You (as an administrator) can use Group Policy to assign
or to publish software to users or computers in a domain. Additionally, it is useful to be
able to deploy software based on group membership. A Group Policy object (GPO) is usually applied only to members of an organizational unit (OU) to which the GPO is linked. Because a user cannot be located in several OUs at the same time, you must be able to apply Group Policy settings outside the boundaries of OUs. This article describes how to have your software deployment policy applied to users who are not in an OU.
Assign a program to a group
- Create a folder to hold the Windows Installer package on a server. Share the folder by applying permissions that let users and computers read and run these files. Then, copy the MSI package files into this location.
- From a Windows Server 2003-based computer in the domain,
log on as a domain administrator, and then start Active Directory Users and
- In Active Directory Users and Computers,
right-click the container to which you want to link the GPOs, and then click
- Click the Group Policy tab, and then click
New to create a new GPO for installing the Windows Installer
package. Give the new GPO a descriptive name.
- Click the new GPO, and then click
The Group Policy Object Editor starts.
- Right-click the Software Settings folder under
either Computer Configuration or User
Configuration, point to New, and then click
- The Software Settings folder under
Computer Configuration contains software settings that apply
to all users who log on to the computer. This folder contains software
installation settings. It may also contain other settings that are put there by
independent software vendors.
- The Software Settings folder under
User Configuration contains software settings that apply to
users regardless of which computer they log on to. This folder also contains
software installation settings. It may contain other settings that are put
there by independent software vendors.
- In the Open dialog box, type the
Universal Naming Convention (UNC) path of the Windows Installer file (.msi) for
this package in the File name box, and then click
Note If the Windows Installer file resides on the local hard disk, do not use a local path. Instead, use the UNC path of the local computer to indicate the location of the installation files. A UNC path takes the form \\servername\sharename\path\filename.msi.
- In the Deploy Software dialog box, do one
of the following:
- Click Assigned to specify that the
application is deployed as assigned and that default settings are used for
- Click Advanced to specify that you are
manually editing the package properties instead of accepting the defaults. You
can also choose between assign and publish for the deployment method.
- When you are prompted to choose between Advanced and Assigned, click Assigned unless you have to
modify the advanced options.
- Click OK.
The software package
appears in the details pane of the Group Policy Object Editor.
- Close the Group Policy Object Editor.
- In the GPO
Properties dialog box, click the GPO, and then click
- Click the Security tab.
- Click Authenticated Users in the
Group or user names list, and then click
- Click Add, select the security group that
you want this policy applied to, and then click OK to add the
security group to the list.
- Select the security group, and then under
Permissions for Users, click to select the
READ and the Apply Group Policy check boxes
in the Allow column.
- Click Apply, click OK, click Apply,
and then click OK.
Changes to a GPO are not immediately applied on the target computers. Instead, changes are applied according to the current Group Policy update interval. You can use the Secedit.exe command-line tool to impose GPO settings upon a target workstation immediately. For more information about how to use Secedit.exe, see the Windows Server 2003 Help
and Support Center.
Article ID: 324750 - Last Review: March 14, 2007 - Revision: 6.6
- Microsoft Windows Server 2003, Standard Edition (32-bit x86)
- Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
- Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
- Microsoft Windows Server 2003, Enterprise x64 Edition
- Microsoft Windows Server 2003, 64-Bit Datacenter Edition
|kbmgmtservices kbhowtomaster kbtool KB324750|