The Guide to Deploying Software Using Group Policy

The first time you see Microsoft Group Policy Software Installation (GPSI) in action, it's a wonderful thing.

In fact, when you look at it, you might think: 'Wow, this think is built with magic.'

Turns out, no magic. Well, maybe a little magic. And the best part is, it's easy to do, and free inside the box.

GPSI's job is to deploy MSI files. True, GPSI can also deploy other kinds of files, but I'm going to skip over that for today and focus only on MSI files.

Remember: MSI files are application packages that come from manufacturers (or, you can also create them yourselves with 3rd party MSI repackaging tools.) Once you have the MSI file in hand, it's not a hard process to get it out there. Though, there is one pitfall, and I'll be sure to cover that here.

Part 1: Prepare and Share

The first step in deploying MSI files is in creating the share, and getting that package into the share. In Figure 1, I'm sharing a folder out. In the next step (not shown) I have copied my MSI and any supporting files into the share.

Figure 1: Share out a folder for your software deployment.

Part II: Creating the GPO to perform the work

Next, you're going to create a GPO which performs the actual work. In Figure 2, you can see the GPO I've chosen for the task. Be sure to link it upon the users or computers you wish to deploy software to.

In my example, I'm linking a GPO over to my East Sales Users, which contains, as you might expect, user accounts.

Figure 2: Create the GPO and link it over to users or computers

Part III: Match up the correct 'side' of the GPO

In Part II, you created a GPO which was linked either to users or computers. In Figure 2 we linked the GPO to where User accounts are contained. Now, in Figure 3, we need to choose the correct 'side' to implement our instructions.

Since we are deploying to users, that means we should create the directive on the USER side. If we were trying to deploy to Computers, you would choose the Computer side within the GPO.

In Figure 3, you can see both sides contain the Software Settings node, so be sure to put your directives in the right place.

Figure 3: Software Installation settings are on both User and Computer sides

Part IV: Deploy the Software

To deploy the software, right-click on Software Installation then select New | Package as seen in Figure 4. Then select your package and click Advanced (as seen in Figure 5.)

Figure 4: Select New | Package to start your deployment

Figure 5: Choose Advanced when deploying software to see your options.

When deploying your package you have several options available to you as seen in Figure 6. The most important ones are Published / Assigned and Basic/Maximum. Here's what they mean:

  • Published / Assigned:''
    • Published means that the application appears in Add/Remove Programs applet.
    • Assigned means that the application appears on the start menu.
  • Basic/Maximum:''
    • Basic means that the user will see few / no screens when the application installs.
    • Maximum means that the user will have full interaction when the application installs.

Figure 6: Advanced Deployment options in GPSI

Part V: Seeing the software install

Windows cannot install the software while the user is already logged on.

If you log off and log back in, only then will you see the applications' icons , as seen in Figure 7.

Figure 7: The deployed application's icons.

Then, selecting the software's icons will perform the actual install, as seen in Figure 8.

Figure 8: The actual install of the software occurs when users select the application.

Final Thoughts

Group Policy Software Installation is very cool and it allows you to deploy software to your users 'on the cheap.' It's not 'super robust' since it cannot deploy software while users are already logged in, but it does the job and can be a real lifesaver if you're looking for cheap in the box to do the job.


  • 1. how can you make the installer window not
    2. B/C it is under policy does it try to install every time the user logs on? If so what option can be used to do it one time (preference maybe)?
    Thank you
    Sagun - sagunseanchetry 8 years ago
    • Sagun, I'm not sure if it works with Windows 2008, but the instructions below worked out for our Windows 2012 and no one saw the installation process, just absolutely silent installation while user is logging on (on W2012 TS, XPs and 7), the server is Win2012. Look At this http://messenger.softros.com/help/domain-install.html - taho 8 years ago
  • Really well written and helpful. Just wonder after install does it check each time? how does it not deploy over and over? - Mrken04 7 years ago
  • Great article, just a couple of additional suggestions:
    1. You should tick the box "Uninstall this application when it falls out of the scope of management" so if you withdraw the policy from any computers / users, it will uninstall the software.
    2. (Answer to the question about the window) The group policy setting is:
    Computer Configuration > Administrative Templates > System
    Enable "Verbose vs normal status messages" which will give you "Installing managed software" to Windows 7, otherwise disable it to get just "Please wait".
    3. (Answer to the question about checking each time) Yes it does check and won't install the software if the policy has already been applied.
    GPO software deployment is a great feature however where it falls down - and proper deployment tools excel - is that there is no audit trail of success or fail installs. Also published apps get installed on power up or log in, so if that's happening on lots of PCs at the same time it's a lot of network traffic. - The_Cat 5 years ago
  • I have a .msi package I installed with GP and the issue I have is domain users who are not members of the local pc admin group get prompted for a password.
    Is there a way to bypass this?
    I want to avoid prompting all my domain users to local admin for obvious security reasons. - danowolf 5 years ago
This post is locked
This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