G DATA TechPaper #0204. Installing G Data Security Client using GPOs and logon scripts. G DATA Service Team

Transcription

1 G DATA TechPaper #0204 Installing G Data Security Client using GPOs and logon scripts G DATA Service Team TechPaper_0204_04_03_2015

2 Table of Contents Introduction... 3 Creating a Security Client installation package... 3 Creating the batch files Installation without Firewall Installation with Firewall... 4 Creating the GPOs... 4 Copyright 2015 G DATA Software AG 2

3 1. Introduction GPOs only work with Windows 2000 and above and therefore will not work with older clients such as Windows 95/98 or Windows NT. GPOs can be assigned to either users or computer objects. GPOs can be linked to OUs, Site or Domain levels, meaning that with one GPO you can assign a logon script to all your users or computers or to specific organizational units within your Active Directory. 2. Creating a Security Client installation package The first step to take is to create an installation package in G Data Administrator. 1. Create a shared folder on the main ManagementServer and share this with all users giving them Read permissions. This folder will contain the G Data Security Client installation package and must be accessible by all PCs that the package will be installed to. In this example a folder called GDClient is used. 2. Open G Data Administrator and select ORGANIZATION > CREATE G DATA SECURITY CLIENT INSTALL PACKAGE. 3. In the information window that opens click on OK. 4. In the SELECT INSTALLATION LANGUAGE window select the ManagementServer that the clients will be managed by in the field PLEASE SELECT A MANAGEMENTSERVER. Select the correct language for the client installation package and click OK. 5. In the window SELECT STORAGE LOCATION select the folder that was previously created and click OK. The client installation package will be created in the background. Copyright 2015 G DATA Software AG 3

4 3. Creating the batch files Two separate batch files are required if G Data Security Client is to be installed either with or without the firewall. The batch files will check for the existence of G Data Security Client. If already installed the installation will terminate Installation without Firewall 1. On the Domain Controller open Notepad. 2. Insert the following lines: REG QUERY HKLM\SYSTEM\CurrentControlSet\services\AVKWCtl /v ErrorControl if %errorlevel% EQU 1 (call \\<MMS hostname or IP>\GDClient\GDClientPck.exe) 3. Save this file with the name GDClient_NO_FW.bat to the folder C:\Windows\SYSVOL\domain\scripts Installation with Firewall On the Domain Controller open Notepad. 2. Insert the following lines: REG QUERY HKLM\SYSTEM\CurrentControlSet\services\AVKWCtl /v ErrorControl if %errorlevel% EQU 1 (call \\<MMS hostname or IP>\GDClient\GDClientPck.exe /FW) 3. Save this file with the name GDClient_WITH_FW.bat to the folder C:\Windows\SYSVOL\domain\scripts. Creating the GPOs At this point it must be decided which installation script will be applicable for which computers. A GPO can be created for either all computer objects in the domain or specific organizational units. In this example the G Data Security Client will be installed including the firewall to laptop computers in a selected organizational unit. 1. On the Domain Controller open ADMINISTRATIVE TOOLS > GROUP POLICY MANAGEMENT. 2. Select the OU that contains the computer objects that the package will be installed to. 3. Right click the selected OU and select CREATE A GPO IN THIS DOMAIN, and link it here. 4. Give the new GPO a descriptive name and click OK. Copyright 2015 G DATA Software AG 4

5 5. Right click the newly created GPO and select EDIT. 6. In the Group Policy Management Editor window in the left-hand pane expand COMPUTER CONFIGURATION > POLICIES > WINDOWS SETTINGS and select SCRIPTS (STARTUP/SHUTDOWN). 7. In the right-hand pane double click STARTUP. 8. In the Startup Properties window select ADD. 9. Select the batch file previously created in C:\Windows\SYSVOL\domain\scripts\GDClient_WITH_FW.bat 10. Change the absolute path to the UNC path. Example: \\ \SYSVOL\domain\scripts\GDClient_WITH_FW.bat. Click APPLY and OK. 11. Close the Group Policy Management Editor window. Any client logging in to the domain will now receive the new GPO and the G Data Security Client will be installed. Note: As the presence of an existing installation is not checked using this routine, it is necessary to integrate a procedure for checking the presence of the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\G DATA\AVKClient (64 bit systems) or HKEY_LOCAL_MACHINE\SOFTWARE\G DATA\AVKClient (32 bit systems). If this key exists then no attempt will be made to install the client and the 350 MB client installation files will not be copied to the client. Copyright 2015 G DATA Software AG 5