Installing applications with .EXE installers using GPO

It is no secret to anyone that in organizations the installation of applications on client computers should be (or, to be honest, it is recommended that it be) automated. Naturally, complex products, for example, such as Microsoft System Center Configuration Manager, can perfectly cope with such a task, but there have always been, are and will be organizations that for one reason or another did not acquire such a product. Therefore, you have to install software products using the same standard tools of the Windows operating systems, and for this task the functionality of Group Policy becomes preferable.
Also, everyone is well aware that, with the help of the extension of the client side, Group Policy Software Installation - GPSI, applications can be deployed to client machines in two ways: either by publishing only to users, or by assigning them to users or computers.

What are zap files for?

By and large, to publish applications, you can use both MSI installers and * .zap files, and both installation packages are processed differently. For example, the MSI software installation package file contains a database with all the necessary instructions for installing or uninstalling the application, and the Windows Installer service is responsible for installing the program on the client computer , which uses the Msi.dll library to read * .msi files. Accordingly, on the basis of the information announced in the installation package, this service copies the program files to the hard disk, as well as makes changes to the registry and performs other tasks specified in the installer. Most often, all the information specified in the msi installation file is set by the developer of the installed software product.
However, since not all software manufacturers use the Windows installer installation files, in some cases it may be necessary to create low-level application packages based on the zero administration initiative (in the original, this sounds like ZAW - Zero Administration for Windows), i.e. * .zap files , which are text files with the necessary instructions for installing the application. After creating such a file, it must be placed in the installation package folder in order for the client-side extension to be able to follow the installation instructions, after the publication of which the application will appear in the component of the Control Panel “Programs and Features”, and users will be able to install it. But, unlike the MSI installer, zap files have such significant limitations as, for example, that you will not be able to configure the installation process of the application if the installer does not contain installation parameters.
I would immediately like to note that this method is not as flexible as installing software using the MSI installation packages, however, if you cannot convert the installation file and the application must be centrally deployed, this method may turn out to be never by the way. Due to the fact that instructions for installing an existing exe file are included in such a text file for both 32-bit and 64-bit applications, the possibility of installing software products using this method does not include the following features:

• Running applications with elevated privileges;
• Rollback of changes in case of unsuccessful software installation process;
• Detection of damage to the installation process and subsequent restoration of this process;
• Installation of software components upon first access to the latter;
• Use and implementation of transformation files.

And this is just the main part of those things that you will not be able to perform during the deployment of software using ZAP files. Incidentally, deploying applications this way can only be done by publishing applications. So users, as I mentioned a few lines above, will be able to install such products directly from the " Install a program from the network " page of the "Programs and Features" control panel component .
Before we begin to create such a file and try using it, solely for testing purposes, to deploy a software product such as Irfan View, I think it will be correct if I tell you a little about the structure of such files. In such a file, only the first two lines are mandatory, where parameters such as:

• FriendlyName - that is, this is the name that will be displayed in the component of the Control Panel "Programs and Features" ;
• SetupCommand - the path to the application installation file is defined here. Naturally, if necessary, you can specify both the UNC path and use the mapped drive. Also, if the application can be installed with additional parameters, these parameters should be specified after the installation path.

In other words, when using this method, you should first study all the additional parameters of the installation files for each product.
In addition to these two parameters, in order for the application version and other information to be displayed in the CSE extension “Installing Programs” or in the component of the “Programs and Components” control panel , while writing such a file, you can add several additional parameters. For example, the following optional parameters are considered the most common:

• DisplayVersion = 2.13.1.5 . As you understand, this parameter is responsible for the displayed software version;
• Publisher is the name of the app manufacturer. This name will be displayed in the component of the Control Panel “Programs and Components”, as well as in the extension of the client side “Installing Programs” ;
• URL - Naturally, this is an address on the Internet designed to obtain additional information about the application.

