Software Deployment

Some initial background:

We have about 250 staff using Windows XP SP-2. We are using Windows 2003 servers.

We have 1 major Group Policy object in Active Directory for software deployment it is called BCSCNet Global Policy.

We are deploying (assigning) all software to computers only within the this 1 BCSCNet Global Policy. No publishing to users.

Some of our packages are deployed to all computers (e.g Microsoft Office 2003, Lotus Notes, etc).

When I add these packages to the group policy and I examine the "security tab" it says authenticated users - ie next reboot
of all computers these packages will be deployed - that is just fine.

Some of the software packages (e.g Adobe Acrobat Professional 7.0) is only going to a specific group of computers.

I therefore have setup a series of software application groups in Active Directory e.g SG APP Adobe Acrobat Professional 7.0.

In this group I have added the computer names that will need this software e.g

Computer1
Computer2
Computer3
Computer4
Computer5
Computer6

When I assign Adobe Acrobat Professional 7.0 in Active Directory I go to the security tab and remove the authenticated users and add
my special group SG APP Adobe Acrobat Professional 7.0. I give this group read access permissions.

Now when Computers1,2,3,4,5,6 are restarted Adobe Acrobat Professional 7.0 is deployed to their computer - just as I expected. So far
everything is working fine.

A few weeks latter, it is decided that Computer6 no longer needs Adobe Acrobat Professional 7.0. I go into my SG APP Adobe Acrobat Professional 7.0
group and remove Computer6 from the group.

I then do a gpupdate on Computer6 and restart. What I think should happen - ie automatic uninstall of Adobe Acrobat Professional 7.0 "does not" happen.

What am I doing wrong?

Of note, in the Deployment Tab for all of our software (including Adobe Acrobat Professional 7.0) we have chosen "not" to tick the box
"Uninstall This Application When It Falls out of the Scope of Management". My understanding is that this applies when a user or computer is removed
from the group policy object in which it resides. In our environment, we have "1" and only 1 group policy object for software deployment. We are not actually
removing the computer from this group policy object - just removing its membership within an application group.

Can you assist me with some understanding about "this" tick box. We want to be able to automatically "uninstall" software from our groups- just like the
scenario outlined above.

As I said we have 1 group policy object for software deployment - BCSCNet Global Policy. In BCSCNet Group Policy we are pushing out all of our software
packages - some to all computers, some to only a specific subset of computers.

I have seen where some people have suggested creating special group policy objects for each software package - eg. BCSCNet Adobe Acrobat Professional,
BCSCNet Adobe Photoshop, etc, etc. Is this a better way to provide more "granularity" in software deployment.

In any event I hope this long winded message makes sense.