Administration

This content is intended for administrators who are responsible for managing App deployments in their Microsoft Active Directory environment. Before you perform the tasks in this guide, please ensure you have correctly installed Specops Deploy / App.

Key components

You can administer the product from the Specops Deploy Administration Tools. The Administration Tools consist of the following components.

Specops Deploy Control Center: The Specops Deploy Control Center can be used to edit Specops Deploy / App GPOs, and deploy software packages to computers in your network.

Specops Deploy GPMC snap-in: The Specops Deploy GPMC snap-in can be used to edit Specops Deploy / App GPOs from the GPMC, and deploy software packages to computers in your network.

NOTE
The Specops Deploy Control Center, and Specops Deploy GPMC snap-in have the same functionality. Both tools can be used to edit the same GPOs. The Specops Deploy Control Center hides some of the complexity of the underlying Group Policy infrastructure and is intended for administrators that are not familiar with Group Policy, while the GMPC snap-in integrates with the Group Policy Management Console and is intended for administrators that are familiar with administering Group Policy within Active Directory.

Specops Configuration Tool: The Specops Configuration Tool can be used to import your license keys and monitor the status of your Client Side Extensions.

Managing your deployments

The Specops Deploy Control Center and/or the Specops Deploy GPMC snap-in can be used to manage your deployments.

Control Center

You can access the Specops Control Center via the start menu. When you launch the Control Center for the first time, you will need to select an existing GPO, or create a new GPO.

Specops Deploy GPMC snap-in

You can access the Specops Deploy GPMC snap-in from the Group Policy Management Editor.

  1. Open the GPMC and navigate to the GPO you want to the GPO you want to edit.
  2. Right click on the GPO and select Edit…
  3. In the Group Policy Management Editor, expand:
    • Group Policy Name>Computer Configuration>Software Settings>Specops Deploy

      • And/or

    • Group Policy Name>User Configuration>Software Settings>Specops Deploy

Managing GPOs

Specops Deploy stores all information about software deployments in Group Policy Objects. There are three common strategies when creating a GPO with Specops Deploy / App settings:

  • Single GPO: A single GPO is used to store all Specops Deploy / App settings. The GPO is linked high in the Active Directory structure to ensure that it affects as many computer objects as possible. The single GPO uses Targets extensively to narrow down which client should get the software installed.
  • Standard + Special Application GPO: A single GPO is used for the most commonly installed application and one or more GPOs are used for special applications. This can be used when you want to group your deployments based on the application type.
  • Administration unit GPO: The administration unit GPO is commonly used in larger organization where software deployment administration is performed in more than a single location.

Create a new GPO using the Control Center

The Specops Deploy Control Center works within the context of one GPO. The scope of the GPO should contain all the computers and users that you want to manage software for.

  1. In the navigation pane, expand Options, and click Select Group Policy Object.
  2. Click Create and Select a new Group Policy Object.
  3. In the text field, enter a name for the Group Policy Object.
  4. Select the location you want to link the Group Policy Object to, and click OK.
    NOTE
    The GPO will not be created and linked to the selected OU.

Change the selected GPO using the Control Center

  1. In the navigation pane, expand Options, and click Select Group Policy Object.
  2. Click Select an existing Group Policy object.
  3. The dialog box will display a list of all the Group Policy Objects in your domain.
  4. Select the Group Policy Object you want to manage software for.
    NOTE
    Verify that the Group Policy Object you select is linked to a User and/or Computer.
  5. Click OK.
    NOTE
    When a GPO targets an OU, only the computers in the OU where the Specops Deploy Client Side Extension have been installed will receive deployments.

Create a new GPO using the GPMC snap-in

The Specops Deploy GPMC snap-in works within the context of one GPO. The scope of the GPO should contain all the computers and users that you want to manage software for.

  1. In the Group Policy Management Console, expand your domain node and locate the OU you want to link the Group Policy Object to.
  2. Right click on the OU, and select Create a GPO in the domain and link it here.
  3. In the text field, enter a name for the new GPO, and click OK.
    NOTE
    When a GPO targets an OU, only the computers in the OU where the Specops Deploy Client Side Extension have been installed will receive deployments.

Deployments

A Deployment is the package and target combined with additional deployment parameters such as when and how the package will be deployed.

  • Software Package: Information about the software you want to deploy, such as: name, version, and path to setup files.
  • Target: The computers or users that should receive the package.

Creating a package

Specops Deploy packages contain information about a software installation, such as network file path to the installation files and any parameters needed to install the software.

