Active Directory network deployment - Revision history

Stevenlawrance: /* Create a computer group for those computers that you want to install IE URL Lock onto */

2007-07-30T06:28:07Z

Create a computer group for those computers that you want to install IE URL Lock onto

← Older revision		Revision as of 06:28, 30 July 2007
Line 10:		Line 10:
	#Add the computers that you want to install IE URL Lock onto		#Add the computers that you want to install IE URL Lock onto

	With a group in place and the package properly configured in ActiveDirectory, adding computers to this group will automatically install IE URL Lock on them when they reboot, and removing computers will automatically uninstall IE URL Lock from them when they reboot. ~~Cool, eh? :-)~~		With a group in place and the package properly configured in ActiveDirectory, adding computers to this group will automatically install IE URL Lock on them when they reboot, and removing computers will automatically uninstall IE URL Lock from them when they reboot.

	==Copy the IE URL Lock MSI file into a shared folder on the server==		==Copy the IE URL Lock MSI file into a shared folder on the server==

Stevenlawrance: /* Adding the installation information to the group policy */

2007-07-30T05:50:35Z

Adding the installation information to the group policy

← Older revision		Revision as of 05:50, 30 July 2007
Line 39:		Line 39:
	#Navigate to the shared folder that contains the IE URL Lock installation MSI package file through the network path and select the IE URL Lock MSI package file. Don't use the local path; workstations will be unable to install the MSI if you do that. Windows will warn you if you try to use the local path. In my example, I navigated to \\W2003server\Share<br/>[[Image:Select-msi-from-share.png]]		#Navigate to the shared folder that contains the IE URL Lock installation MSI package file through the network path and select the IE URL Lock MSI package file. Don't use the local path; workstations will be unable to install the MSI if you do that. Windows will warn you if you try to use the local path. In my example, I navigated to \\W2003server\Share<br/>[[Image:Select-msi-from-share.png]]
	#When asked for the deployment type, you can select either "Assigned" or "Advanced." The difference is that the latter will open up the properties window automatically for you. If you selected "Advanced," then you can right-click on the newly-added package and select "Properties" to proceed to the next step		#When asked for the deployment type, you can select either "Assigned" or "Advanced." The difference is that the latter will open up the properties window automatically for you. If you selected "Advanced," then you can right-click on the newly-added package and select "Properties" to proceed to the next step
	#Click on the "Deployment" tab and select the "Uninstall this application when it falls out of the scope of management" to enable automatic uninstallation when you remove computers from this policy either directly or via a group of computers. Press the OK button to save these changes		#'''Important:''' Click on the "Deployment" tab and select the "Uninstall this application when it falls out of the scope of management" to enable automatic uninstallation when you remove computers from this policy either directly or via a group of computers. Press the OK button to save these changes
	#IE URL Lock will now install automatically onto computers that this policy applies to after they are restarted		#IE URL Lock will now install automatically onto computers that this policy applies to after they are restarted

Stevenlawrance: /* Adding the installation information to the group policy */

2007-07-30T05:50:09Z

Adding the installation information to the group policy

← Older revision		Revision as of 05:50, 30 July 2007
Line 39:		Line 39:
	#Navigate to the shared folder that contains the IE URL Lock installation MSI package file through the network path and select the IE URL Lock MSI package file. Don't use the local path; workstations will be unable to install the MSI if you do that. Windows will warn you if you try to use the local path. In my example, I navigated to \\W2003server\Share<br/>[[Image:Select-msi-from-share.png]]		#Navigate to the shared folder that contains the IE URL Lock installation MSI package file through the network path and select the IE URL Lock MSI package file. Don't use the local path; workstations will be unable to install the MSI if you do that. Windows will warn you if you try to use the local path. In my example, I navigated to \\W2003server\Share<br/>[[Image:Select-msi-from-share.png]]
	#When asked for the deployment type, you can select either "Assigned" or "Advanced." The difference is that the latter will open up the properties window automatically for you. If you selected "Advanced," then you can right-click on the newly-added package and select "Properties" to proceed to the next step		#When asked for the deployment type, you can select either "Assigned" or "Advanced." The difference is that the latter will open up the properties window automatically for you. If you selected "Advanced," then you can right-click on the newly-added package and select "Properties" to proceed to the next step
	#Click on the "Deployment" tab and select the "Uninstall this application when it falls out of the scope of management" to enable ~~easy~~ uninstallation. Press the OK button to save these changes		#Click on the "Deployment" tab and select the "Uninstall this application when it falls out of the scope of management" to enable automatic uninstallation when you remove computers from this policy either directly or via a group of computers. Press the OK button to save these changes
	#IE URL Lock will now install automatically onto computers that this policy applies to after they are restarted		#IE URL Lock will now install automatically onto computers that this policy applies to after they are restarted

