Deploying Group Policy Preference Client Side Extensions for Windows XP via Group Policy

Group Policy is great, but sometimes you need to make tweaks to your systems in ways that aren’t covered by existing Group Policy settings. Traditionally login scripts were used to perform this task, but more recently I have used PolicyMaker by DesktopStandard. When Microsoft bought DesktopStandard and repackaged PolicyMaker as “Group Policy Client Side Extensions” (GPCSE) I was keen to deploy and use it.

Unfortunately this proved harder that it should have been. Despite approving the update (KB943729) for installation via WSUS I found that it wasn’t being deployed to a large proportion of my systems – with WSUS reporting that the update was “not needed”. Further investigation revealed that I wasn’t the only person with this problem and a solution wasn’t forthcoming.

So I gave up on using WSUS to deploy and used an MSI based installation via Group Policy. Typically it’s not possible to deploy command-line type installations (i.e. using update.exe or setup.exe) this way because it requires an MSI package. However MSI packages can contain command line actions as a “Custom Action”. So all we need to do is create a basic “empty” MSI package and modify it with some Custom Actions to actually perform the installation.

Preparation

Before progressing it should be noted that the package actually installs two updates. The first is “XML Lite” which is a prerequisite for the actual GPCSE update proper.

To create the new MSI package you can use Caphyon’s Advanced Installer http://www.advancedinstaller.com/. This comes in Free, Professional, Enterprise and Java versions. You get 30 days to try all the Enterprise features after which you will be limited to the Free version only – which is fine for our needs.

To modify the MSI package use “Orca” from Microsoft. This is best downloaded as part of the Windows® Server 2003 R2 Platform SDK here or a there is a direct link to an Orca installation here. This article, http://support.microsoft.com/kb/255905, gives an overview of using Orca.

You will also need to download the GPCSE and XML Lite updates: GPCSE and XML Lite.

Create the MSI Package

Run the Advanced Installer program and follow the “New Project” wizard. Choose the option to create “Simple” project. The options are pretty self-explanatory. I would suggest that you use “Group Policy Preference Client Side Extensions for Windows XP” as the application name and choose the option to create an MSI file. When you get to the “Add files to your project”, browse for the folder containing the downloaded GPCSE and XML Lite installation files.

Advanced Installer Project Window

Advanced Installer Project Window

After the wizard is complete you will be presented with the project window.

In the left-hand pane there are various options pages for you to select. You only need to modify a few settings on a few pages. These are the ones that I use:

Project Details:
Product URL: http://support.microsoft.com/?kbid=943729
Enable “Disable Modify” and “Disable Repair”

Install Parameters:
Installation Type: Choose “Per-Machine Only”

Prerequisites:
Supported Operating Systems: Enable “Windows NT from” only and select “Windows XP Service Pack 2”
Windows Installer Minimum Version: Select “3.0”
Predefined Software Launch Conditions: Enable “Minimum IE Version” and select “Internet Explorer 6.0”
Predefined System Launch Conditions: Enable “Run only if user has administrator priveleges”

Save the project and Build the MSI (F7). Exit the program.

Modify the MSI Package

Right-click on the MSI file created by Advanced Installer and choose “Edit with Orca”. The program window will display the contents of the MSI file as a list of tables.

Orca

Orca

Clicking on a table from the list on the left-hand side displays the contents of the table (as rows of data) on the right-hand pane. You need to add a few rows to the “CustomAction” and “InstallExecuteSequence” tables (CTRL+R). The row data that you need to add is listed below.

CustomAction Table:

Action Type Source Target
SET_XMLLITE_INSTALL_PATH 51 XML_LITE_INSTALL_PATH [APPDIR]WindowsXP-KB915865-v11-x86-ENU.exe
SET_GPCSE_INSTALL_PATH 51 GPCSE_INSTALL_PATH [APPDIR]Windows-en-US-KB943729.exe
SET_XMLLITE_REMOVE_PATH 51 XML_LITE_REMOVE_PATH [%windir]\$NtUninstallKB915865$\spuninst\spuninst.exe
SET_GPCSE_REMOVE_PATH 51 GPCSE_REMOVE_PATH [%windir]\$NtUninstallKB943729$\spuninst\spuninst.exe
INSTALL_XMLLITE 50 XML_LITE_INSTALL_PATH /quiet /norestart
INSTALL_GPCSE 50 GPCSE_INSTALL_PATH /quiet /norestart
REMOVE_XMLLITE 50 XML_LITE_REMOVE_PATH /quiet /norestart
REMOVE_GPCSE 50 GPCSE_REMOVE_PATH /quiet /norestart

InstallExecuteSequence Table:

