0

USB stick inserted into the target windows server? Download from a website on a personal machine, transfer the installable to a shared file system accessible by the target windows server? Download from a website directly to the target windows server? Mount a read-only SMB share provided by the software author?

Any help appreciated.

2
  • I'm sorry this wasn't more specific to start with. The reason why is I'm trying to understand my customer - I sell software to Windows IT administrators. They have many different security policies, topologies, etc. Many of them seem to have a lot of problems getting the software onto the target server. I was hoping for a general best practice to recommend to people having issues, but maybe there are just too many possibilities to be able to generalize.
    – user67443
    Jan 19, 2011 at 21:21
  • I edited my answer to reflect your new comment.
    – mfinni
    Jan 20, 2011 at 14:14

3 Answers 3

1

Not a great question - depends on many things:

  • Security requirements of your environment (may exclude USB sticks or even Internet access)
  • package size
  • install method
  • access to server (I don't want to go all the way to London with a USB stick)
  • firewall restrictions

And probably more beside. Please clarify if you're getting at this from a practical angle, or whether you're concerned with security etc.

2
  • In particular, people try to use internet explorer directly on the target server, and this fails because of security restrictions, often set as group policies which can not be overridden locally. Then it occurred to me that they probably shouldn't be doing this in the first place, and that this problem must have already been solved (how to get software on highly restricted windows servers 2008 and 2003) and to try and find that solution here.
    – user67443
    Jan 19, 2011 at 21:27
  • Yeah, depending on your security stance, you don't want servers being able to browse the web. Some server make use of external sites (FTP, SMTP, web services, etc) so those may need to be allowed, but it's an easy win to prevent them from browsing the web. So you'll need to do downloads of patches on other machines and get them onto the server in question. That said, once you've done that, there is no single "best practice" at all, as I described in my answer below, and the other answers echo similar thoughts.
    – mfinni
    Jan 20, 2011 at 3:56
0

My favourite is to deploy a simple FTP/NAS device to the network with a public folder. Push scripts to all the hosts to download from the FTP folder and execute the .exe's.

0

Answer edited after clarification from OP: If you're a vendor, then package it via the current MS recommendation, which is still MSI as far as I know. That allows people who use packaging software to incorporate it into their framework. After that, it's not your problem. If your customers put themselves in a box with so many restrictions that they can't figure out how to install software on their machines, get smarter customers.

Answer below for sysadmins:

There is no single answer for all environments, so I will give you the all-purpose answer : "It depends." It depends on the amount of money you've spent on tools, it depends on your needs, it depends on who (and how many) install software regularly, it depends on your security policies.

The last one would be really weird though - few vendors make SMB shares available over the internet.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .