about me about this session agenda computer user

Software deployments: From GPO to Configuration ManagerMikko JärvinenSystems AdministratorUniversity of Turku

UD-B323

About me• Desktop services team

leader at IT Management of the University of Turku, Finland

• OS and software deployments, print services, msi repackaging, general sysadmin stuff

• Twitter: @mikko_jarvinen

About University of Turku• 7 faculties• 3500 FTE employees• 21000 students• 5000+ workstations• 400+ servers• Mixed and diverse

environment• Centralized IT

About this session• Tweet: #MMSUDB323• Based on a true story• We migrated software

deployments from group policy software installations to Configuration Manager 2007

• In this session we will also focus on 2012 Configuration Manager (SP1)

• How could application model help us?

• Scripts available at myITforum.com

AgendaPart 1Group policy software installations explainedGetting familiar with features in and differences between group policy software installations and Configuration Manager software deployments

Part 2Moving group policy based published per-user installations to Configuration Manager

Part 3Moving group policy based assigned per-machine installations to Configuration Manager

Part 1: Group policy software installations

Demo: Group policy software installations

Group policy software installations explained

Computer User

Group policy software installations vs.Configuration Manager

Group policy vs. Configuration ManagerGroup policy software installations

Configuration Manager

Group policy software installations client side extension

ConfigMgr Client → ConfigMgr Software Distribution Agent (ccmexec.exe)

Msi package (or .zap file) Any command line

Install and uninstall out of the box Package model: install and uninstall separateApplication model: installation program required, uninstall program recommended

Writes Event ID's, but no centralized reporting

Extensive and exhaustive reports and logging



Based on active directory and organizational units

Collections and databaseInformation can be read from AD

Targeting using organizational units

Targeting using collections

Additional targeting using group policy security filtering

Queries, direct membershipApplication Model: requirements

Msi package → assign/publish Package model: Package → Program → AdvertisementApplication model: deployment types



If msi package and targeted computer are ok, everything just works (or that's what we think)

Whether software distribution action was successful or not we get the information.Return codes are important!

Sequencing possible using "GPO Link Order"Package installation order within the same GPO is assumed to be random

Package model: "Run another program first"Task SequencesApplication Model: requirements, dependencies

Makes sure the client computer is in the state that msi package defines

Makes sure the command line will be run on client - eventually



No scheduling options Deployments can be scheduled

DFS root → DFS share → directory → msi package (Install source)

Package Source Files → Distribution Point → ConfigMgr cache

Install source is immutable ConfigMgr Windows Installer Source List Management

Group policy software installations

Group policyInformation about software installation is in active directory and group policy objectGroup policies normal separation to computer configration and user configuration applies as well with software installationsClient computer processes group policies and gets the information about software installations

Client-side extensionGroup policy software installations client side extension commands Windows installer based on the information it has received after group policies have applied

Windows installerWindows installer operates with the msi package


Stateful technologies by designGroup policy software installations is stateful and relies on the information defined in group policy objectWindows installer is stateful and relies on the information defined in the msi package

Extremely stateful togetherGroup policy software installations client-side extension enforces msi package self-healing which will restore the state of the installations!These are very powerful but problematic technologiesThe quality of the msi package is very important

Domain


ClientGPO Software Installations

Client Side Extension

Windows Installer

Msi package

GPO

Computer

User


Three main operating modes1. Assigned to Computers2. Assigned to Users

• Advertise (create shortcuts only)• Install at logon

3. Published to Users


Auto-installDeployment option "Auto-install this application by file extension activation"File type associations are extracted from msi package's Verb TableGroup policy client side extension knows the associationsIf a user tries to open a file type which is known by "auto-install" the associated program will be installed automaticallyIf "Install a program from the network" has been hidden on client auto-install still works!

Windows installer install cache and install source

Windows installer install cache

Install cacheWindows installer saves an "inflated" version of msi package into Windows installer cacheInstall cache enables self-healing, uninstall, etc. without the need for original msi

Install cache location%systemroot%\InstallerCache is there for a reason - don't delete anything or otherwise mess with it!