ZAP file limits

As I already mentioned, unlike msi installation packages, applications deployed using zap files cannot be assigned to computers or users. It is also worth noting that when installing the application with the current method, the standard installation program is launched. In other words, in addition to the added parameters, using any additional parameters of this file, you cannot configure the software installation process. Another limitation is the fact that the application cannot be installed on behalf of the administrator account, which can be extremely inconvenient in some cases. That is, applications are always installed by the local administrator.
When creating ZAP files, you should definitely take note of the following points (I already spoke about some of them a few lines above):

• Firstly, due to the fact that by simply executing the ZAP file, the installation program is simply launched, as I have already said, this tool does not allow the installation process to run with elevated rights, which can be implemented using MSI packages. Therefore, if the application during its installation requests an increase in privileges, only those users for whom such permission is explicitly registered can install it;
• Secondly, due to the fact that ZAP files are text documents, when you save such a file, you can accidentally create a file with the extension .zap.txt, which, for obvious reasons, will not work correctly. In other words, make sure the file is saved with the correct extension;
• Thirdly, if you have computers with 64-bit operating systems in your network, you should definitely test the installation and operation of 32-bit applications on such operating systems. This is a very important step, since many 32-bit applications deployed with ZAP files may fail during their installation;
• And fourthly, if you do not change its behavior when creating a ZAP file with 32-bit software, it will not appear in the component of the Control Panel Programs and Features under 64-bit operating systems.

I think that you have already learned some information about the purpose and application of these files intended for publishing software, and it is time to try creating and distributing the application using this method.
The deployment process is as follows: first of all, information about the installation process of the software product is written in detail to the ZAP file. The installer, of course, must be in a public location, because otherwise it will not work. After that, you need to place the generated file in a public software distribution point. This is done so that the GPO you created can localize this file. And in the end, the GPO object itself is created, it is connected with the necessary unit and, with the expansion of the client side “Installing Programs”, the distributed software product is published for users.
Consider these processes, starting with creating the ZAP file itself.

Create a .zap file

We will publish now, as I wrote above, such a software product as Irfan View, therefore it is advisable to download and place the installation file from somewhere in a public folder.
Now, as I already said, by simply writing the path to the executable file, during the deployment of the software, its installer will be launched for the user. and the latter will have to go through all the steps of the wizard before the program is installed. For many users, this will be a big problem, and for this reason, along with the path to the installation file, you need to specify parameters for a quiet installation. Fortunately, this software product provides the possibility of such an installation.
The Irfan View installer has a list of various options that can help you during the silent installation of this product. Let's look at them:

• Silent - silent installation, that is, without user intervention;
• Folder - destination folder. If it is not specified with this parameter, then the old IrfanView folder will be used. If there is none, then the folder "Program Files \ IrfanView" is used;
• Desktop - creates a shortcut on the desktop; 0 = no, 1 = yes (default: 0);
• Thumbs - creates a shortcut for the thumbnail mode; 0 = no, 1 = yes (default: 0);
• Group - creates a group in the Start menu; 0 = no, 1 = yes (default: 0);
• Allusers - shortcuts on the desktop / in the Start menu for users; 0 = for the current user, 1 = for all;
• Assoc - allows you to set file associations; 0 = do not install, 1 = only images, 2 = select all (default: 0);
• Assocallusers - if this option is used, then file associations are established for all users (works only in Windows XP);
• Ini - if used, sets the user folder for the INI file (system variables are allowed).

Therefore, to install this software, we will use something like the following command:
iview435_setup.exe / silent / desktop = 1 / thumbs = 1 / allusers = 1 / assoc = 1
Now that we know for sure which command will install this software product, you can start writing the zap file itself. Therefore, to compose such a file, we perform the following steps:

