Manual for System Engineers and Administrators

Manual for System Engineers and Administrators

Revision History Revision Date Author Description 1.0 21. Mai 2015 Tom Huerlimann Initial Release 2.0 25. Mai 2015 Tom Huerlimann License Agreement added Page 2 of 15

Index 1.0 Description... 4 1.1 Why using AppDeploy?... 4 1.2 Architecture... 4 2.0 Installation... 5 2.1 Requirements... 5 2.1.1 Server... 5 2.1.2 Client... 5 2.2 Walkthrough... 5 2.2.1 Execute MSI installer on your fileserver... 5 2.2.2 Select Installation Destination... 5 2.2.2.1 AppDeploy Management GUI... 5 2.2.2.2 AppDeploy Software Distribution Point... 5 2.2.2.3 AppDeploy Requirements... 6 2.2.3 Fileshares... 6 2.2.4 Shortcuts... 6 2.2.5 Start AppDeploy... 6 3.0 Configuration... 7 3.1 Active Directory... 7 3.1.1 Create Policy for LoginScript.vbe... 7 3.1.1.1 Copy Default Domain Policy... 7 3.1.1.2 Rename and link the new policy... 7 3.1.1.3 Disable User Configuration settings... 8 3.1.1.4 Add LoginScript.vbe... 8 3.1.2 Create Organization Units and Groups... 8 3.1.2.1 Create a new Organization Unit for Software Packages... 8 3.1.2.2 Add a Group for each Software Package... 9 3.1.2.3 Add Computers to Groups... 9 3.2 AppDeploy... 9 3.2.1.1 License... 9 3.2.1.2 Settings... 9 3.2.1.3 Create Software Package... 10 4.0 Advanced Configuration... 12 4.1 Force the execution job of a Software Package remotely... 12 4.2 Apply MSP packages at the end of an MSI installation... 12 5.0 Troubleshooting... 14 5.1 Logfiles... 14 5.1.1 LoginScript.vbe... 14 5.1.2 MSI installation... 14 5.2 LoginScript.vbe does not run... 14 5.2.1 Permissions on AppDeploy and SoftwareDistributionPoint... 14 6.0 Software License Agreement... 15 Page 3 of 15

1.0 Description AppDeploy 2.0 is a Microsoft active directory integrated software distribution solution. 1.1 Why using AppDeploy? You can take profit from using AppDeploy compared to other solutions. Some arguments for using AppDeploy: - 100% Microsoft active directory integrated - No software required for your workstations - Easy to use and maintain - Easy to configure and integrate - No database required - No delays after setting modifications - Detailed logging for quick troubleshooting - Support of every possible installation format (MSI, EXE, VBS, CMD) - Installation, uninstallation and repair functionality for every software package - Configurable pre- and post-tasks for every software package - Support of multi-site installations with local software repositories by using DFS - Easy workstation based licensing 1.2 Architecture Main Site Active Directory AD Group 1 AD Group 2 AD Group 3 File Server Loginscript applied to all Workstations covered by AppDeploy Software Package copied to Software Distribution Point and configuration in AppDeploy applied to a Active Directory group containing target workstations Software Distribution Point App Deploy Lookup if Workstation is a member of a Active Directory group 5) If Workstation is a member of the related group, software will be installed and AppDeploy config will be updated Computer LoginScript by GPO Loginscript executed on all Workstations covered by AppDeploy WAN Mgmt Workstation Managed Workstations Remote Site Remote sites can be covered with Active Directory integrated Distributed File Systems for the Software Distribution Point and AppDeploy File Server AD Group 1 AD Group 2 AD Group 3 Active Directory Software Distribution Point App Deploy Computer LoginScript by GPO Mgmt Workstation Managed Workstations Page 4 of 15