Stevenlawrance: /* Create or reuse a configuration policy */

2007-07-30T05:47:28Z

Create or reuse a configuration policy

← Older revision		Revision as of 05:47, 30 July 2007
Line 44:		Line 44:
	==Create or reuse a configuration policy==		==Create or reuse a configuration policy==
	Depending on your needs, you can configure IE URL Lock using computer, group, or user policies. Most administrators will likely want to use group policies to configure IE URL Lock to give different user groups different levels of access to Internet Explorer.		Depending on your needs, you can configure IE URL Lock using computer, group, or user policies. Most administrators will likely want to use group policies to configure IE URL Lock to give different user groups different levels of access to Internet Explorer.

			[[Group policy editor with Active Directory\|Read the ActiveDirectory configuration page for more information]].

Stevenlawrance: /* Create a computer group for those computers that you want to install IE URL Lock onto */

2007-07-30T05:45:18Z

Create a computer group for those computers that you want to install IE URL Lock onto

← Older revision		Revision as of 05:45, 30 July 2007
Line 9:		Line 9:
	#Click on the "Members" tab		#Click on the "Members" tab
	#Add the computers that you want to install IE URL Lock onto		#Add the computers that you want to install IE URL Lock onto

			With a group in place and the package properly configured in ActiveDirectory, adding computers to this group will automatically install IE URL Lock on them when they reboot, and removing computers will automatically uninstall IE URL Lock from them when they reboot. Cool, eh? :-)

	==Copy the IE URL Lock MSI file into a shared folder on the server==		==Copy the IE URL Lock MSI file into a shared folder on the server==

Stevenlawrance: /* Adding the installation information to the group policy */

2007-07-30T05:43:24Z

Adding the installation information to the group policy

← Older revision		Revision as of 05:43, 30 July 2007
Line 38:		Line 38:
	#When asked for the deployment type, you can select either "Assigned" or "Advanced." The difference is that the latter will open up the properties window automatically for you. If you selected "Advanced," then you can right-click on the newly-added package and select "Properties" to proceed to the next step		#When asked for the deployment type, you can select either "Assigned" or "Advanced." The difference is that the latter will open up the properties window automatically for you. If you selected "Advanced," then you can right-click on the newly-added package and select "Properties" to proceed to the next step
	#Click on the "Deployment" tab and select the "Uninstall this application when it falls out of the scope of management" to enable easy uninstallation. Press the OK button to save these changes		#Click on the "Deployment" tab and select the "Uninstall this application when it falls out of the scope of management" to enable easy uninstallation. Press the OK button to save these changes
	#IE URL Lock will now install on computers that this policy applies to ~~when~~ they ~~restart~~		#IE URL Lock will now install automatically onto computers that this policy applies to after they are restarted

	==Create or reuse a configuration policy==		==Create or reuse a configuration policy==
	Depending on your needs, you can configure IE URL Lock using computer, group, or user policies. Most administrators will likely want to use group policies to configure IE URL Lock to give different user groups different levels of access to Internet Explorer.		Depending on your needs, you can configure IE URL Lock using computer, group, or user policies. Most administrators will likely want to use group policies to configure IE URL Lock to give different user groups different levels of access to Internet Explorer.

