Fall out of scope of managment
Can anyone tell me exactly what this does?
We deploy software from GPO by Sites and Services. I finally found out one thing it does. If I don't have it checked and I remove someone from a group it does not uninstall the software automatically. If I have it checked and remove someone from the group it automitically uninstalls the software. I think that's what I want.
Here's the real question I have. I wonder if I have this option checked and someone goes with their laptop from one site to another site will it fall out of scope of management and uninstall the software? This I don't want. Seems like I read something like that here once. I'd like to have it checked but don't want this to ever happen to a user.. so may have to uncheck it.
Thanks for all your help in advance.
We deploy software from GPO by Sites and Services. I finally found out one thing it does. If I don't have it checked and I remove someone from a group it does not uninstall the software automatically. If I have it checked and remove someone from the group it automitically uninstalls the software. I think that's what I want.
Here's the real question I have. I wonder if I have this option checked and someone goes with their laptop from one site to another site will it fall out of scope of management and uninstall the software? This I don't want. Seems like I read something like that here once. I'd like to have it checked but don't want this to ever happen to a user.. so may have to uncheck it.
Thanks for all your help in advance.
0 Comments
[ + ] Show comments
Answers (9)
Please log in to answer
Posted by:
cdupuis
19 years ago
No, if a laptop user removes the laptop from the network then the apps will still be installed, it will not remove them. What they mean by management is if the machine/user remains a part of the domain and if it still falls under that Group Policy. The only way Acitve Directory knows that the machine is no longer under management is if you tell it to move or delete a computer or user account. In that case, even if you did that when laptop is disconnected, technically it would never get the new policy refresh saying that AD wants the software removed, therefore it would not remove the software until it got the policy refresh, which means plugged back in to the network, then AD would tell it to remove the application.
Posted by:
snooper47374
19 years ago
Thanks for the answer.
One more question though. Say I have a user that works in site A 99 percent of the time. He goes to site B for 1% of the time. He's in the group FrontPage2002. It deployed it to him in Site A. If he goes to Site B will his software be installed again from that server?
One more question though. Say I have a user that works in site A 99 percent of the time. He goes to site B for 1% of the time. He's in the group FrontPage2002. It deployed it to him in Site A. If he goes to Site B will his software be installed again from that server?
Posted by:
cdupuis
19 years ago
No, as long as both sites are part of the same domain. If they are different domains it should still be OK unless you have created a second group at the other site (in the other domain) and specified to install frontpage2002, then it would instasll again. So as long as the AD information at both sites is accurate and we assume that we are dealing with the same domain, then it will not remove and reinstall.
Posted by:
cdupuis
19 years ago
Unless replication is broken, then it may try to force a different version of that policy onto that machine, then who knows what could happen.
Posted by:
snooper47374
19 years ago
Thanks guys.
Btw, now I don't see any reason not to have the "Uninstall if fall out of scope of managment" checked. That way if i want to remove the software from the user I can just take them out of the policy.
Btw, now I don't see any reason not to have the "Uninstall if fall out of scope of managment" checked. That way if i want to remove the software from the user I can just take them out of the policy.
Posted by:
cdupuis
19 years ago
One thing I found as being an anoyance was if the computer account became corrupt (and that does happen) and you have to remove the computer from the domain then rejoin it, it will have to go through the entire uninstall/reinstall for each app published to that machine. That can cause extra downtime and headaches, especially if you are only on a 10MBit link to your server.
Posted by:
cdupuis
19 years ago
It does make for good license control. But more often than not, if you regualarly move machine accounts around or user accounts to different OUs then it can be anoying.
Posted by:
snooper47374
19 years ago
I don't really use OUs for software distribution. I really only use Sites and Services for software distribution. That way software gets pushed down according to the server and then group they belong to.
Posted by:
cdupuis
19 years ago
So then, what process do you use to distribute software? Do you take an MSI file, the make a new GPO and add it to the software installation section? If so, how are you managing to assign it to a site as opposed to an OU? Make sure you keep that in mind, unless you have made OUs for each site.
Rating comments in this legacy AppDeploy message board thread won't reorder them,so that the conversation will remain readable.