Action Condition Sequence
SET_XMLLITE_INSTALL_PATH NOT REMOVE 6510
SET_GPCSE_INSTALL_PATH NOT REMOVE 6511
INSTALL_XMLLITE NOT REMOVE 6512
INSTALL_GPCSE NOT REMOVE 6513
SET_GPCSE_REMOVE_PATH REMOVE 6514
SET_XMLLITE_REMOVE_PATH REMOVE 6515
REMOVE_GPCSE REMOVE 6516
REMOVE_XMLLITE REMOVE 6517

There’s a chance that you may need to use different sequence numbers from me in the InstallExecuteSequence table, depending on how your MSI file was built by Advanced Installer. If so, just make sure that the sequence numbers of your added rows are greater than the “InstallExecute” action sequence number, but less than the “InstallFinalize” action sequnce number. After making the changes, save the file. You should now be able to use the MSI file for deployment in your GPO.

Caveats

Just be aware that, if you re-open your Advanced Installer project to make any modifications, then rebuild, you will also need to modify the MSI again using Orca. There are a couple of ways around this:

1. Use a transform file
Instead of modifying the MSI file directly, create a transform file in Orca. The steps to do this are:

  • Open original (unedited) MSI file for editing
  • Select Transform/”New Transform” from the menu
  • Add row data just as described above
  • Select Transform/”Generate Transform”

When using the MSI file for GPO install you will then need to add the MST file to the “Modifications” tab.
2. Use Advanced Installer Professional
If you played with the Professional version of the product within the trial period you may have noticed that it includes functionality for Custom Actions natively. I haven’t tried it myself yet but it should be possible to eliminate the need for editing the MSI in Orca by making use of this functionality.

Finally, there are a few limitations to this technique that you should be aware of. Not all Windows Installer actions are implemented with these custom actions. Install and remove are fine, but there is no contingency for rollback, for example if part of the install fails or is cancelled. In the real world I’ve no problems with this limitation, but you may need to take it into consideration.

Roundup

I been using this technique for a while now with no issues. Hope this post helps others in the same position.

12 thoughts on “Deploying Group Policy Preference Client Side Extensions for Windows XP via Group Policy

  1. Travis

    Thank you for this informative and detailed post. I don’t quite have it working correctly yet though, and was wondering if someone has come across the same error message that I am getting when trying to run the setup.msi that is created from Advanced Installer builds. Before add the setup.msi to a group policy software installation package I decided to test the install by running the installer manually. The error message that I am getting is as follows:

    “There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or a package vendor.”

    I have run the installer on two separate machines with the same result. Also the user that I am running it under does have administrative rights to the machine.

    Also, I have created the setup.msi with ORCA modifications twice to be sure that there wasn’t a typo. In both attempts I copied and pasted the ORCA modifications so that I wouldn’t have a typo.

    Interestly, when I don’t include the ORCA customizations I am able to run the installer successfully (meaning no error message), however, the GPCSE update does not appear in the registry or in c:\windows\$NTUninstallK943729$ location.

    If I can get this to work my life will be made much easier when we have to re-ip a large remote office next month.
    Thanks,
    Travis

    Reply
    1. Nick Brown Post author

      @Travis
      Try creating a log file when installing like this:
      msiexec /I setup.msi /l* c:\setup.log

      Or, for more detail:
      msiexec /I setup.msi /l*vx c:\setup.log

      Take a look at the log for errors.

      Reply
  2. Travis

    Thank you for getting back to me Nick. Here is my error log. The reason for the failure did not stand out to me.

    [log snipped]

    Reply
  3. Travis

    Sorry about posting the entire error log here. I don’t know another way to do this. Here is the next part of the error log. I have included the last two lines from the previous buffer cut off point.

    [log snipped]

    Reply
  4. i3laze

    Man.. you have to publish this MSI somewhere.

    I don’t wanna mess these two pages with AdvInstaller,even i got it installed both on home and office PC : )

    Reply
  5. jetpax

    Try running the exe’s on one of your XP clients separately first.

    I found that when I executed the XMLlite install independently (ie as an exe) on XP SP3 it failed, since it was not required. So I removed it from the the MSI and Orca mods.

    My GPCSE also failed to run directly on a client, but that was because I found I had accidently downloaded the 64bit version.

    Once I had put the 32 bit in the MSI, it worked perfectly.

    Reply
    1. Nick Brown Post author

      Good point. With a bit more work it would be possible to add the necessary logic to the installer to detect whether each component is needed or not and skip the installation custom action by using an appropriate CONDITION statement.

      Reply

Leave a Reply

Your e-mail address will not be published. Required fields are marked *