PLANNING AN AD DS STRATEGy in VS .NET

Generator QR Code JIS X 0510 in VS .NET PLANNING AN AD DS STRATEGy

When planning a Group Policy application deployment, you must review your organization s software requirements and compare them to your AD DS organizational structure and your available Group Policy Objects (GPOs). With this information, you can determine how you want to deploy your applications. Then create a test environment to determine exactly how you want to assign or publish software to your users or computers.

Some of the basic strategies for Group Policy software deployment that you should consider are as follows:

Create organizational units (OUs) based on software management, rather than security, needs. This strategy enables you to target applications to the appropriate users. Deploy software close to the root of your AD DS domain. Deploying software high in the domain hierarchy makes it easier to provide all of the users in an organization with access to an application. This reduces administration because you can deploy the package using a single GPO rather than having to re-create the object in multiple containers deeper in the AD DS hierarchy. Deploy multiple applications with a single GPO. In organizations where users share the same core set of applications, this practice reduces administration overhead by enabling you to create and manage a single GPO rather than multiple GPOs. Also, the user logon process is faster because a single GPO deploying multiple applications processes faster than multiple GPOs each deploying one application. Publish or assign applications only once to a given group of users or computers. Deploying the same application in multiple configurations is sometimes necessary to support different types of users. However, you should avoid deploying multiple copies of the same application in such a way that users are forced to decide which version they need. Instead, adjust your deployment strategy wherever possible so that each configuration is delivered only to the users and computers that need it.

A software distribution point is a location on a shared network drive on which you store the packages you intend to deploy using Group Policy. When you create a Software Installation policy, the package you specify is not actually stored in the AD DS database. The GPO contains only a pointer to the package s location. Therefore, the package must be accessible, not only to the computer where you are running the Group Policy Management Editor, but also to the computers and users who are to receive it. You can create multiple distribution points or a single distribution one for all of your packages as long as you create separate folders for each application and each version. Configure the share and NTFS permissions so that administrators have Read and Write access to the distribution point. Users need only Read access.

The Properties sheets for the Software Installation folders in Group Policy Management Editor contain configuration settings that apply to all of the package policies you create in that folder. Some of the settings establish defaults for parameters you can customize on individual policies, as shown in Figure 10-3, while others enable multiple applications deployed by the same GPO to coexist.

For example, the File Extensions tab, shown in Figure 10-4, enables you to establish priorities for the file associations created by the deployed applications. If you install two applications that both create associations for the same file extension, you can specify which one of the applications should launch when a user opens a file with that extension.

When you browse to the Software Installation folder under Computer Configuration or User Configuration, right-click it, and select New | Package from the context menu, you must first browse to the software distribution point you created and select the package file you want to deploy. After you do this, the Deploy Software dialog box appears, as shown in Figure 10-5, in which you can specify whether you want to assign or publish the package. When you deploy a package to computers (as opposed to users), the Published option is unavailable, and if you select the Advanced option, the package s Properties sheet appears.