How do you deploy software using GPO
I will show you how to use Group Policy to deploy software to computers and users. I am
deploying Chrome to computers via Group Policy. The steps in this example will work
with other MSI files as well.
STEP – A- Create a Network Share for the MSI Install File
➢ Pick a server that everyone can access to configure the shared folder.
➢ I’m using a 2019 Windows server. I created a folder called software to store the
install files. You can name your folders anything you want.
➢ Right-click a folder, then click the sharing tab and advanced sharing.
➢ Then click the permissions button.
➢ On the share permissions screen, remove everyone.
➢ Now add domain computers and domain users and set the permissions to read.
➢ Click ok to get back to the properties page and click on the security tab.
➢ Make sure everyone is not listed, if so remove it, add domain users and domain
computers and give them read & execute, list, and read permissions.
➢ The shared folder configuration is complete. Now copy the MSI install files to the
folder you just created.
➢ Test access to the network share on a remote computer. On the remote computer
in the search box type the \\hostname\Foldername.
That completes the network share configuration. The next step will configure
the GPO for software deployment to computers only.
STEP – B- Create GPO to Deploy Software to Computers
➢ Group policy has settings for targeting computers and settings to target users.
Here, we will target computers for deploying software. This means the software
will be installed for anyone that logs into the computer.
➢ I recommend creating a new GPO for the software install, do not add these
settings to the Default Domain Policy.
➢ To open the GPMC (Group Policy Management Console) > Server Manager > Tools
> Group Policy Management. You can also use CMD – [Link]
➢ In the group policy management console browse to the OU, right click and select
“Create a GPO in this domain, and link it here”.
In this example, I’m going to install Chrome on all the computers in the IT OU, so I will
create and link the GPO to the IT OU. Give the GPO a name. I’ve named mine
“Computer – Chrome Install”.
➢ Now, edit the new GPO: Computer Configuration > Policies > Software Settings>
Software Installation
➢ Right click Software installation and select New > Package
➢ On the open screen, browse to the network share using the UNC (Universal Naming
Convention) path, select the MSI you want to install, and click open. DO NOT browse
using the local drives or the install will fail.
➢ On the deploy software screen, click Assigned and then click Ok. Published will be
grayed out as that option can only be used when deploying software to users.
That completes the GPO configuration. The GPO settings should look like this.
➢ The software will only install during a reboot and the computer must have its GPO
settings updated. GPO settings will refresh automatically every 90 minutes.
➢ To force the GPO settings you can use the gpupdate /force command.
The software will be installed on reboot. That completes the steps on how to deploy
software using group policy.
STEP – C - GPO Settings to Install Software to Users Only
➢ To install software for specific users just use the user configuration GPO settings
instead of the computer.
➢ This works differently than deploying to a computer.
NOTE- In my testing, the user configuration does not install the software
automatically for the user. This is why I prefer to use the computer configuration for
deploying software but everyone has different requirements.
Assign an MSI package
A package can be assigned per-user or per-computer. Also, if the package is assigned, it
will automatically be installed silently.
Publish an MSI package
When using Group Policy, you can publish a package in order to allow the target user to
install it by using Add or Remove programs.
From my testing, they seem to do the same thing. The only thing I see this does is add the
software to the list of programs that can be installed from the network. The user will need
to click on Google Chrome from here and then the software will install.
Thanks & regards – Vikram Kumar