There are four different package types:

  • Windows Installer: A Windows Installer package uses an msi-file as the installation source and is applied on the client through Windows Installer.
  • Windows Installer Patch: A Windows Installer Patch, or msp-file is a type of msi-package that updates an existing software installation. Windows Installer patches are applied through Windows Installer and require little or no configuration.
  • App-V package: Microsoft Application Virtualization packages are based on App-V 4.6 or 5.0 package files. These applications can only be installed on clients that have the App-V client installed.
  • Legacy Setup: The legacy package type indicates that the installation is run through a separate executable, typically a Setup.exe installation program. The setup file is fully responsible for all actions it performs during the software installation and typically requires many configuration parameters to silently install the software without end user intervention. In order to remove the installed software, you must also specify uninstallation commands for legacy setups.
  • Windows Store Applications: Windows Store applications are applications that are designed for the Windows 8 start screen. Before you can deploy your Windows Store App you need to package and sign it using the App Packager (MakeAppX.exe) and SignTool (SignTool.exe) executables shipped with Visual Studio 2012 and the Windows 8 SDK.

Create a package using the Control Center

  1. In the navigation pane expand tasks, and click Deploy Package.
  2. Click Create new package.
  3. Select the type of package you want to create, and click OK.
  4. In the package category field, click New to create a new Package Category.
    NOTE
    You can use an existing Package Category.
  5. Enter a name and description for the Package Category, and click OK.
    NOTE
    Selecting a package category is not mandatory but it will allow you to easily sort and view the deployments.
  6. Browse to the location of the file, and click Open.
    NOTE
    The path to the source files must be in the UNC format.
  7. Verify that the Package Properties field has automatically been updated and enter a description for the package in the text field.
  8. In the navigation pane, select Installation options and modify the following settings:
    Option
    Additional Windows Installer Properties
    1. Enter parameters to the install command in the text field.
    Option
    Additional Windows Installer Properties
    1. Expand Show advanced options.
    2. In the Pre installation command text field, enter the full path to a command that will be executed before a package is installed.
    3. Enter parameters to the pre-installation command in the parameters text field.
    4. In the text field, enter the exit code value that represents a successful execution. You can also choose to ignore the exit code.
    Option
    Additional Windows Installer Properties
    1. Expand Show advanced options.
    2. In the Post installation command text field, enter the full path to a command that will be executed after a package is installed.
    3. Enter parameters to the pre-installation command in the parameters text field.
    4. In the text field, enter the exit code value that represents a successful execution. You can also choose to ignore the exit code.
  9. Once you have modified the installation options, select Uninstallation options from the navigation pane to configure the parameters that will be used when you choose to uninstall a package. You can modify the following settings:
    Option
    Pre-installation commands and parameters
    1. Expand Show advanced options.
    2. In the Pre installation command text field, enter the full path to a command that will be executed before a package is installed.
    3. Enter parameters to the pre-installation command in the parameters text field.
    4. In the text field, enter the exit code value that represents a successful execution. You can also choose to ignore the exit code.
    Option
    Pre-installation commands and parameters
    1. Expand Show advanced options.
    2. In the Post installation command text field, enter the full path to a command that will be executed after a package is installed.
    3. Enter parameters to the pre-installation command in the parameters text field.
    4. In the text field, enter the exit code value that represents a successful execution. You can also choose to ignore the exit code.
  10. If the package you are creating is a Windows Installer package, click Transforms in the navigation pane and follow the below steps. If you are not creating a Windows Installer Package, skip to step 11.
    • Click Add to add a transform MST file to the package.
    • Click OK.
  11. Click Advanced options in the navigation pane.
  12. If you want to allow computers to reboot if it is required by the package, enable the checkbox. If the checkbox is enabled, you can also force computers to reboot after installing or uninstalling the package.
  13. If the package file is not in the root directory of the files and directories required by the package, you will need to change the path. Click Change.
  14. Enable the Use HTTP URL as package source checkbox if you want to use a HTTP URL as the package source.
    • Enable an HTTP directory for the package.
  15. To view a list of changes made to the package, click Modify history in the navigation pane.
  16. Click OK to save the new package.

Set package order

If you are deploying multiple packages to the same target, you can use the set package order command to define the precedence order for the packages. This command is available in the Deploy Control Center. You will need to expand Objects, and click Packages.

