Systems Management

Hi Dave,
you are writing about logon scripts and MSI installs. Are you installing MSI files with logon scripts?
If yes, please stop this immediately, because this is a road which definitely leads to nowhere than big, big troubles!
For this, there is GPO Software installation.
Please read this:
http://technet2.microsoft.com/WindowsServer/en/library/dfe7b84d-8727-4561-9767-ccb47a5bf9ba1033.mspx?mfr=true

Regards, Nick

Im using GP logon scripts to run compiled scripts that have a considerable amount of logic in them and many also install 3rd party MSIs. GP software installation is intended to install MSIs but that would not include the logic code I need unless I were to modify every MSI and thats definately not a road I want to go down.

I also as a rule dont use the Publishing or Assignment features, if Im going to install an MSI, I force it to install everything thats needed, not run something on first use. I think its better to ensure software gets installed the first time rather then set it to install on first use, have it attempt to install days, weeks, or months later because the user tried to use it, fail to install, and then have to send someone to fix it. One could argue for doing it the way Microsoft intended, I have just never found their way practical in my world.

I could use ZAP files to call my scripts with GP software installation but I see no advantage in calling the scripts that way over logon scripts and Im not sure I wouldnt have the smae issue with MSIs. This isnt an ideal method but until I have SMS implemented its better then nothing.

Hi Dave,
IMHO, if you really want to push this scenario further, you will be most likely complete at your own.
As i wrote above, i wouldn't recommend this to no one, ever.
With GPO Software Install you would have much more flexibility!
With assigning you can install a package to the computer or to the users. It will be installed the next time the computer restarts.
With publishing you can give the users the ability to decide them self, if they install an app.
The biggest advantage with it is, that you do not have to give enhanced privileges to standard users.
Your logon script are only working with admin rights. Are all your users working with admin privileges?
In the time you develop a script to tailor an app (setting the things, that didn't come out of the box), you most likely build a transform for the MSI.
And this in general, will be a lot more stable, because a lot of error handling, logs etc. is already built in there.
You could extend GPO Install with a tool like 'Specops Deploy', which can install regular setup.exe's and uses BITS to transfer the packages.

ZAP files would be a enhancement, because you don't need a login as an admin to make it work.
Hope, you understand this.

Regards, Nick

I appreciate your opinion and I do understand what your saying. As I said, you could argue for doing it the Microsoft way.

Unfortunately I live in a world where to many of my apps still complain when you dont have admin privledges. Until every app has been tested (are we are talking hundreds of apps) having users with limited privledges is only a dream. We do have a union here so I cant simply take away rights and pick up the pieces later or we would have all kinds of grievances.

Publishing apps is only an option for my power users, I simply cant provide intructions for all my users to go out and install things every time we want them to have something new. If for example I published Office 2007 and gave users instructions to install it via add/remove, they would flood the helpdesk a month from now complaining that they dont have it because they either didnt read the instructions, auto deleted them, didnt know how to follow them, have no clue we ever told them, or just didnt want to do it themselves. Its just not a realistic option.

I have on occasion had to create a transform for an MSI as well as write a custom script to handle a dozen other possible problems that couldnt be accounted for with the built in tools that create the transform. Yes I do use the logging for MSI's and many of their features during installs, they just cant account for everything.

Third party products like 'Specops Deploy' wouldnt exist if GP software installation was sufficient, nor would sites like AppDeploy be needed if every install just worked. Those products cost money, my scripts are free. Im sure Im far from the only one that uses login scripts in this manner but yes I agree there are potential rights issues and features that I cant use because of doing it this way.

In a perfect world, Ill be using SMS with Vista UAC with no GP logon scripts, the reality may be having to use a half dozen products used in unconventional ways to get the job done.

Thanks