Problem

You want to install PG Desktop on multiple machines without manually interacting with each one. You also do not have access to a 3rd party software deployment service.

Solution

Use Group Policy to deploy PortalGuard desktop along with an MST file to apply specific settings for your deployment.

Requirements

1. Access to Group Policy Management

2. A Network Path accessible to all machines/users on the domain with at least ‘Read’ access.

Implementation Steps

1. From a Domain Controller on your network, Launch the Group Policy Management utility.

   1. You can either use the ‘Search’ functionality, or use ‘run’ and execute the following:

      1. gpmc.msc

2. Right-click your domain name in the left-hand navigation bar and choose the option to ‘Create a GPO in this domain and Link it here…’

3. Set a name for the GPO.

   1. e.g. “PG Desktop Installation”

4. Right-click the new GPO from the left-hand navigation bar and select ‘Edit' to bring up the GPO editor.

5. In the new ‘Group Policy Management Editor’ window, expand Computer Configuration → Policies → Software Settings within the left-hand navigation bar.

   1. 

6. Right-click ‘Software Installation’ and choose New → Package…

7. Point to the PortalGuard Desktop Installation MSI.

   1. IMPORTANT: You MUST point to the MSI on a Network Share, otherwise client machines will not be able to access the MSI in order to complete the installation.

8. On the ‘Deploy Software’ screen, choose ‘Advanced’ and click ‘Okay’.

   1. Required for utilizing the MST.

9. Navigate to the Modifications tab and click ‘Add…’.

10. Point to the MST file.

    1. IMPORTANT: You MUST point to the MST on a Network Share, otherwise client machines will not be able to access the MST in order to apply custom settings to the base MSI.

11. Click ‘Ok’.

12. Still within the ‘Group Policy Management Editor’ window, enable the following settings:

    1. Computer Configuration → Policies → Administrative Templates → Windows Components → Windows Installer

       1. Enable the ‘Always install with elevated permissions’ setting.

    2. Computer Configuration → Policies → Administrative Templates → System → Logon

       1. Enable the ‘Always wait for the network at computer startup and login’ setting.

    3. Computer Configuration → Policies → Administrative Templates → System → Group Policy

       1. Enable the ‘Configure Software Installation policy processing’ setting and then check the ‘Allow processing across a slow network connection’.

    4. We also recommend configuring the following settings to ensure that the MSI distribution process is smooth and seamless:

       1. Computer Configuration → Policies → Administrative Templates → Windows Components> Window Installer → Always install with elevated privileges

       2. Computer Configuration → Policies → Administrative Templates → System → Logon → Always wait for the network at computer startup and logon

          1. IMPORTANT: You may wish to leave this setting at the default (disabled) if you require frequent ‘offline’ use of your domain-joined workstations (e.g. Remote Work).

       3. Computer Configuration → Policies → Administrative Templates → System → Group Policy → Software Installation policy processing

          1. Check “Allow processing across a slow network connection”

13. Close the ‘Group Policy Management Editor’ window.

14. Within the Group Policy Management utility, select the GPO that you just created.

15. On the right-hand side of the screen, update the ‘Security Filtering’ section to apply a scope of only the machines you wish to have the PG Desktop software installed on.