Software installation using machine Policy

[Guest]

Please help me with this question:

I am planning an installation of over 20 applications using Machine Based
GP. The following is my scenario:
In the past we used to have some of these applications installed using
UserBased GP. This is causing licensing issues. For eg. We only have 50
licenses for application A but becauses users are using applications on
different machines they are logging on, there are over 60 Machines with this
application, ie 10 unlicensed installs. This is a simplest example but we
have heaps like this. Telling the users not to install applications on the
visiting machines do not help.

To force applications to specific machines and allow users to use this
applications only on this machines, I would like to redeploy the apps thru
the machine policy. This is where my problem is.... From my knowlege and
experince, order to machine based applications, I need to put the machines
into a an OU then apply the GP on this OU and the machines under this ou gets
all the applications. This is not application in the case I have because
there heaps of applications where some machines need to have multiple of them
and others need to have few. It would be creating layers of OU and filter
through........ Doesn't seem practical.

Question is, is it possible to push a machine based GP on an OU so that
Application A1 gets installed only on Machine M1 and Application A2 gets
installed only on Machine M2. Both of them in the same OU. I am thinking of
putting machine M1 into user group G1 and Machine M2 into User Group G2 and
allow only group G1 to have read access to installation folder for A1 and
group G2 to installation files for A2 may be possible but I don't know if
this works. Has anyone done this? Is there any other way around?

Thank you very much for your help

 

[Darren Mar-Elia \(MVP\)]

Eric-
One way you could do this is to set per-package permissions within a given
GPO, and then link the GPO high enough up in your AD hierarchy so that alll
machines that need to process it will. If you are creating a package in GP
Editor, and are looking at the Advanced options, then you will notice a
security tab, that by default grants Authenticated Users Read access to the
package. You can modify this ACL on a per-package basis so that a given
package is read only by a given machine, user or group. In that case, you
would remove the Authenticated Users ACE from the ACL and grant read
permission to the group that you wish to process that package. In this way,
you can have a single GPO that selectively deploys packages to users,
computers or groups.

Darren

--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Whitepapers and Utilities for all things Group Policy-related
And, the Windows Group Policy Guide is out from Microsoft Press!!! Check it
out at http://www.microsoft.com/mspress/books/8763.asp
GPOGUY Blog: http://blogs.dirteam.com/blogs/gpoguy

 

[Guest]

Thank you Darren,
Your advise works

Eric-
One way you could do this is to set per-package permissions within a given
GPO, and then link the GPO high enough up in your AD hierarchy so that alll
machines that need to process it will. If you are creating a package in GP
Editor, and are looking at the Advanced options, then you will notice a
security tab, that by default grants Authenticated Users Read access to the
package. You can modify this ACL on a per-package basis so that a given
package is read only by a given machine, user or group. In that case, you
would remove the Authenticated Users ACE from the ACL and grant read
permission to the group that you wish to process that package. In this way,
you can have a single GPO that selectively deploys packages to users,
computers or groups.

Darren

--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Whitepapers and Utilities for all things Group Policy-related
And, the Windows Group Policy Guide is out from Microsoft Press!!! Check it
out at http://www.microsoft.com/mspress/books/8763.asp
GPOGUY Blog: http://blogs.dirteam.com/blogs/gpoguy