Create a package using the GPMC snap-in

  1. Open the GPMC and navigate to the GPO you want to the GPO you want to edit.
  2. Right click on the GPO and select Edit…
  3. In the Group Policy Management Editor, expand:
    • Group Policy Name>Computer Configuration>Software Settings>Specops Deploy

      • or

    • Group Policy Name>User Configuration>Software Settings>Specops Deploy
  4. Select Click here to deploy a package.
  5. Click Create new package.
  6. Select the type of package you want to create, and click OK.
  7. In the package category field, click New to create a new Package Category.
    NOTE
    You can use an existing Package Category.
  8. Enter a name and description for the Package Category, and click OK.
    NOTE
    Selecting a package category is not mandatory, but it will allow you to easily sort and view the deployments.
  9. Browse to the location of the file, and click Open.
    NOTE
    The path to the source files must be in the UNC format.
  10. Verify that the Package Properties field has automatically been updated and enter a description for the package in the text field.
  11. In the navigation pane, select Installation options and modify the following settings:
    Option
    Additional Windows Installer Properties
    1. Enter parameters to the install command in the text field.
    Option
    Additional Windows Installer Properties
    1. Expand Show advanced options.
    2. In the Pre installation command text field, enter the full path to a command that will be executed before a package is installed.
    3. Enter parameters to the pre-installation command in the parameters text field.
    4. In the text field, enter the exit code value that represents a successful execution. You can also choose to ignore the exit code.
    Option
    Additional Windows Installer Properties
    1. Expand Show advanced options.
    2. In the Post installation command text field, enter the full path to a command that will be executed after a package is installed.
    3. Enter parameters to the pre-installation command in the parameters text field.
    4. In the text field, enter the exit code value that represents a successful execution. You can also choose to ignore the exit code.
  12. Once you have modified the installation options, select Uninstallation options from the navigation pane to configure the parameters that will be used when you choose to uninstall a package. You can modify the following settings:
    Option
    Pre-installation commands and parameters
    1. Expand Show advanced options.
    2. In the Pre installation command text field, enter the full path to a command that will be executed before a package is installed.
    3. Enter parameters to the pre-installation command in the parameters text field.
    4. In the text field, enter the exit code value that represents a successful execution. You can also choose to ignore the exit code.
    Option
    Pre-installation commands and parameters
    1. Expand Show advanced options.
    2. In the Post installation command text field, enter the full path to a command that will be executed after a package is installed.
    3. Enter parameters to the pre-installation command in the parameters text field.
    4. In the text field, enter the exit code value that represents a successful execution. You can also choose to ignore the exit code.
  13. If the package you are creating is a Windows Installer package, click Transforms in the navigation pane and follow the below steps. If you are not creating a Windows Installer Package, skip to step 14.
    • Click Add to add a transform MST file to the package.
    • Click OK.
  14. Click Advanced options in the navigation pane.
  15. If you want to allow computers to reboot if it is required by the package, enable the checkbox. If the checkbox is enabled, you can also force computers to reboot after installing or uninstalling the package.
  16. If the package file is not in the root directory of the files and directories required by the package, you will need to change the path. Click Change.
  17. Enable the Use HTTP URL as package source checkbox if you want to use a HTTP URL as the package source.
    • Enable an HTTP directory for the package.
  18. To view a list of changes made to the package, click Modify history in the navigation pane.
  19. Click OK to save the new package.

Set package order

If you are deploying multiple packages to the same target, you can use the set package order command to define the precedence order for the packages. This command is available in the Deploy Control Center. You will need to expand Objects, and click Packages.

Selecting a target

Once a package has been created, it can be configured for deployment using targeting criteria. A target consists of a set of criteria which the client will match against its own environment. If the criterion matches the client environment, the target is considered valid and the deployments associated with the target should be acted on. The Client will evaluate all targets in every GPO with Specops Deploy / App settings.

Select a target using the Control Center

  1. In the navigation pane, expand Objects, and click Targets.
  2. Click New Target.
  3. Select the type of target you want to create, and click OK.
    NOTE
    Computer and user targets are different. Packages deployed to a Computer target will install software to a specific set of computers while packages deployed to a user target will install on any computers where the users logon.
  4. Enter a name and description for the target in the text field.
  5. Select Target criteria from the navigation pane.
  6. To add Target Criteria select the Add Target Criterion drop box. You can add the following criteria:
    Table caption
    CriteriaDescription
    Membership criteriaThe Membership criteria consists of the following items:
    • Security groups
    • Organizational units
    • User names
    • Computer names
    • Sites
    • Ip address range
    Environment criteriaThe Environment criteria consists of the following items:
    • Languages
    • Environment variables
    • Registry settings
    Hardware criteriaThe Hardware criteria consists of the following items:
    • Computer models
    • BIOS versions
    • Hard drive free space
    • Processor
    • Memory size
    Software criteriaThe Software criteria consists of the following items:
    • Operating systems
    • Windows installer installations
    • Files
    WMI Query
    • Query the Windows Management Instrumentation
  7. Once you have added the target criteria, they will be displayed in the list. From the list you can:
    • Edit a criterion
    • Remove a criterion
  8. To view a list of changes made to the package, click Modify history in the navigation pane.
  9. Click OK to save the new user target.