2.0 Installation AppDeploy will be installed on a fileserver who is part of your local active directory. Two fileshares will be created by the msi-installer. One fileshare contains the application and all required management tools, the second fileshare contains your software distribution point. 2.1 Requirements 2.1.1 Server Operating System: Microsoft Windows 2008 R2 x64 or newer CPU: No special CPU requirements RAM: No special RAM requirements Disks: Best practice is to have the OS on drive C: and the Software Distribution Point on drive D: Space: AppDeploy itself requires only 100MB of space. Make sure you have enough space to store all your application on your Software Distribution Point. Software: Active Directory services need to be installed and.net 4.5.2 is required to execute the AppDeploy Management GUI 2.1.2 Client Operating System: CPU: RAM: Disks: Space: Software: 2.2 Walkthrough Microsoft Windows 7 or newer No special CPU requirements No special RAM requirements Best practice is to have the OS on drive C:. AppDeploy itself does not require space but AppDeploy creates a local application-installer cache on drive C:. Make sure you have enough space to store all application-installers you want to install on a client. Workstations need to be part of the Active Directory and.net 2.0 is required to execute the AppDeploy client-installer. 2.2.1 Execute MSI installer on your fileserver 2.2.2 Select Installation Destination 2.2.2.1 AppDeploy Management GUI In this screenshot the management GUI will be installed to C:\Program Files (x86)thuinformatik GmbH\AppDeploy 2.2.2.2 AppDeploy Software Distribution Point Page 5 of 15

In this screenshot the Software Distribution Point will be created in D:\SoftwareDistributionPoint 2.2.2.3 AppDeploy Requirements After the installation the dotnetchecker.exe is executed to detect missing.net requirements. If Microsoft.NET Framework 4.5.2 is missing you get the suggestion to install it. Use the Update button to install.net Framework 4.5.2 or the Close button to close the window. 2.2.3 Fileshares After the installation two new fileshares are available. The AppDeply-share points to the installation directory (see chapter 2.2.2.1) and the SoftwareDistributionPoint-share points to the distribution point-directory (see chapter 2.2.2.2). 2.2.4 Shortcuts After the installation you ll find shortcuts to AppDeploy and the Software Distribution Point in your startmenu and on your desktop. 2.2.5 Start AppDeploy You can start AppDeploy straight on your server by using the icons or you can start AppDeploy from a workstation by executing \\<your_server>\appdeploy\appdeploy.exe. Page 6 of 15

3.0 Configuration 3.1 Active Directory 3.1.1 Create Policy for LoginScript.vbe 3.1.1.1 Copy Default Domain Policy Open the Group Policy Management Console on your active directory server and locate the Default Domain Policy. Copy/paste the Default Domain Policy. 3.1.1.2 Rename and link the new policy Preserve the existing permissions for your new policy. The copy process will be succeeded. Rename the copied policy to AppDeploy LoginScript and assign the policy to your domain or at least to an organization unit related to your domain configuration. Right-click the policy and drag it to the domain or the organization unit you want it to assign. Select OK to link the policy to the selected domain or organization unit. Page 7 of 15

3.1.1.3 Disable User Configuration settings Right-click the linked policy and select Edit. If your policy is opened, right-click the policy and select Properties. Disable User Configuration settings and confirm with OK. 3.1.1.4 Add LoginScript.vbe Browse to Computer Configuration Policies Windows Settings- Script (Startup/Shutdown) and double-click Startup. Click Add and add the UNC path to LoginScript.vbe from the directory selected in chapter 2.2.2. 3.1.2 Create Organization Units and Groups We assign software packages to Active Directory groups. Active directory groups are responsible for the sequence how packages will be installed. We recommend to use a good naming technique to be able to control the installation sequence. 3.1.2.1 Create a new Organization Unit for Software Packages Page 8 of 15

Open the Active Directory Users and Computers Management Console on your active directory server and create an organization unit for your software distribution groups. 3.1.2.2 Add a Group for each Software Package Create a Universal Group as Security Group type and call the first group 0001_<Your Software>, the second group 0002_<Your Software>, etc. Software packages will be installed in alphabetical order of the given groupnames. Supported charactes for group names: ()-_.+%/\=?!$ and unsupported characters for group names: []&" 3.1.2.3 Add Computers to Groups To assign software packages to workstations you add the related computer accounts to the groups create before. 3.2 AppDeploy Start AppDeploy like described in chapter 2.2.5. 3.2.1.1 License AppDeploy requires a valid license to run. Click OK to open the license dialog. Enter your Register Name and your License Key to unlock AppDeploy. If you don t have a valid License Key please click on Demo, the application will be unlocked for five workstations for unlimited time including all functions. 3.2.1.2 Settings Page 9 of 15

