GPO to push out 2 different version of office.

[scott]

Right now I have windows 2003 server with windows xp Clients.
I have one OU called "managed computers" And I'm pushing out
Word xp, Excel XP, Outlook 2003, Acrobat reader, and citrix client.
The GPO is assoiceated to the OU "managed coputers" and there is no
filtering.
All computers in that out Gets all the apps.
--
Now I need to push out All of office 2003 to a subset of the computers
in the "managed copmuters" OU.
I understand GPO priority but How does that work if one GPO says
install office xp and another says install office 2003?
I think I'm going to try this.
Under the one GPO I have add Software install for office 2003 and
under that software object limit it to a new security group "office
2003" and add coputers I want office 2003 in that group.
But I have a few questions, In that same GPO I have an install of
office xp (word and excel) that there is no security on (all
authenticated users/copmuters). Will this cause a problem? Do I need
to make another goup called office xp and add all the other computers
to that group?

thanks

Scott

 

[Herb Martin]

Right now I have windows 2003 server with windows xp Clients.
I have one OU called "managed computers" And I'm pushing out
Word xp, Excel XP, Outlook 2003, Acrobat reader, and citrix client.
The GPO is assoiceated to the OU "managed coputers" and there is no
filtering.
All computers in that out Gets all the apps.
--
Now I need to push out All of office 2003 to a subset of the computers
in the "managed copmuters" OU.
I understand GPO priority but How does that work if one GPO says
install office xp and another says install office 2003?

Not as well as you might wish -- it could actually end up first
doing one and then upgrading it to the other.

I think I'm going to try this.
Under the one GPO I have add Software install for office 2003 and
under that software object limit it to a new security group "office
2003" and add coputers I want office 2003 in that group.

This may be one of those uncommon reasons for preferring filtering.

You could also split the OU to two child OUs and differentiate that
way.

But I have a few questions, In that same GPO I have an install of
office xp (word and excel) that there is no security on (all
authenticated users/copmuters). Will this cause a problem? Do I need
to make another goup called office xp and add all the other computers
to that group?

If I understand you proposition correctly, then yes, you need to two
groups and to filter on each of them for the correct GPO.

Is there some natural distinction between these machines? Say,
WinXP versus Win2000?

Were that the case, and you were using Win2003 DCs you could
filter using WMI for the OS -- and it would automatically update
the machines if they were ever updated to XP. The group method
requires that you remember to move them from one group to the
other (OU method also.)

 

[scott]

Ok So I have one GPO with 2 software deployments office 2003 and
officexp.
Under each deployment there is security Tab, What rights do I have to
take away from authenticated uses so it does not deploy?
Or is it better to make more than one GPO?

scott

 

[Herb Martin]

Ok So I have one GPO with 2 software deployments office 2003 and
officexp.
Under each deployment there is security Tab, What rights do I have to
take away from authenticated uses so it does not deploy?
Or is it better to make more than one GPO?

Normally one removes (or never gives) the right to "Apply Policy"
but both that and READ are required for the policy to apply.

If you are using DENY then you probably should just use
DENY_APPLY_POLICY so that it won't accidently affect
the ability of someone like an Admin (in the group) to READ
the policy.

 

[scott]

if you look under the security under the software deployment there is
not a "apply policy" right.
I'm trying to do this all with one GPO, if it is possible.

scott

 

[Herb Martin]

if you look under the security under the software deployment there is
not a "apply policy" right.
I'm trying to do this all with one GPO, if it is possible.

Sorry, I didn't realize you had misunderstood the security
of Group Policies: You must filter the ENTIRE policy,
not just the Software Package.

Usually one creates a separate policy for this purpose;
one that does only the Software packages (or other settings
specific to that class/group of machines.)