1. We open any text editor, for example, the same Notepad ;
2. The very first line of the created file indicates the Application section, enclosed in rectangular brackets. That is, we write in this line like this: [Application] ;
3. As I already wrote above, here two lines are required, namely: the FriendlyName line and the SetupCommand line . Both in the first and second lines, the values ​​are indicated after equal in quotation marks. The sign is equally framed by spaces. That is, we get these lines:
   FriendlyName = “Irfan View”
   SetupCommand = “\\ SERVER NAME \ Install \ ... , and then the name of our installation file with all the parameters “ iview435_setup.exe ”/ silent / desktop = 1 / thumbs = 1 / allusers = 1 / assoc = 1
   If necessary, you can also add comments by putting a semicolon at the beginning of the line. For example, on a new line, add a comment where we write how our program will be installed:
   ; The program is installed in silent mode, with creating shortcuts on the desktop, a shortcut for thumbnails, and for all users with an association of only graphic images
4. Now we can deal with additional parameters by which we determine the version of the program, its publisher and the support URL. In other words, the DisplayVersion, Publisher, and URL parameters will be applied :
   DisplayVersion = 4.35
   Publisher = IrfanView
   URL = www.irfanview.com
5. We save the resulting file with the zap extension. For example, let this file be called “IrfanView.zap” .
   In other words, should get something like this:
   
   
   Fig. 1. Ready ZAP file

The file is almost ready for further deployment. All that remains for us is to place it in a public distribution point for software. For example, if our SDP is the Install folder, create the “ZAP Files” folder there and put this file there. Done. Now you can go directly to the distribution of software.

Deploy Irfan View with a previously generated .zap file

Now, at the final stage, you should go to the Group Policy Management snap- in and perform the following actions:

1. A new GPO is being created (naturally, if you wish, you can also use any of the existing GPOs), let it be called "ZAP Files Publication" . It is associated either with a specific unit, which includes user accounts, or with the level of the entire domain, and from the context menu of this object you should select the appropriate command designed to open the Group Policy Management Editor;
2. After that, already in the “Group Policy Management Editor” snap-in , we need to expand the User Configuration \ Policies \ Software Settings node, then go to the “Software Installation” node . In order for the application to publish normally, go to the settings for this node. In other words, from the context menu of this node, select the “ Properties ” command ;
3. Here, as I said, so that we can publish our application without any problems, we should specify the path to the distribution point in the properties of this client-side extension, that is, "\\ NURSERVER \ Install" . In addition, on the Advanced tab , it is necessary to check the option “ Make 32-bit X86 down-level (ZAP) applications available to Win64 machines ”. These settings are enough for us, we save all the changes made;
   
   
   Fig. 2. Configuring CSE GPSI extension
4. Now you can create a software distribution policy. In other words, from the context menu of this node, select the command designed to create a new package. Now in the dialog box that appears, select the type " ZAW Down-level applications package (* .zap) " from the drop-down list of file types , and then go to the folder with the previously created ZAP file. Naturally, at this stage it is necessary to choose the file, as shown in the following figure:
   
   
   Fig. 3. Adding a ZAP file for software deployment
5. Due to the fact that we don’t really need to add any additional options for this package, in the “ Deploy Software ” dialog box that appears , among all the available options, stop at “ Published ” and create an installation package.

Ultimately, node «Software Installation» of this equipment should be as follows:


Fig. 4. Snap-in Group Policy Management Editor after creating the package
Done, it remains only to check all the changes. Now you can even update the policy settings on the current machine. We do this forcibly, that is, together with the Gpupdate command , we specify the parameters / force / boor / logoff .
It remains only to install the published package. To do this, we go to the control panel and go to the "Programs and Features" component . Then, in order to get to the location from where the published product will be installed, click on the link"Install a program from the network . "
As you can see in the following illustration, here you can find our Irfan View.


Fig. 5. Application available for installation

Conclusion

Actually, no matter how sad it may be, on this note the process of software deployment by means of the functionality of Group Policy together with ZAP files is coming to an end. From this article, you learned about what ZAP files are, in which scenarios they should be used, and when you will need to dwell on other solutions. You learned about the syntax of such files, and also, of course, how to create such a file, and then how to distribute a software product using such a file. Write in the comments if you had to deploy software products in this way in your practice and, if it’s no secret, what kind of applications you deployed in this way, and have you encountered any pitfalls when using this method?