Windows installer install source

Install sourceWindows installer saves the original path of the msi package in registryInstall source is the last resort if "inflated" msi package in Windows installer cache is not enough

True with poorly authored and bad msi packagesIf install source is needed but not accessible you are in trouble!

Configuration Manager Windows installer source location managerAlso known as 'Source update' or 'Installation source management'Source location manager tries to keep the install source available for the clientBased on msi package's product code

Windows installer install source

Install source locations• HKCR\Installer\Products\<product code>\SourceList\Net\<#>• HKCU\Software\Microsoft\Installer\Products\<product code>\SourceList\

Net\<#>• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

<Product>\InstallSource• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\

<User-SID>\Products\<obfuscated product code>\InstallProperties\InstallSource

Msi package

Windows installer self-healing (self-repair)Windows installer checks for component keypaths but repairs the whole componentReference msi is in install cache

Component A (GUID A)

File 1Keypath for Component A

File 2

Component B (GUID B)

Registry Key 1Keypath for Component B

File 3

Windows installerC

heck

Repair

Chec

kRepair

Update, upgrade and replace


There are three main methods to get a new software version deployed1. Update2. Upgrade3. Replace


UpdateDeploy Windows installer patch (.msp) over existing installationGroup policy software installations has no support for deploying updates but you cannot safely update the installations on clients, either

If you update, client's state is different than the group policy software installation's opinion

To deploy a patched version you must first update administrative installation and then redeploy (or repackage)Configuration Manager: Run the command line to install the patch or utilize Software UpdatesNon-Windows installer technology updates or patching is a bit different story


UpgradeFor upgrade to work, msi package must have the logic (Upgrade Code and Upgrade Table) to upgrade older versionsWindows installer takes care of the upgrade during the installation of a new versionGroup policy software installations "Package can upgrade over existing package"Some vendors don't support upgrades in their msi packages!

You must handle these situations carefully as a part of deployment

Non-Windows installer upgrades are a bit different story

Update, Upgrade and Replace

ReplaceComplete uninstall of old version, then install new versionGroup policy software installations "Uninstall the existing package, then install the upgrade package"Replacing is the safest way to install new versionsUninstall or install could still fail!

Windows installer rollback

Rollback returns the original stateBefore deleting a file Windows installer creates a temporary backup from itIf something goes horribly wrong Windows installer can stop the process and roll the system back to the initial stateRollback can happen during install or uninstall!

Undesirable rollbackMsi package defines the initial state of the computerPoorly authored msi package, especially custom actions, or messed up client may lead to unwanted rollbacks

It is possible to end up in a situation where software cannot be installed or uninstalled


Detecting the installationsTo avoid any damage we do not want to deploy a software using Configuration Manager on top of the group policy based installation

Group policy software installations extension and Windows installer self-healing will try to restore the state of the group policy based installation

We need to detect if the specific msi package has been installed on the computer by group policy software installations - either with "published to users" or "assigned to computer" method

The same msi package installed outside of the group policy software installations is not a problem

Installations can be detected using solely msi package's product code and the information can be found under HKLM hive in registryHowever, some programmed logic is required to detect published per-user installations


Detection method: assigned to computerHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt\{guid}\

Where {guid} is the value of ObjectGUID attribute of the packageRegistration object inside the group policy object where the package has been defined in active directorydomain/System/Policies/{GPOguid}/Machine/Class Store/Packages/{aas-guid}


Detection method: published to usersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\<domain-user-SID>\Installer\Products\{obfuscated-msi-product-code}\

Obfuscation:{01234567-89ab-cdef-0123-456789abcdef} product code will be in form{76543210-ba98-fedc-1032-547698badcfe}

Information about installation is stored in user's registry as wellHKCU\Software\Microsoft\InstallerHKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt


Options to get away?Option 1: Forced uninstall

Removal option "Immediately uninstall the software from users and computers"Group policy software installations extension uninstalls the software at next possible moment after the group policies have been refreshedLeaves the (un)deployment "alive" in group policyIt is easy to force a restart for the computers but how do you force a re-logon to all users that have logged on to a computer and have per-user installations?

