We are running our company network with a few 2008 R2 AD server and windows 7 workstations. Our users do not have local admin rights our their computers, hence, the IT departement is required each time :

  1. a user needs to install an application
  2. java needs to upgrade for example ...

Here is what i think :

  1. i think we should be able to deploy some apps using GPO
  2. for this scenario, i really don't know ...

What are the solution to handle this smoothly ? It would be nice to have a one-time admin password for example ...

Thanks !


Some of the various things I've used in the past to do this:

  1. Group policy, including log on install scripts (batch/vbscript/powershell to throw switches at exe files)
  2. Altiris Deployment Solution and/or Altiris Software Delivery
  3. Beyond Trust Powerbroker Desktops, a group policy plug-in that gives install privileges to processes rather than users (for example, it gives the java updater "admin" privileges instead of the users)
  4. PsExec and scripts.

Things I haven't used that are pretty standard include Microsoft System Center, Numara Asset Manager, etc.

There are lots of ways to handle this sort of thing, and it depends on how much you want to spend, how big your environment is, and whether you'd rather spend money or time.


To deploy applications, including java you can use Microsoft SMS or a program alike. At the company where I work we are using OCS-Inventory to do that. Applications like Java which can not be updated when in use we schedule to the sunday when people are out of the office, we have a maintenance window there and just upgrade at that point.

For most applications the automatic update check can be disabled, so we did this. No more bug messages to users, and we decide when we want to upgrade.

  • 2
    By Microsoft SMS do you mean Systems Management Server? Hasn't that been replaced (going back several years) by the System Center suite of products?
    – joeqwerty
    Aug 23 '13 at 10:29
  • it had to be: Microsoft System Center rather then SMS indeed, SMS is the old product. microsoft.com/en-us/server-cloud/system-center/… the rest of the story still applies however.
    – Flash
    Aug 23 '13 at 15:13

Any MSI package can be installed directly using group policy, including any Transforms that might be created. Using a tool like Orca or SuperOrca you can generally customize these MSI/MST files to do whatever setting changes you need, or in the case of applications like Java or Flash player you can use Computer Configuration->Preferences->Windows Settings->Files to deploy configuration files in the same GPO you install with.

I am currently using this in our production environments to manage Java, Flash and Reader.

How To Use Group Policy To Remotely Install Software

The major thing that stumps people is this. Installation occurs at startup, however scheduling occurs at logoff or shutdown (can't remember which). So in order for a package to get installed, the group policy that triggers the installation must have been refreshed on the local system prior to the restart that will install it. Group policy should, in most cases, be refreshing every 4 hours or so anyway, so for production this isn't usually a huge problem, but if you're not prepared for it during testing you'll simply think it's not working.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.