Stevenlawrance: /* Create a new computer-based installation policy */

2007-07-30T05:42:16Z

Create a new computer-based installation policy

← Older revision		Revision as of 05:42, 30 July 2007
Line 22:		Line 22:
	#Right-click on the domain that you want to add the policy to and select "Create and Link GPO Here." Give your new group policy object a name, such as "IE URL Lock"<br/>[[Image:Gpm-createandlinkgpo.png]]		#Right-click on the domain that you want to add the policy to and select "Create and Link GPO Here." Give your new group policy object a name, such as "IE URL Lock"<br/>[[Image:Gpm-createandlinkgpo.png]]
	#Click on the newly created group policy object		#Click on the newly created group policy object
	#In the "Security Filtering" section for this newly created group policy object, click on the "Add..." button ~~and~~ add computers ~~that~~ you want to ~~install IE URL Lock onto~~		#In the "Security Filtering" section for this newly created group policy object, click on the "Add..." button. If you created a group for the IE URL Lock computers, then add that group of computers. If you want to add computers individually here, then add those computers now
	#Remove "Authenticated Users" from the "Security Filtering" section if it was automatically added. We want this policy to apply only to computers		#Remove "Authenticated Users" from the "Security Filtering" section if it was automatically added. We want this policy to apply only to computers
	#After adding the computers, right-click on your new GPO and select "Edit..." from the right-click menu		#After adding the computers or group(s) of computers, right-click on your new GPO and select "Edit..." from the right-click menu
	#Jump to the section below entitled "Adding the installation information to the group policy"		#Jump to the section below entitled "Adding the installation information to the group policy"

Stevenlawrance: /* Adding the installation information to the group policy */

2007-07-30T05:40:38Z

Adding the installation information to the group policy

← Older revision		Revision as of 05:40, 30 July 2007
Line 35:		Line 35:
	#In the Group Policy Object Editor window, open "Computer Configuration" -> "Software Settings" -> "Software installation"		#In the Group Policy Object Editor window, open "Computer Configuration" -> "Software Settings" -> "Software installation"
	#Right-click on "Software installation" and select "New" -> "Package..."<br/>[[Image:Gpoedit-newpackage.png]]		#Right-click on "Software installation" and select "New" -> "Package..."<br/>[[Image:Gpoedit-newpackage.png]]
	#Navigate to the shared folder through the network path and select the IE URL Lock MSI package file. Don't use the local path; workstations will be unable to install the MSI if you do that. Windows will warn you if you try to use the local path~~, too~~. In my example, I navigated to \\W2003server\Share<br/>[[Image:Select-msi-from-share.png]]		#Navigate to the shared folder that contains the IE URL Lock installation MSI package file through the network path and select the IE URL Lock MSI package file. Don't use the local path; workstations will be unable to install the MSI if you do that. Windows will warn you if you try to use the local path. In my example, I navigated to \\W2003server\Share<br/>[[Image:Select-msi-from-share.png]]
	#When asked for the deployment type, you can select either "Assigned" or "Advanced." The difference is that the latter will open up the properties window automatically for you. If you selected "Advanced," then you can right-click on the newly-added package and select "Properties" to proceed to the next step		#When asked for the deployment type, you can select either "Assigned" or "Advanced." The difference is that the latter will open up the properties window automatically for you. If you selected "Advanced," then you can right-click on the newly-added package and select "Properties" to proceed to the next step
	#Click on the "Deployment" tab and select the "Uninstall this application when it falls out of the scope of management" to enable easy uninstallation. Press the OK button to save these changes		#Click on the "Deployment" tab and select the "Uninstall this application when it falls out of the scope of management" to enable easy uninstallation. Press the OK button to save these changes

Stevenlawrance: /* Copy the IE URL Lock MSI file into a shared folder on the server */

2007-07-30T05:39:10Z

Copy the IE URL Lock MSI file into a shared folder on the server

← Older revision		Revision as of 05:39, 30 July 2007
Line 13:		Line 13:
	If you have not already done so, you will need to create a shared folder that contains the IE URL Lock MSI file so that computers that you want to install IE URL Lock onto can download and install it. You will need to ensure that the permissions are proper on both the share and on the folder within the NTFS filesystem.		If you have not already done so, you will need to create a shared folder that contains the IE URL Lock MSI file so that computers that you want to install IE URL Lock onto can download and install it. You will need to ensure that the permissions are proper on both the share and on the folder within the NTFS filesystem.

