How to assign application to computer

[el]

Hi all,
I am new to use group policy to deploy application to desktops or users.

The application I used to try was Office Compatibility Pack 2007. I had tried several different ways to assign it to several desktops. The common works I had done for the different tries were:
1.. Created a new Deploy Application OU under MyDomainName domain in Active Directory Users and Computers (ADUC)
2.. Created a new MS Office Compatibility Pack 2007 OU under Deploy Application OU
3.. Created a new assign group policy called Assign to computers in Properties window of MS Office Compatibility Pack 2007 OU and have the MSI file and other settings entered
I then use different ways to test the deployment. Each test was done on different computer:
1.. I moved a Computer object called TestMachine1 from Computers container to MS Office Compatibility Pack 2007 OU and restarted the test machine. The application was deployed correctly.
2.. In the Properties windows of Assign to computers group policy, I add TestMachine2 Computer object to the ACL and gave it Read and Apply Group Policy Allow permissions in Security tab. The application could not deployed to the test machine.
3.. I even tried to create a security group and put a test machine Computer object as a member of this security group and then gave the security group Read and Apply Group Policy Allow permission in Assign to computers group policy. The application could not be deployed to the test machine either.
The purpose of test 2 is to find a way to deploy multiple applications to a different desktops. The numbers of different combinations of applications and desktops do not allow us to have a single group policy applies to all desktops.

Could someone explain those failures and help me on the multiple deployments?

TIA,
el

 

[Florian Frommherz [MVP]]

Howdie!

el schrieb:
> Hi all,
> I am new to use group policy to deploy application to desktops or users.
> [...]
> I then use different ways to test the deployment. Each test was done on
> different computer:
>
> 1. I moved a Computer object called TestMachine1 from *Computers*
> container to *MS Office Compatibility Pack 2007* OU and restarted
> the test machine. The application was deployed correctly.

That's clear. You moved the computer account into the OU where the
Software Installation policy is linked. The machine is now in the scope
of the policy - it'll pull the policies down the domain controller and
start processing them.

> 2. In the *Properties* windows of *Assign to computers* group policy,
> I add *TestMachine2* Computer object to the ACL and gave it *Read*
> and *Apply Group Policy* *Allow* permissions in Security tab. The
> application could not deployed to the test machine.
> 3. I even tried to create a security group and put a test machine
> Computer object as a member of this security group and then gave
> the security group *Read* and *Apply Group Policy* A*llow*
> permission in *Assign to computers* group policy. The application
> could not be deployed to the test machine either.

This won't work as the machines don't know of that policy. You need to
put those machines into the OU where you linked the Software
Installation GP to. The Active Directory objects (I mean users and
computers by that) need to be in the scope of the policy - the scope is
the OU or a subOU where the policy is linked. Move the users into that
OU or link your policy to an OU (built-in "Computers" is not an OU, it's
a container!) where the machines are in.

cheers,

Florian
--
Microsoft MVP - Windows Server - Group Policy.
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.

 

[Anthony]

The GPO needs to be in the OU the computers are in
You can filter the GPO by creating a group, then in the security tab of the GPO specify the group. You can either Deny Authenticated Users and Allow the group you created, or vice versa.
Anthony
http://www.airdesk.co.uk


"el" <drop_msg -@- hotmail -DOT- com> wrote in message news:eQQQ%23$lzHHA.1208@TK2MSFTNGP05.phx.gbl...
Hi all,
I am new to use group policy to deploy application to desktops or users.

