How to use GPO to remotely install software in Windows Server 2008

       You can use Group Policy to assign or to publish software to users or computers in a domain. Additionally, it is useful to be able to deploy software based on group membership. A Group Policy object (GPO) is usually applied only to members of an organizational unit (OU) to which the GPO is linked.

Create a Distribution Point
       To publish or assign a computer program, you must create a distribution point on the publishing server:

1. Log on to the server computer as an administrator.
2. Create a shared network folder where you will put the Microsoft Windows Installer package (.msi file) that you want to distribute.
3. Set permissions on the share to allow access to the distribution package.
4. Copy or install the package to the distribution point. For example, to distribute Microsoft Office XP, run the administrative installation (setup.exe /a) to copy the files to the distribution point.

Assign a Package
       To assign a program to computers that are running Windows Server 2003, Windows 2000, or Microsoft Windows XP Professional, or to users who are logging on to one of these workstations:

1. Start the Active Directory Users and Computers snap-in. To do this, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
2. In the console tree, right-click your domain, and then click Properties.
3. Click the Group Policy tab, select the group policy object that you want, and then click Edit.
4. Under Computer Configuration, expand Software Settings.
5. Right-click Software installation, point to New, and then click Package.
6. In the Open dialog box, type the full Universal Naming Convention (UNC) path of the shared installer package that you want. For example, \\file server\share\file name.msi.
   
   Important Do not use the Browse button to access the location. Make sure that you use the UNC path to the shared installer package.
7. Click Open.
8. Click Assigned, and then click OK. The package is listed in the right pane of the Group Policy window.
9. Close the Group Policy snap-in, click OK, and then quit the Active Directory Users and Computers snap-in.
10. When the client computer starts, the managed software package is automatically installed.

Publish a Package
       To publish a package to computer users and make it available for installation from the Add or Remove Programs tool in Control Panel:

1. Start the Active Directory Users and Computers snap-in. To do this, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
2. In the console tree, right-click your domain, and then click Properties.
3. Click the Group Policy tab, click the group policy object that you want, and then click Edit.
4. Under User Configuration, expand Software Settings.
5. Right-click Software installation, point to New, and then click Package.
6. In the Open dialog box, type the full UNC path of the shared installer package that you want. For example, \\file server\share\file name.msi.
   Important Do not use the Browse button to access the location. Make sure that you use the UNC path to the shared installer package.
7. Click Open.
8. Click Publish, and then click OK.
9. The package is listed in the right pane of the Group Policy window.
10. Close the Group Policy snap-in, click OK, and then quit the Active Directory Users and Computers snap-in.
11. Test the package:

Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.
         a. Log on to a workstation that is running Windows Vista or Windows 7 by using an account that you published the package to.
         b.In Windows 7, click Start, and then click Control Panel.
         c.Double-click Program and Feature, and then click Add New Programs.
         d.In the Add programs from your network list, click the program that you published, and then click Add. The program is installed.
         e.Click OK, and then click Close.

Note if you upgrade or modify the package, you can redeploy a software package

Read More

force proxy setting via group policy(GPO)

       We are using GPOs to apply proxy settings in our domain. Works fine and gives us the flexibility we need. GPOs are applied at system startup or user login. Take a look into the refresh policy. Changed GPOs will not be applied before the refresh interval takes place (in case the user remains logged in).

This article describes how to force proxy setting via group policy.

• Click Start – All programs – Administrative Tools – Group Policy Management.
• Create or Edit Group Policy Objects.
• Expand User configuration – Policies – Windows Settings – Internet Explorer Maintenance – Connection.
• In right Pane Proxy Settings.

For some security reasons maybe administrator need to prevent end users from change their proxy settings. You can do it with group policy follow this steps:

• Click Start – All programs – Administrative Tools – Group Policy Management.
• Create or Edit Group Policy Objects.
• Expand Computer Configuration – Administrative Templates – Windows Components - Internet Explorer – Internet Control Panel
• In right Pane Disable the Connections page (Enabled)

       Removes the Connections tab from the interface in the Internet Options dialog box. If you enable this policy, users are prevented from seeing and changing connection and proxy settings. If you disable this policy or do not configure it, users can see and change these settings. When you set this policy, you do not need to set the following policies for the Connections tab, because this policy removes the Connections tab from the interface

Use GPORESULT (resource kit) to check if a GPO will be applied or not.

More info...

Read More

How to Disable USB Storage Devices ports in Windows 7

      USB storage devices are so common these days almost everyone owns USB storage device in shape of small flash drives, external hard disks, mobile phones, cameras, and lots of other portable devices. So if you want to secure your computer from stealing data, viruses or any other risks then simply disable the USB ports for USB storage devices / disk drives. To block the USB storage devices just follow the given steps below.

Note: this method just block the USB drives (Flash drives, External HDD, Mobile Phones, etc.) not the USB mouse, Keyboard, etc.

How to Disable USB ports
Press Windows + R from keyboard, type “regedit” in the “Run” window and hit Enter.

Explore the registry editor folders
 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR
in the right pane double click to open “Start” DWORD value as shown below.

Change its value to 4 and click “OK” button to save changes. Close the registry editor and plug in any USB storage device to check.

Read More