computer has at least "read" access to that folder and its contents.

3. And the last thing you will need is the new Group Policy Object linked to the appropriate Organization Unit.

How to Install Software Using GPOs

Assuming that you already have the .msi file ready, let’s start with creating a shared folder on our network.

1. Browse to the location on your network, right-click and select New, then Folder.

2. Name the folder — in this example we are going to call it "Software".

3. Select that folder and then click on the Share button on the menu toolbar.

4. Like I mentioned above, every machine needs to have at least read access to this folder. To do this type in Everyone and hit enter, or click on the Add button.

5. Make sure the Permission Level says Reader and then click the Share button.

6. Remember or write down the location of this shared folder. In our example the location is \\NY-MEM1-2K8\Software

7. Double click on the Shared Folder you just created and once again perform the steps to create a new folder.

This time name the folder with a name specific to the software you are about to install. We are going to call it "Foxit".

8. Double click on the new folder ("Foxit") and copy and paste the .msi file for the software you want to install. Our .msi is called FoxitReader23.

9. Now it is time to switch to your domain controller.

We are going to switch to our DC1 server. Once there, go ahead and open up Server Manager.

10. Now you need to point to the Organizational Unit where the new Group Policy Object will reside.

To start off, go ahead and expand Features, then Group Policy Management, and then your Forest. In our example it is the Globomantics.com forest.

11. Then expand Domains and then the domain in which you want to create the GPO.

12. Once you are in the correct domain, expand the Organizational Unit. In our example, we are expanding NewYorkOU.

13. Since we want the software to be installed on every single computer, we are going to create the Group Policy Object in our NYComputers Organization Unit.

Go ahead and click on that OU.

14. To create a new GPO, right-click on the appropriate Organization Unit and select Create a GPO in this domain, and Link it here…

15. Name your new GPO and hit OK.

16. To make sure the new GPO was created, go ahead and expand the Group Policy Objects.

You should see your GPO listed there. That GPO is now being linked to our NYComputers OU.

17. Select and then right click on the GPO under the Organization Unit. Then select Edit.

18. That should open a Group Policy Management Editor.

19. Go ahead and expand Computer Configuration, then Policies, and then Software Settings.

20. Next click on and select Software Installation.

21. Right click on the right side of the Software Installation, select New and then click on Package.

22. Browse to the location where your software .msi file exists.

In our example it is NY-MEM1-2K8 → Software → Foxit. Once you have located it, double click on the file or select it and then click on the Open button.

23. Select Assigned and click OK.

Testing

Before you actually go and test this on one of your client machines, do not forget to run a GPO Update. To do so, open up you command prompt on your Domain Controller and type in gpupdate /force.

Once the update ran through you can go to one of your clients and restart the machine. Keep in mind that in order for the software to be installed on a computer, you will need to do a hard reboot.

Now go ahead and relax for the rest of your day.

Server 2008 Active Directory User Groups — the Easy Way!

Gosia Grabowska — Mon, 07 Apr 2008 15:00:58 +0000

User Groups and Organizational Units are two great ways of keeping your Active Directory organized and controlled.

Last week I showed you how to create user accounts and user templates. So today, I’m going to show you how to put all of these users into a group.

Why would we want to do that?

Well, let’s say for example that we have this one shared folder on our network that we want only our Sales Department to have access to.

Without groups in your Active Directory, you would have to go to each individual Sales Department user account and give that account access to that shared folder. That can take quite some time if you have, let’s say … 200 users in your Sales Department.

Instead, what we are going to do is, take all the Sales Department user accounts and put them in a Sales User Group. Now when I want to give access to all of my Sales Users to that shared folder, I just give the entire Sales Group access to it and voila! All Sales Users now have access to our shared folder!

That’s just so much easier, isn’t it? You can then take the Sales User Group and put it in a Sales Organizational Unit.

Organizational Unit is really just a folder for organizational purpose, to keep your Active Directory nice and clean. You can add different groups, computers and other resources to an Organizational Unit.

Enough talk, let me show you how you can accomplish all of this in your Windows Server 2008 Active Directory.

Creating an Organizational Unit

1. Start by opening up your Server Manager, then expand the Roles section.

2. Next expand the Active Directory Domain Services section and click on Active Directory Users and Computers.

3. At this point you should be able to see your domain. In our example we are using the Globomantics domain. Go ahead and expand your domain.

4. Now we need to create an Organizational Unit for a group to live in. In our example we are going to create an OU for our Ops Team.

To create a new Organization Unit, right-click on your domain name, point to the New option and then select Organizational Unit.

5. Type in the name of your OU and make sure that the box is checked next to Protect container from accidental deletion. When done, click OK.

6. We now have a new Organizational Unit in our Active Directory called OpsOU.

Creating a New Group

1. After you create an Organizational Unit in your Active Directory, you are ready to create your first group. Go ahead and select your OU and then right-click in the blank area.

2. Next, point to New and then select Group.

3. The next step is to name your Group, select the scope and then select the type.

In this example we are going to name our group OpsUSers. We are also going to leave the default selections for group scope, which is Global, and group type, which is Security. When you are ready, click OK.

4. Our new group has been created!

Moving Accounts Into a Group

1. In order to move pre-existing accounts into a group, you need to hold down the Control key and click on all the User or Computer accounts that you want to move into that group.

2. Then you need to right-click on any one of those accounts and select Add to a group.

3. Next, you need to type in the group name and let the machine find it.

In our example, I will type in OpsUsers and then click on the Check names button. Once the name is verified and group name is found, the text will become underlined and you can click the OK button. Since we know our group exists, we are going to click OK without verification.

4. Now all of these accounts are part of our OpsUsers group.

Note: Another way of accomplishing this would be to click on an account, hold it, then drag and drop it into a particular group. Depending on how much you like to use your mouse and how much time you have this may or may not be your preferred way of accomplishing this task.

Windows Server 2008 Active Directory Training — Coming Soon!

Get complete coverage for the new 70-640 exam and get started on your MCITP certification.

Master Active Directory terms, learn about creating, organizing, and managing Users and Groups, installing and upgrading Domain Controller and much more — all on Windows Server 2008.