	At a minimum, the computers that you want to install IE URL Lock onto will need read-only access to this folder. If you created an IE URL Lock Computers group, this task is simplified by giving read-only access to that group on both the share and NTFS permission levels. To ensure that the permissions are restrictive, grant full NTFS folder and share access to only the ~~administrators~~ group and give the IE URL Lock Computers group read-only access on both the NTFS folder and share levels. Remove access from all others on both the share and on the NTFS folder ~~security~~.		At a minimum, the computers that you want to install IE URL Lock onto will need read-only access to this folder. If you created an IE URL Lock Computers group, this task is simplified by giving read-only access to that group on both the share and NTFS permission levels. To ensure that the permissions are restrictive, grant full NTFS folder and share access to only the Administrators group and give the IE URL Lock Computers group read-only access on both the NTFS folder and share levels. Remove access from all others on both the share and on the NTFS folder permissions.

	==Create or reuse a computer-based installation policy==		==Create or reuse a computer-based installation policy==

Stevenlawrance: /* Copy the IE URL Lock MSI file into a shared folder on the server that all relevant computers can read */

2007-07-30T05:37:34Z

Copy the IE URL Lock MSI file into a shared folder on the server that all relevant computers can read

← Older revision		Revision as of 05:37, 30 July 2007
Line 1:		Line 1:
	To deploy IE URL Lock with ActiveDirectory, follow these general guidelines. These instructions presently assume that you have installed the [http://www.microsoft.com/windowsserver2003/gpmc/default.mspx Microsoft Group Policy Management Console], which makes group policy management easier.		To deploy IE URL Lock with ActiveDirectory, follow these general guidelines. These instructions presently assume that you have installed the [http://www.microsoft.com/windowsserver2003/gpmc/default.mspx Microsoft Group Policy Management Console], which makes group policy management easier.

	==Copy the IE URL Lock MSI file into a shared folder on the server ~~that all relevant computers can read~~==		==Create a computer group for those computers that you want to install IE URL Lock onto==
			For maximum convenience, it's possible to create a group of computers in the ActiveDirectory. Note that this is optional, but it can greatly simply administration if you want to restrict access on the shared folder containing the installation MSI file to only those computers that need to install IE URL Lock. To do this, follow these steps:
			#Open the "Active Directory Users and Computers" program from the "Administrative Tools" folder
			#In your domain's "Computers" folder, right-click on "Computers" and select "New" -> "Group"
			#Give this group a meaningful name such as "IE URL Lock Computers"
			#Right-click on the newly created group and select "Properties"
			#Click on the "Members" tab
			#Add the computers that you want to install IE URL Lock onto

			==Copy the IE URL Lock MSI file into a shared folder on the server==
	If you have not already done so, you will need to create a shared folder that contains the IE URL Lock MSI file so that computers that you want to install IE URL Lock onto can download and install it. You will need to ensure that the permissions are proper on both the share and on the folder within the NTFS filesystem.		If you have not already done so, you will need to create a shared folder that contains the IE URL Lock MSI file so that computers that you want to install IE URL Lock onto can download and install it. You will need to ensure that the permissions are proper on both the share and on the folder within the NTFS filesystem.

			At a minimum, the computers that you want to install IE URL Lock onto will need read-only access to this folder. If you created an IE URL Lock Computers group, this task is simplified by giving read-only access to that group on both the share and NTFS permission levels. To ensure that the permissions are restrictive, grant full NTFS folder and share access to only the administrators group and give the IE URL Lock Computers group read-only access on both the NTFS folder and share levels. Remove access from all others on both the share and on the NTFS folder security.

	==Create or reuse a computer-based installation policy==		==Create or reuse a computer-based installation policy==