To be able to work with AppDeploy you need to configure some required settings. Click OK to open the Settings dialog. Active Directory: Client Administrator: Client Password: Distribution Point: Client Cache: Hide Cache on Client: 3.2.1.3 Create Software Package Your need to configure the active directory you want to integrate with AppDeploy. Select Auto to resolve the active directory connection string automatically. You see the automatically resolved string in the read-only textbox next to Auto. In case you want to configure your own active directory connection string, please select Custom and enter your custom connection sting. You can use custom to find active directory groups in a specific organization unit only. A Client Administrator is required to force the remote installation of an assigned software package (see chapter 4.1). A Client Password is required to force the remote installation of an assigned software package (see chapter 4.1). The distribution point is the directory you ve specified during the installation in chapter 2.2.2.2. Please add the UNC path to the configuration, for example: \\your_server\softwaredistributionpoint. Installation resources required for the installation of software packages will be cached locally on the clients. Please specify the directory for the local cache, for example: C:\SoftwareCache\. In case you want to hide the Client Cache on a workstation please check this box. Select the active directory group you want to assign the software package to and activate the Action who should be executed. Click on the related button to configure the job. Page 10 of 15

Setup Type: Source Directory: Installer: Installer Options: Disabled: Force Reboot: Force Reinstallation: Select the installation type of the application (CMD, EXE, MSI, VBS) Select the source directory of the application. This directory will be copied to the local Client Cache. Select the installer file for the application. This file should be within the same directory as specified in Source Directory and will be executed from the Client Cache. Add additional arguments to perform a silent installation. A good choice for MSI files would be /passive. Activate this checkbox to disable the job. Activate this checkbox to force a reboot after the job is complete. Activate this checkbox to reinstall all related computers regardless of the install state. You can configure the same settings for all jobs (PreInstall, Install and PostInstall). Page 11 of 15

4.0 Advanced Configuration 4.1 Force the execution job of a Software Package remotely To force a job on a workstation, click on Manage Workstations on the related job. All workstations in the related active directory groups are listed on the left side (Workstations in this group). On the right side (Installation status) is the reported installation status of each machine. You can apply the actions to dedicated workstations or to all workstations. Check if [ ] is alive: Check if [ ] alive before install is forded: Force install [ ]: Clear install status [ ]: 4.2 Apply MSP packages at the end of an MSI installation A ping is made to the workstations to identify if the system is alive. To check if workstations are alive before the installation of the selected software package is forced then activate the checkbox. Force the installation of the selected software package to workstations. Does only work if install status is Not Installed. Clear the installation status of the selected software package on workstations. Create a.bat file and save it in the source directory of your software package. Add an additional line for every MSP transform file that should be applied: @echo off call msiexec.exe /p "C:\SoftwareCache\AdbeRdrUpd11010.msp" /qn /l* "C:\SoftwareCache\AdbeRdrUpd11010.log" call msiexec.exe /p "C:\SoftwareCache\AdbeRdrUpd11011.msp" /qn /l* "C:\SoftwareCache\AdbeRdrUpd11011.log" Or add all patches in one command-line: @echo off call msiexec.exe /p "C:\SoftwareCache\AdbeRdrUpd11010.msp";"C:\SoftwareCache\AdbeRdrUpd11011.msp" /n {AC76BA86-7AD7-1031-7B44-AB0000000001} /qn For a list of all possible switches please consult the msiexec.exe command line options on the Microsoft website: https://msdn.microsoft.com/en-us/library/windows/desktop/aa367988(v=vs.85).aspx Page 12 of 15

To activate the patch rollout create a PostInstall Job for your Software Package. If the software package is already installed on the workstations add a new software package who contains the configuration above or activate Force Reinstallation on the InstallJob tab; third possibility is to Clear install status of all workstations. Page 13 of 15

