COMP-10051
MS SERVER ADMIN II
GPO Client Configuration and Software
Deployment
IntelliMirror
• IntelliMirror is a set of Windows O.S. features that are
implemented through Group Policy definitions
• Makes it possible for a user to always have access to the
same computing environment no matter what computer in
the domain they're using
• User data management – Folder redirection
• Software installation and maintenance – Windows Installer
• User settings management – Roaming profiles
IntelliMirror Software Installation and Maintenance
• Automates the installation, configuration and removal of
applications, service packs and software upgrades
• Allows the same set of applications to be available on any
computer that a user logs on to
• From the user's point of view, little or no installation
procedures need to be performed to make these
applications available
• Two options for deploying applications:
• Published applications
• Assigned applications
Published Applications
• Published to users only (not to computers)
• Published applications appear in the Control Panel’s
Programs and Features applet so it is up to the user to
initiate the application’s installation
• Installation also occurs when a user or application
attempts to open a file that requires a specific published
application
Assigned Applications
• Assigned to users or computers
• If assigned to a computer, the application will install next
time the computer is booted
• If assigned to a user the application will be installed:
• When the user tries run that assigned application
• When the user attempts to open a document associated with an
assigned application
• When the user logs on
Implemented with Group Policies
• Group policy objects are used to determine how the
application deployment will be handled (i.e. published or
assigned) for the various users and computers in the
domain
• Which users have applications published to them
• Which users and/or computers have applications assigned to them
• Installation file format must be .msi (Microsoft Installer
Files)
• May have to acquire conversion software to convert from .exe.
to .msi format
AD GPO User and Computer Scripts
• Various scripts can be configured for users and computer
using Group Policy objects
• User Scripts
• Logon scripts – executed when the user logs on to a computer
• Logoff scripts – executed when the user logs off of a computer
• Computer Scripts
• Startup scripts – executed when the computer boots
• Shutdown scripts – executed when the computer shuts down.
User Logon Scripts
• Scripts can be assigned to all users and computers in a
domain or they can be assigned to just the users and
computers in a given OU, site or a single domain in a
multi-domain environment
• The logon script can be a command shell script file
• A series of commands interpreted using the windows [Link] shell
• Or a PowerShell script file
• A series of commands interpreted using the windows
[Link] shell
User Logon Scripts
• The logon script file must be saved in the Sysvol folder
which is replicated to all Domain Controllers in the AD
Forest.
%SystemRoot%\SYSVOL\sysvol\<Domain DNS Name>\Policies\{GUID}\User \
Scripts\Logon
The GUID value is the unique identifier for the specific Group Policy Object
containing the logon script.
GPO WMI Filters
• Windows Management Instrumentation (WMI) filters allow
you to dynamically determine the scope of Group Policy
objects (GPOs) based on attributes of the target
computer.
• When a GPO that is linked to a WMI filter is applied on
the target computer, the filter is evaluated on the target
computer.
• If the WMI filter evaluates to false, the GPO is not applied
• If the WMI filter evaluates to true, the GPO is applied.
• Requires Windows 2000 and above clients
WMI Filters
• A WMI filter consists of one or more queries based on the specified
WMI class.
• The queries are written using the WMI Query Language (WQL), a
SQL-like language.
• Queries can be combined with AND and OR logical operators
• Each query is executed against a particular WMI namespace.
• The default is root\CIMv2, which is appropriate for most WMI queries.
• The WMI filter is created in the Group Policy Management console
as a separate object from the GPO
• The filter is linked to the desired GPO in the WMI filtering section on the GPO’s
Scope tab.
• Each GPO can have only one WMI filter, however the same WMI filter can be
linked to multiple GPOs.
WMI Query Language – WQL
• Example:
Select * from Win32_OperatingSystem where Version like “6.3%” and
ProductType = “1”
• WQL Operators reference
[Link]
Commands used in the lab
• Windows Update Standalone Installer ([Link])
• Command for installing individual windows update packages
Example:
[Link] [Link] /quiet /norestart
• Invoke-command
• Invoke-command –ScriptBlock {code}
• Invoke-command –filePath C:\scriptfile.ps1
Example:
• Invoke-command {[Link] [Link]
/quiet /norestart}
In the lab
• Create and share a software deployment folder on the
AcmeServer domain controller
• Install the Remote Administration tools using a GPO login
script
• Publish a software package using GPO Software policies
(IntelliMirror)