Select a target using the GPMC Snap-in

  1. In the Group Policy Management Editor, expand:
    • Group Policy Name>Computer Configuration>Software Settings>Specops Deploy

      • or

    • Group Policy Name>User Configuration>Software Settings>Specops Deploy
    NOTE
    Computer and user targets are different. Packages deployed to a Computer target will install software to a specific set of computers while packages deployed to a user target will install on any computers where the users logon.
  2. Select the target node, and click New Target.
  3. Enter a name and description for the target in the text field.
  4. Select Target criteria from the navigation pane.
  5. To add Target Criteria select the Add Target Criterion drop box. You can add the following criteria:
    Table caption
    CriteriaDescription
    Membership criteriaThe Membership criteria consists of the following items:
    • Security groups
    • Organizational units
    • User names
    • Computer names
    • Sites
    • Ip address range
    Environment criteriaThe Environment criteria consists of the following items:
    • Languages
    • Environment variables
    • Registry settings
    Hardware criteriaThe Hardware criteria consists of the following items:
    • Computer models
    • BIOS versions
    • Hard drive free space
    • Processor
    • Memory size
    Software criteriaThe Software criteria consists of the following items:
    • Operating systems
    • Windows installer installations
    • Files
    WMI Query
    • Query the Windows Management Instrumentation
  6. Once you have added the target criteria, they will be displayed in the list. From the list you can:
    • Edit a criterion
    • Remove a criterion
  7. To view a list of changes made to the package, click Modify history in the navigation pane.
  8. Click OK to save the new user target.

Advanced targets (target criteria Boolean expressions)

Targets can contain multiple different criteria. By default, to be considered a valid member of the target and be included in the deployment, that member has to meet all these criteria (i.e. the criteria are combined by using the Boolean AND operator). Criteria are assigned an ID in the order that they are added (A, B, C… etc.).

NOTE
the order of criteria cannot be altered after they have been created.

This default relationship between the different criteria can be altered by using a customized Boolean expression.

Boolean customization

  1. Select the Customize checkbox.
  2. Enter or alter the Boolean expression in the text field.

Removing the customization

  1. Clear the Customize checkbox
  2. The Boolean expression will revert to the default (all criteria combined by AND)

Boolean operators

The following Boolean operators can be used:

  • AND
  • OR
  • NOT (notation: AND NOT)

It is also possible to group criteria by enclosing them in parentheses in the Boolean expression.

NOTE
do not use Boolean algebraic notation (&&, ||, !) when entering your expression. Use the alphabetic notation above instead.
NOTE
the Boolean operator Exclusive OR (^) cannot be used.

Removing a criterion in targets with Boolean customization

Removing a criterion from a target with a customized Boolean expression will make the expression invalid, and it will be removed from the target. Since there is no valid expression governing the target, the target cannot be saved. To resolve this, do one of the following:

  • Clear the Customize checkbox (the expression will revert to its default AND state) OR
  • Enter a valid Boolean expression containing all the remaining criteria.
NOTE
when removing a criterion, all following criteria will receive new ID designations.

Examples

The following expression examples are applied to a target containing the following three criteria:

  1. Organizational units: HR
  2. Computer models: Dell XPS 8700
  3. Security groups: Administrators

Expression examples

A and B and C: users in the HR OU who have a Dell XPS 8700 and who are a member of the Administrators Security group (this is the default expression)

(A and B) and not C: users in the HR OU who have a Dell XPS 8700, but are not a member of the Administrators Security group

(A or B) and C: users in the Administrators Security group who are either a member of the HR OU or have a Dell XPS 8700

A and not B and not C: users in the HR OU who do not have a Dell XPS 8700, and who are not a member of the Administration Security group

Configure the deployment

Once you have the package and the target you can configure additional deployment parameters such as when and how the package will be deployed.

