Group Policy is great, but sometimes you need to make tweaks to your systems in ways that aren’t covered by existing Group Policy settings. Traditionally login scripts were used to perform this task, but more recently I have used PolicyMaker by DesktopStandard. When Microsoft bought DesktopStandard and repackaged PolicyMaker as “Group Policy Client Side Extensions” (GPCSE) I was keen to deploy and use it.

Unfortunately this proved harder that it should have been. Despite approving the update (KB943729) for installation via WSUS I found that it wasn’t being deployed to a large proportion of my systems – with WSUS reporting that the update was “not needed”. Further investigation revealed that I wasn’t the only person with this problem and a solution wasn’t forthcoming.

So I gave up on using WSUS to deploy and used an MSI based installation via Group Policy. Typically it’s not possible to deploy command-line type installations (i.e. using update.exe or setup.exe) this way because it requires an MSI package. However MSI packages can contain command line actions as a “Custom Action”. So all we need to do is create a basic “empty” MSI package and modify it with some Custom Actions to actually perform the installation.

Preparation

Before progressing it should be noted that the package actually installs two updates. The first is “XML Lite” which is a prerequisite for the actual GPCSE update proper.

To create the new MSI package you can use Caphyon’s Advanced Installer http://www.advancedinstaller.com/. This comes in Free, Professional, Enterprise and Java versions. You get 30 days to try all the Enterprise features after which you will be limited to the Free version only – which is fine for our needs.

To modify the MSI package use “Orca” from Microsoft. This is best downloaded as part of the Windows® Server 2003 R2 Platform SDK here or a there is a direct link to an Orca installation here. This article, http://support.microsoft.com/kb/255905, gives an overview of using Orca.

You will also need to download the GPCSE and XML Lite updates: GPCSE and XML Lite.

Create the MSI Package

Run the Advanced Installer program and follow the “New Project” wizard. Choose the option to create “Simple” project. The options are pretty self-explanatory. I would suggest that you use “Group Policy Preference Client Side Extensions for Windows XP” as the application name and choose the option to create an MSI file. When you get to the “Add files to your project”, browse for the folder containing the downloaded GPCSE and XML Lite installation files.

After the wizard is complete you will be presented with the project window.

In the left-hand pane there are various options pages for you to select. You only need to modify a few settings on a few pages. These are the ones that I use:

Project Details:
Product URL: http://support.microsoft.com/?kbid=943729
Enable “Disable Modify” and “Disable Repair”

Install Parameters:
Installation Type: Choose “Per-Machine Only”

Prerequisites:
Supported Operating Systems: Enable “Windows NT from” only and select “Windows XP Service Pack 2”
Windows Installer Minimum Version: Select “3.0”
Predefined Software Launch Conditions: Enable “Minimum IE Version” and select “Internet Explorer 6.0”
Predefined System Launch Conditions: Enable “Run only if user has administrator priveleges”

Save the project and Build the MSI (F7). Exit the program.

Modify the MSI Package

Right-click on the MSI file created by Advanced Installer and choose “Edit with Orca”. The program window will display the contents of the MSI file as a list of tables.

Clicking on a table from the list on the left-hand side displays the contents of the table (as rows of data) on the right-hand pane. You need to add a few rows to the “CustomAction” and “InstallExecuteSequence” tables (CTRL+R). The row data that you need to add is listed below.

CustomAction Table:

Action	Type	Source	Target
SET_XMLLITE_INSTALL_PATH	51	XML_LITE_INSTALL_PATH	[APPDIR]WindowsXP-KB915865-v11-x86-ENU.exe
SET_GPCSE_INSTALL_PATH	51	GPCSE_INSTALL_PATH	[APPDIR]Windows-en-US-KB943729.exe
SET_XMLLITE_REMOVE_PATH	51	XML_LITE_REMOVE_PATH	[%windir]\$NtUninstallKB915865$\spuninst\spuninst.exe
SET_GPCSE_REMOVE_PATH	51	GPCSE_REMOVE_PATH	[%windir]\$NtUninstallKB943729$\spuninst\spuninst.exe
INSTALL_XMLLITE	50	XML_LITE_INSTALL_PATH	/quiet /norestart
INSTALL_GPCSE	50	GPCSE_INSTALL_PATH	/quiet /norestart
REMOVE_XMLLITE	50	XML_LITE_REMOVE_PATH	/quiet /norestart
REMOVE_GPCSE	50	GPCSE_REMOVE_PATH	/quiet /norestart

InstallExecuteSequence Table:

Action	Condition	Sequence
SET_XMLLITE_INSTALL_PATH	NOT REMOVE	6510
SET_GPCSE_INSTALL_PATH	NOT REMOVE	6511
INSTALL_XMLLITE	NOT REMOVE	6512
INSTALL_GPCSE	NOT REMOVE	6513
SET_GPCSE_REMOVE_PATH	REMOVE	6514
SET_XMLLITE_REMOVE_PATH	REMOVE	6515
REMOVE_GPCSE	REMOVE	6516
REMOVE_XMLLITE	REMOVE	6517

There’s a chance that you may need to use different sequence numbers from me in the InstallExecuteSequence table, depending on how your MSI file was built by Advanced Installer. If so, just make sure that the sequence numbers of your added rows are greater than the “InstallExecute” action sequence number, but less than the “InstallFinalize” action sequnce number. After making the changes, save the file. You should now be able to use the MSI file for deployment in your GPO.

Caveats

Just be aware that, if you re-open your Advanced Installer project to make any modifications, then rebuild, you will also need to modify the MSI again using Orca. There are a couple of ways around this:

1. Use a transform file
Instead of modifying the MSI file directly, create a transform file in Orca. The steps to do this are:

• Open original (unedited) MSI file for editing
• Select Transform/”New Transform” from the menu
• Add row data just as described above
• Select Transform/”Generate Transform”

When using the MSI file for GPO install you will then need to add the MST file to the “Modifications” tab.
2. Use Advanced Installer Professional
If you played with the Professional version of the product within the trial period you may have noticed that it includes functionality for Custom Actions natively. I haven’t tried it myself yet but it should be possible to eliminate the need for editing the MSI in Orca by making use of this functionality.

Finally, there are a few limitations to this technique that you should be aware of. Not all Windows Installer actions are implemented with these custom actions. Install and remove are fine, but there is no contingency for rollback, for example if part of the install fails or is cancelled. In the real world I’ve no problems with this limitation, but you may need to take it into consideration.

Roundup

I been using this technique for a while now with no issues. Hope this post helps others in the same position.