The application I used to try was Office Compatibility Pack 2007. I had tried several different ways to assign it to several desktops. The common works I had done for the different tries were:
1.. Created a new Deploy Application OU under MyDomainName domain in Active Directory Users and Computers (ADUC)
2.. Created a new MS Office Compatibility Pack 2007 OU under Deploy Application OU
3.. Created a new assign group policy called Assign to computers in Properties window of MS Office Compatibility Pack 2007 OU and have the MSI file and other settings entered
I then use different ways to test the deployment. Each test was done on different computer:
1.. I moved a Computer object called TestMachine1 from Computers container to MS Office Compatibility Pack 2007 OU and restarted the test machine. The application was deployed correctly.
2.. In the Properties windows of Assign to computers group policy, I add TestMachine2 Computer object to the ACL and gave it Read and Apply Group Policy Allow permissions in Security tab. The application could not deployed to the test machine.
3.. I even tried to create a security group and put a test machine Computer object as a member of this security group and then gave the security group Read and Apply Group Policy Allow permission in Assign to computers group policy. The application could not be deployed to the test machine either.
The purpose of test 2 is to find a way to deploy multiple applications to a different desktops. The numbers of different combinations of applications and desktops do not allow us to have a single group policy applies to all desktops.

Could someone explain those failures and help me on the multiple deployments?

TIA,
el

 

[KTC]

I'll assume you are using Group Policy Management Console.
http://www.microsoft.com/downloads/...24-8cbd-4b35-9272-dd3cbfc81887&DisplayLang=en

Make sure "Domain Computers" group are in the Scope Tab section Security Filtering. Assign apps are done at the computer level.

In the Delegation Tab section you can try to control individual PC's.

Hope this helps.
"el" <drop_msg -@- hotmail -DOT- com> wrote in message news:eQQQ%23$lzHHA.1208@TK2MSFTNGP05.phx.gbl...
Hi all,
I am new to use group policy to deploy application to desktops or users.

The application I used to try was Office Compatibility Pack 2007. I had tried several different ways to assign it to several desktops. The common works I had done for the different tries were:
1.. Created a new Deploy Application OU under MyDomainName domain in Active Directory Users and Computers (ADUC)
2.. Created a new MS Office Compatibility Pack 2007 OU under Deploy Application OU
3.. Created a new assign group policy called Assign to computers in Properties window of MS Office Compatibility Pack 2007 OU and have the MSI file and other settings entered
I then use different ways to test the deployment. Each test was done on different computer:
1.. I moved a Computer object called TestMachine1 from Computers container to MS Office Compatibility Pack 2007 OU and restarted the test machine. The application was deployed correctly.
2.. In the Properties windows of Assign to computers group policy, I add TestMachine2 Computer object to the ACL and gave it Read and Apply Group Policy Allow permissions in Security tab. The application could not deployed to the test machine.
3.. I even tried to create a security group and put a test machine Computer object as a member of this security group and then gave the security group Read and Apply Group Policy Allow permission in Assign to computers group policy. The application could not be deployed to the test machine either.
The purpose of test 2 is to find a way to deploy multiple applications to a different desktops. The numbers of different combinations of applications and desktops do not allow us to have a single group policy applies to all desktops.

Could someone explain those failures and help me on the multiple deployments?

TIA,
el

 

[el]

Can I put computers into a security group and in GPO giving that group Allow permission? Will the application be installed onto the members (which are computers) of that security group?
"Anthony" <anthony.spam@spammedout.com> wrote in message news:e4Yx4KtzHHA.600@TK2MSFTNGP05.phx.gbl...
The GPO needs to be in the OU the computers are in
You can filter the GPO by creating a group, then in the security tab of the GPO specify the group. You can either Deny Authenticated Users and Allow the group you created, or vice versa.
Anthony
http://www.airdesk.co.uk


"el" <drop_msg -@- hotmail -DOT- com> wrote in message news:eQQQ%23$lzHHA.1208@TK2MSFTNGP05.phx.gbl...
Hi all,
I am new to use group policy to deploy application to desktops or users.

