Is there a way to automatically deploy .net 4 using Active Directory group policy or WSUS?

I want to push it out to lots of machines without having to go around to each one.

Background: I have a VSTO ClickOnce application I want to deploy to non-admin users, but it uses .net 4, which won't install without admin rights, so ClickOnce fails for non-admins unless .net 4 is already installed.

  • Does anyone know if unpacking and then invoking netfx_Core_x86.msi works? What are kb958488 and kb956250? These updates are in the package. – Terence Johnson May 11 '10 at 17:35
  • In the end, I went round and installed manually, after placing the full installer package on a network share. It appears, however, that .Net4 is available on Windows Update now. – Terence Johnson Jun 25 '10 at 18:25

We used a script via Altiris Deployment. It should function as computer logon script or via remote cli. You need to grab the stand-alone installer from Microsoft.

START "" /WAIT dotNetFx40_Full_x86_x64.exe /q /norestart /log %TEMP%\dotNet4.log


Also wanted to add that this install will take a couple minutes, or longer, depending on the speed of the client's computer. Performing the install should likely be scheduled during a maintenance window where users will not restart their computers for "not-responding". It may also be wise to restart the machine post-install. We don't as we perform an Altiris software inventory immediately after.


For versions 2.0, 3.0, and 3.5, installing .NET Framework directly from the .msi database would fail with a message about needing to launch setup.exe unless either the ADDEPLOY or VSEXTUI properties were set to 1. I'm assuming that when using Group Policy it automatically sets ADDEPLOY to 1 for every installation it performs, but otherwise you'd need to do this explicitly.

For both the Client Profile and Extended editions of .NET Framework 4.0, it works the same way except the one and only property you can set is called EXTUI; ADDEPLOY won't have the desired effect. (If you look at the CA_BlockDirectInstall action in the InstallExecuteSequence table of the .msi database you'll see that the condition for that particular action is "NOT (EXTUI = 1 OR Installed)"). After setting that property to 1, I've been able to perform deployments directly from the .msi via Novell ZENworks or msiexec.exe with no issues whatsoever. One would think Active Directory should be just as easy except, unlike with ADDEPLOY, I'm guessing you'll probably need to set the EXTUI property yourself, which can be done with a transform.

A minimal command line to perform an unattended installation of, for example, 64-bit .NET Framework 4.0 Client Profile would be...

msiexec.exe /i netfx_Core_x64.msi EXTUI=1

...or simply...

netfx_Core_x64.msi EXTUI=1

Since there are no installation options for the user to customize, the (default) full interface mode is already effectively an unattended installation, so you don't need to add /passive or any /q switches to make it execute unattended.

  • Or unzip the exe using 7zip, then use one of the .msi's for your group policy. I've only done this once and don't see it recommended anywhere so I guess caution is advised. – daniel Jul 19 '17 at 18:45
  • @daniel Well, yes, Microsoft does/did not provide a direct .msi download of the .NET Framework so you'd need to extract it from the .exe installer; that's the same .msi I was referencing in my answer. However you choose to extract the .msi (7-Zip, or Microsoft self-extracting installers typically have an /extract command line parameter or something similar), the issue still remains that installing directly from the .msi will be blocked if the requisite properties aren't set. – BACON Jul 19 '17 at 18:51

.NET Framework 4.0 is currently available through WSUS and it appears to work fine on both the workstation and server operating systems. We began to pilot the package last week without incident.


Take a look at this my friend. http://msdn.microsoft.com/library/ee390831%28v=VS.100%29.aspx

  • Well, SCCM is a little heavy for that ;) – TomTom May 11 '10 at 17:19
  • I don't have SCCM. – Terence Johnson May 11 '10 at 17:32
  • you cannot deploy .net 4 from Group Policy as an .msi from what I can find. I believe you can script the deployment though :). – Campo May 11 '10 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.