Configure the deployment using the Control Center

  1. In the navigation pane, expand Objects and select Deployments.
  2. Click New Deployment.
  3. Select the package you want to deploy, and click OK.
  4. From the Target drop down menu select the target the package will be deployed to.
  5. Select the installation type. You will be given the following options:
    OptionDescription
    InstallA full installation that completely installs the package on the computer.
    Advertise onlyThe package is prepared for installation but the files are not installed.
    Publish in Add/Remove programsThe package is published in the available programs list in Add/Remove programs.
  6. In the navigation pane, select Deployment options. You can configure the following items:
    OptionDescription
    Installation time
    • As soon as possible
    • Not before
    Installation options
    • Only install during user logon
    • Only install after the user has logged on
    • Both
    Source file options
    • Download and install, remove source files from cache
    • Download and install, leave source files in cache
    • Install from network
    Uninstall the package if the deployments falls "Out of the Scope of management"
    • Uninstalls the package if the GPO no longer applies
  7. In the navigation pane, select End User Interaction. You can configure the following items:
    OptionDescription
    Installation popup dialog
    • None
    • Display popup
    Use custom end user message
  8. To view a list of changes made to the package, click Modify history in the navigation pane.
  9. Click OK to start deployment.
View deployment feedback using the Control Center

You can use the Control Center to monitor, in real time, the status of deployments.

  1. In the navigation pane, expand Objects and select Deployments.
  2. Click Deployment feedback to view the status of deployments.

Configure the deployment using GPMC snap-in

  1. In the Group Policy Management Editor, expand:
    • Group Policy Name>Computer Configuration>Software Settings>Specops Deploy / App

      • or

    • Group Policy Name>User Configuration>Software Settings>Specops Deploy / App
  2. Click Deployments.
  3. Select the package you want to deploy, and click OK.
  4. From the Target drop down menu select target the package will be deployed to.
  5. Select the installation type. You will be given the following options:
    Table caption
    OptionDescription
    InstallA full installation that completely installs the package on the computer.
    Advertise onlyThe package is prepared for installation but the files are not installed.
    Publish in Add/Remove programsThe package is published in the available programs list in Add/Remove programs.
  6. In the navigation pane, select Deployment options. You can configure the following items:
    OptionDescription
    Installation time
    • As soon as possible
    • Not before
    Installation options
    • Only install during user logon
    • Only install after the user has logged on
    • Both
    Source file options
    • Download and install, remove source files from cache
    • Download and install, leave source files in cache
    • Install from network
    Uninstall the package if the deployments falls "Out of the Scope of management"
    • Uninstalls the package if the GPO no longer applies
  7. In the navigation pane, select End User Interaction. You can configure the following items:
    OptionDescription
    Installation popup dialog
    • None
    • Display popup
    Use custom end user message
  8. To view a list of changes made to the package, click Modify history in the navigation pane.
  9. Click OK to start deployment.
View deployment feedback using the GPMC snap-in

You can use the GMCP snap-in to monitor, in real time, the status of deployments.

  1. In the Group Policy Management Editor, expand:
    • Group Policy Name>Computer Configuration>Software Settings>Specops Deploy / App

      • or

    • Group Policy Name>User Configuration>Software Settings>Specops Deploy / App
  2. Click Deployments.
  3. Click Deployment feedback to view the status of deployments.

Configure the Specops Deploy Client Side Extension from the Administrative Template

The Specops Deploy Client Side Extension can be configured using the administrative template in the Group Policy Management Console. You can configure the following settings using the Administrative Template:

  • Control how often (in days) the client side extension sends heartbeats to the server.
  • Disable the Software Updater on the client.
  • Time in minutes that the Software Updater will wait before automatically starting processing Deployments.

Configure the Specops Deploy Client Side Extension from the Administration Template

  1. Open the GPMC and navigate to the GPO you want to edit.
  2. Right-click on the GPO and select Edit…
  3. In the Group Policy Management Editor dialog box, expand Computer Configuration, Policies, Administrative Templates, Specops Deploy.
  4. You can configure the following settings:
    • Client Side Heartbeat Interval
    • Software Updater
  5. Double-click the setting you want to configure.
  6. Make the necessary changes, and click OK.

After you finish: Create a Central Store for Group Policy Administrative Templates and add the Specops Deploy Administrative template.

Create a Central Store for Group Policy Administrative Templates

The Central Store for Administrative Templates allows you to store all template files in a single location on SYSVOL where they can be accessed and presented on any server from your domain. To create a Central Store for Group Policy Administrative Templates, copy the %windir%\PolicyDefinitions folder from your Windows machine to the policies folder on the SYSVOL share in your domain. For more information about the Central Store and best practices, visit https://www.support.microsoft.com/kb/929841.