The application I used to try was Office Compatibility Pack 2007. I had tried several different ways to assign it to several desktops. The common works I had done for the different tries were:
1.. Created a new Deploy Application OU under MyDomainName domain in Active Directory Users and Computers (ADUC)
2.. Created a new MS Office Compatibility Pack 2007 OU under Deploy Application OU
3.. Created a new assign group policy called Assign to computers in Properties window of MS Office Compatibility Pack 2007 OU and have the MSI file and other settings entered
I then use different ways to test the deployment. Each test was done on different computer:
1.. I moved a Computer object called TestMachine1 from Computers container to MS Office Compatibility Pack 2007 OU and restarted the test machine. The application was deployed correctly.
2.. In the Properties windows of Assign to computers group policy, I add TestMachine2 Computer object to the ACL and gave it Read and Apply Group Policy Allow permissions in Security tab. The application could not deployed to the test machine.
3.. I even tried to create a security group and put a test machine Computer object as a member of this security group and then gave the security group Read and Apply Group Policy Allow permission in Assign to computers group policy. The application could not be deployed to the test machine either.
The purpose of test 2 is to find a way to deploy multiple applications to a different desktops. The numbers of different combinations of applications and desktops do not allow us to have a single group policy applies to all desktops.

Could someone explain those failures and help me on the multiple deployments?

TIA,
el

 

[Florian Frommherz [MVP]]

Howdie!

el schrieb:
> Can I put computers into a security group and in GPO giving that group
> Allow permission? Will the application be installed onto the members
> (which are computers) of that security group?

No - you need to put the computer accounts into the OU or a subOU. You
cannot use a security group for this. Group Policy only applies to user
and computer accounts.

cheers,

Florian
--
Microsoft MVP - Windows Server - Group Policy.
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.

 

[Anthony]

Yes, you put the computers in the security group. Computers are already in Authenticated Users, so:
- If you want to block every computer except the group, you would remove Authenticated users, add you group and Allow it
- If you want to install on all except your group, you add the group and Deny it.
Make sure the computers are in the OU where the GPO is.
Anthony
http://www.airdesk.co.uk




"el" <drop_msg -@- hotmail -DOT- com> wrote in message news:%23eTlSqyzHHA.1208@TK2MSFTNGP03.phx.gbl...
Can I put computers into a security group and in GPO giving that group Allow permission? Will the application be installed onto the members (which are computers) of that security group?
"Anthony" <anthony.spam@spammedout.com> wrote in message news:e4Yx4KtzHHA.600@TK2MSFTNGP05.phx.gbl...
The GPO needs to be in the OU the computers are in
You can filter the GPO by creating a group, then in the security tab of the GPO specify the group. You can either Deny Authenticated Users and Allow the group you created, or vice versa.
Anthony
http://www.airdesk.co.uk


"el" <drop_msg -@- hotmail -DOT- com> wrote in message news:eQQQ%23$lzHHA.1208@TK2MSFTNGP05.phx.gbl...
Hi all,
I am new to use group policy to deploy application to desktops or users.

The application I used to try was Office Compatibility Pack 2007. I had tried several different ways to assign it to several desktops. The common works I had done for the different tries were:
1.. Created a new Deploy Application OU under MyDomainName domain in Active Directory Users and Computers (ADUC)
2.. Created a new MS Office Compatibility Pack 2007 OU under Deploy Application OU
3.. Created a new assign group policy called Assign to computers in Properties window of MS Office Compatibility Pack 2007 OU and have the MSI file and other settings entered
I then use different ways to test the deployment. Each test was done on different computer:
1.. I moved a Computer object called TestMachine1 from Computers container to MS Office Compatibility Pack 2007 OU and restarted the test machine. The application was deployed correctly.
2.. In the Properties windows of Assign to computers group policy, I add TestMachine2 Computer object to the ACL and gave it Read and Apply Group Policy Allow permissions in Security tab. The application could not deployed to the test machine.
3.. I even tried to create a security group and put a test machine Computer object as a member of this security group and then gave the security group Read and Apply Group Policy Allow permission in Assign to computers group policy. The application could not be deployed to the test machine either.
The purpose of test 2 is to find a way to deploy multiple applications to a different desktops. The numbers of different combinations of applications and desktops do not allow us to have a single group policy applies to all desktops.

Could someone explain those failures and help me on the multiple deployments?

TIA,
el