5.0 Troubleshooting 5.1 Logfiles 5.1.1 LoginScript.vbe The logfiles of the LoginScript.vbe will be stored for each workstation in the software distribution point-share. Have a look at \\your_server\softwaredistributionpoint\log\<hostname>.log 5.1.2 MSI installation The logfiles of MSI installations will be stored in the Client Cache directory of each client and have the same name as the MSI installer itself but with.txt file ending. If the MSI file is called AcroRead.msi then please have a look at C:\SoftwareCache\<your application>\ AcroRead.txt. For all install types please define a logfile by yourself by using the Installation parameters textbox. 5.2 LoginScript.vbe does not run 5.2.1 Permissions on AppDeploy and SoftwareDistributionPoint Execute SwDistPoint.exe to create the right access permissions for your AppDeploy- and your SoftwareDistributionPoint-share. SwDistPoint.exe ------------------------------------------------------------------------------ This script will share your sofware distribution point and set required ACLs -path $localpath = path to your software distribution repository -share $sharename = the name of your share Example: SwDistPoint.exe -p "C:\SoftwareDistributionPoint\" -s SoftwareDistributionPoint Hint: Please make sure your -p variable has a final backslash at the end of the path. Please use this script to create your AppDeploy share as well. Support: In case of support is required please contact: support@thuinformatik.ch. Page 14 of 15

6.0 Software License Agreement 1. This is an agreement between Licensor and Licensee, who is being licensed to use AppDeploy 2.0 2. Licensee acknowledges that this is only a limited nonexclusive license. Licensor is and remains the owner of all titles, rights, and interests in the Software. 3. This License permits Licensee to install the Software on one or more computer system, as long as the Software is licensed to be used on the amount of computer system. Licensee will not make copies of the Software or allow copies of the Software to be made by others, unless authorized by this License Agreement. Licensee may make copies of the Software for backup purposes only. 4. This Software is subject to a limited warranty. Licensor warrants to Licensee that the physical medium on which this Software is distributed is free from defects in materials and workmanship under normal use, the Software will perform according to its printed documentation, and to the best of Licensor's knowledge Licensee's use of this Software according to the printed documentation is not an infringement of any third party's intellectual property rights. This limited warranty lasts for a period of 31 days after delivery. To the extent permitted by law, THE ABOVE-STATED LIMITED WARRANTY REPLACES ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, AND LICENSOR DISCLAIMS ALL IMPLIED WARRANTIES INCLUDING ANY IMPLIED WARRANTY OF TITLE, MERCHANTABILITY, NONINFRINGEMENT, OR OF FITNESS FOR A PARTICULAR PURPOSE. No agent of Licensor is authorized to make any other warranties or to modify this limited warranty. Any action for breach of this limited warranty must be commenced within one year of the expiration of the warranty. Because some jurisdictions do not allow any limit on the length of an implied warranty, the above limitation may not apply to this Licensee. If the law does not allow disclaimer of implied warranties, then any implied warranty is limited to 31 days after delivery of the Software to Licensee. Licensee has specific legal rights pursuant to this warranty and, depending on Licensee's jurisdiction, may have additional rights. 5. In case of a breach of the Limited Warranty, Licensee's exclusive remedy is as follows: Licensee will return all copies of the Software to Licensor, at Licensee's cost, along with proof of purchase. (Licensee can obtain a step-by-step explanation of this procedure, including a return authorization code, by contacting Licensor at thuinformatik GmbH, Kaffeestrasse 17, 8180 Bülach, Switzerland, +41 44 585 38 48, office@thuinformatik.ch, www.thuinformatik.ch. At Licensor's option, Licensor will either send Licensee a replacement copy of the Software, at Licensor's expense, or issue a full refund. 6. Notwithstanding the foregoing, LICENSOR IS NOT LIABLE TO LICENSEE FOR ANY DAMAGES, INCLUDING COMPENSATORY, SPECIAL, INCIDENTAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, CONNECTED WITH OR RESULTING FROM THIS LICENSE AGREEMENT OR LICENSEE'S USE OF THIS SOFTWARE. Licensee's jurisdiction may not allow such a limitation of damages, so this limitation may not apply. 7. Licensee agrees to defend and indemnify Licensor and hold Licensor harmless from all claims, losses, damages, complaints, or expenses connected with or resulting from Licensee's business operations. 8. Licensor has the right to terminate this License Agreement and Licensee's right to use this Software upon any material breach by Licensee. 9. Licensee agrees to return to Licensor or to destroy all copies of the Software upon termination of the License. 10. This License Agreement is the entire and exclusive agreement between Licensor and Licensee regarding this Software. This License Agreement replaces and supersedes all prior negotiations, dealings, and agreements between Licensor and Licensee regarding this Software. 11. This License Agreement is governed by the law of Bülach, Switzerland. 12. This License Agreement is valid without Licensor's signature. It becomes effective upon the earlier of Licensee's signature or Licensee's use of the Software. Page 15 of 15