Option 2: Remove commitments Removal option "Allow users to continue to use the software, but prevent new installations"Software remains installed, but group policy software installations extension is no longer interested in the state of the installation on client computerYou will have to uninstall, upgrade or replace the software afterwards


Options to get away?Option 3: Uninstall without removal

Deployment option "Uninstall this software when it falls out of the scope of management"If you add this option, remember that clients must refresh the policies to receive the informationWhen group policy is no longer affecting the computer or user the software is considered to be "out of the scope of management"Group policy software installations extension uninstalls the software at next possible moment after the group policies have been refreshed

Option 4: Reinstall WindowsMake sure the group policies with installation are not affecting computer or user after the restart

Option 5: Application virtualizationVirtualized software will not change the state of the computer so you can deploy software on top of group policy software installations without breaking clientsYou can buy some time with this but the group policy based installations remain on the clients

Part 2: Migrating published per-user installations

Group policy vs. Configuration ManagerPublished installations



Publish to user Advertisement, non-mandatory to computer

Only domain accounts For all accounts (Domain, Local)

Installing account: user with elevated privileges

Installing account: Local System or the user logged on

No notifications about new software

Option for notifications about new software

Migrating published per-user installationsPublished per-user installation factsPublished software is installed only once per computerEach user must, however, initiate the "installation" to get per-user information (shortcuts, HKCU, etc.)Group policy software installations client side extension keeps track of users and installed programsGroup policy per-user installation can be uninstalled only by the user(s) and essential information is in user's registry

Software will be uninstalled when the "user count" hits zeroIf the user (account) no longer exists it is difficult to get software uninstalledIf you delete user's profile essential information will be lost

Per-user installation type is challenging when computer has more than one user!

Migrating published per-user installationsProsA great and an easy way to provide optional software for usersInstall, modify and uninstall for standard users (through elevation)24/7 software installation self-service portal built-in into Windows and Active Directory

ConsStrange mixup of per-machine and per-user installationsTied to domain user accountsPing-pong self-healing if two users have different version of the same software on the computer that cannot co-exist

Migrating published per-user installationsChallengeHow to provide about the same features and user experience with Configuration Manager as we had with published group policy based installations?

2012 Configuration Manager Application Catalog is definitely one way

How to prevent breaking existing per-user installations on clients?

SolutionPIPARI script

Pipari Implements Prerequisite Analyzer and Runs Installations

Migrating published per-user installationsPIPARI is a Visual Basic script which• Will be used as an wrapper script for the installation• Detects blocking group policy based per-machine installations• Detects blocking group policy based per-user installations• Detects blocking running processes • Provides uninstall or modify feature if program has already been

installed• Informs the user when installation is finished• Can provide merciful reboot option• Works with all x86/x64-combinations of installer and environment• Returns valid return codes

Pipari script explained

Start

BlockingPer-Machineinstallations?

BlockingPer-User

installations?

Notify userNotify user

Blockingprocessrunning?

Notify user,try again?

No

Yes

No

Yes

No

Yes

No

Yes

Quit: -1(per-

machine)

Quit: -2(per-user)

Quit: -3(blocking process)

A

Programalready

installed?

Installprogram?

Notify user: installation

finished

Run uninstallcommand

Quit: Return Code from uninstall

command

Rebootneeded?

No

Yes

Yes

NoYes

NoYes

Programalready

installed?

No

Quit: 0(no

changes)

No

Quit: -4(user gave

up)

Yes

Run installcommand

Quit: Return Code from install command

Schedule reboot in 60

seconds

Notify user: reboot is needed

A

Uninstallprogram?

Wait of 'OK'

Demo: Pipari script

Part 3: Migrating assigned per-machine installations

Group policy vs. Configuration ManagerPer-machine installations

Group policy software Installations


Install during startup (boot)"Installing Managed Application..."

Install at any time (except during startup)Whether user is logged on or not

Uninstall during startup (boot) Uninstall at any time (except during startup)

Installing account: Local System Installing account: Local System (Run with administrative rights) or any other account

Migrating assigned per-machine installationsAssigned per-machine installation factsGroup policy software installation type "Assigned to computer" installs and uninstalls programs at computer startup

"Installing Managed Software..."

