Software Deployment

Install only during your maintenance window?

BTW, there is a dedicated SCCM/SMS forum on AppDeploy.

What I end up doing in my package to prevent the user from relogging in while it is running is throw up a shutdown with a message asking them not to reboot the box because software is being installed. While a shutdown screen is present, they will not be able to logon. If the package fails or when it is finished, the reboot is aborted and the customer can log back in normally.

If you have AD (Active Directory) setup, you can use group policy to push the installation. It will be applied when the next time user logs on. This way, you don't have to worry about preventing the user from logging in till the installation is over.

Anyone who's used SCCM and Group Policy will know which is the better option, even given SCCM's foibles.

For SCCM in the Package\Programs [InstallName] properties select the environment tab and select Program Can Run: drop down box and select Only When User Is Loged Off the package will only run in this state if someone logs on then the package will not install

ORIGINAL: langa100

For SCCM in the Package\Programs [InstallName] properties select the environment tab and select Program Can Run: drop down box and select Only When User Is Loged Off the package will only run in this state if someone logs on then the package will not install


Very true, but it doesn't stop anyone logging on after the installation has started... only way to be sure of this is to schedule the deployment out of hours and get users to leave their machines on (but logged off obviously)

As milindsm said, you can do this via AD. Machine based "assigned" policies means the install occurs before ctrl+alt+del is even presented. User based policies apply after logon but before the desktop is presented. Main downside of AD being that if there is a problem with the install / uninstall the machine can site there until it times out - I believe this can be hours... I've seen it and it's not nice.

There are pros and cons to all deployment tools, you just have to make the best of what you have.

Cheers,
Rob.

Dale,

I can tell you the tool we use here (or well, vbs function) uses a combination of

- ntrights.exe -r SeInteractiveLogonRight, applied to the Users group, to revoke interactive logon rights.
- setting the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ShutdownWithoutLogon regkey to 0, to disable the shutdown button in the Logon Dialog

Ofcourse, after the install, you would need another function to restore the above [:D]

Hope this helps

PJ

Thanks everyone for the tips! I want to stay with SCCM as that is our distribution tool. I don't want to make our company try to manage a one off scenario.

It sounds like pjgeutjens has a good lead of me to follow. That is the type of solution that I think we need.

Thanks again

Dale

Of course SCCM includes WOL (Wake on Lan), so you could schedule overnight and wake the machines up to receive the deployment.

thanks,

Dunnpy

Our greatest concern are laptops. We have a lot of VPN users.