A. With Group Policies in Windows 2000 you can do far more than just restrict and set certain registry entries. You can set startup/shutdown/login/logoff scripts, redirect folders like My Documents and publish applications (and more). Its the last item that interests us and there are four main options:
- Assign to a computer
- Publish to a computer
- Assign to a user
- Publish to a user
When you assign an application to a user its icons are setup and the software installed on first usage, if you assign to a computer it will be installed the next time the computer starts up. If you publish an application the user has the option of installing the application via the Add/Remove Programs control panel applet.
Any deployed application cannot be uninstalled by the user. Published applications can be uninstalled as they are optional.
You can publish/assign applications to any group policy object which means you can assign applications on a per domain, per site or per Organizational Unit basis.
To assign an application to a GPO perform the following:
- Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
- Right click on the domain, OU or site and select Properties
- Select the 'Group Policy' tab
- Select the GPO you wish to assign/publish the application with and click edit
- Select either 'Computer Configuration' or 'User Configuration' depending on if the application is for a user or computer assignment
- Select the Software Settings\Software installation branch
- Right click on 'Software installation' and select New - Package from the context menu
- Select the MSI file you wish to deploy, make sure you access via a network path or clients will be unable to install it, e.g. \\titanic\data\winzip\winzip.msi. Click Open
- You will have the option to either publish/assign or advanced publish/assign. Click OK. If you select advance you have options to select an existing package that this one will upgrade and various other settings including Security
- The program will now be shown under the Software installation branch and will be assigned/published to any user/computer who has the GPO applied to them.