Group policy software installations extension and Windows installer will make sure that the programs are installed as they are defined in group policies and msi packagePer-machine (assigned to computer) installation type is quite inflexible and exceptions need extra work

Migrating assigned per-machine installationsMigration starting pointAlmost 100 "Install Program X" group policy objects to install software"Install Program X" GPO's are linked to OU's with strictly managed computers

Mostly computer labs and other shared computers

Permission to link group policy objects delegated to helpdesk groups to different organizational units

Easy and simple way to install programsSoftware installations can be managed only on the computers you have given the permission forSoftware will be kept up to date by IT Services

Migrating assigned per-machine installationsChallengeHow to tie up GPO's and Configuration Manager collections?How to make sure we are not messing up group policy based per-machine or per-user installations?How to prevent unnecessary ovelapping management?

Active directory OU structure and Configuration Manager collections

SolutionKEKSI script

Keksi is an Enhancement Kludge for Software Installations

Migrating assigned per-machine installationsKeksi is a Visual Basic script which• Is defined as a startup script in "Install Program X" group policy object• Does nothing if certain group policy per-machine or per-user

installations are found• Checks are based on a msi package's Product Code• returns a dedicated return codes for reporting

• Adds a new installed pseudo-program "GPOInstall Program X" into registry under HKLM\SOFTWARE\[Wow6432Node\]Microsoft\Windows\CurrentVersion\Uninstall

Domain

Keksi

Computer

HKLM\SOFTWARE\[Wow6432Node\]Microsoft\Windows\CurrentVersion\Uninstall\GPOInstall Adobe Reader\DisplayName="GPOInstall Adobe Reader"

GPO: "Install Adobe Reader"Startup script: "\\server\share\keksi-adobereader.vbs"

ConfigurationManagerConfiguration

Managerclient

Hardware inventory cycleAdd/Remove Programs"GPOInstall Adobe Reader"

Computer

Collection"GPO: Install Adobe Reader"QueryAdd/Remove Programs Display Name = GPOInstall Adobe Reader

Install or upgradeAdobe Reader

1

2

3

45

Demo: Keksi script

Final thoughts

• Know your environment and deployment tools• Test every installation and uninstall using the

deployment solution and with all client versions• If you have group policy based software

installations in place be sure not to break them• Be careful with scripts some random guy has made• Never underestimate the power of the software

vendor to build the most unimaginable solutions in their software and installers

Links, references and resourcesGroup Policy Infrastructurehttp://technet.microsoft.com/en-us/library/dd379467.aspxGroup Policy Software Installationhttp://technet.microsoft.com/en-us/library/cc738151.aspxMissing Windows Installer Cache Files Will Require a Computer Rebuildhttp://support.microsoft.com/kb/2667628About Windows Installer Source Location Managerhttp://technet.microsoft.com/en-us/library/bb892810.aspxRollback Installationhttp://msdn.microsoft.com/en-us/library/windows/desktop/aa371370.aspxSoftware Installation and Maintenancehttp://technet.microsoft.com/en-us/library/bb742420.aspxHow To Patch a Software Installation Stored on a Network Server That Is Deployed Using Microsoft Software Installerhttp://support.microsoft.com/kb/226936

http://technet.microsoft.com/en-us/library/dd379467.aspx

http://technet.microsoft.com/en-us/library/cc738151.aspx

http://support.microsoft.com/kb/2667628

http://technet.microsoft.com/en-us/library/bb892810.aspx

http://msdn.microsoft.com/en-us/library/windows/desktop/aa371370.aspx

http://technet.microsoft.com/en-us/library/bb742420.aspx

http://support.microsoft.com/kb/226936

Thank you!

Evaluation

Complete your session evaluations today and enter to win prizes daily. Provide your feedback at a CommNet kiosk or log on at www.2013mms.com.Upon submission you will receive instant notification if you have won a prize. Prize pickup is at the Information Desk located in Attendee Services in the Mandalay Bay Foyer. Entry details can be found on the MMS website.

We want to hear from you!

Resources

http://channel9.msdn.com/Events

Access MMS Online to view session recordings after the event.

© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

about me about this session agenda computer user

Documents

logging slide

session slide

agenda slide

new software slide

random package model

client computer

software distribution

separate application