User-based Software Delivery

The introduction of Altiris 7 has brought some new and exciting features with it. One of those features is a much improved software delivery system which allows for user based software delivery.

Our idea was to install software on people's computers based on the primary user of the PC. We could more easily automate installs as well as uninstalls this way. We were looking for a way to easily create groups of users which was also easy to maintain and authoritative. Since we are using Active Directory we have the option to import the structure and deliver software by OU. This is not a bad solution at all assuming the software title in question does not traverse users in multiple OUs, but if it does the setup can start to get tedious. It made more sense to us to use security groups to handle this with a group corresponding to each software title.

Luckily there is an option to import security groups from AD into Altiris. The problem with the supplied method is that it requires adding the desired groups one at a time. Again this is fine if there are just a few groups but I do not think many environments have only a few software titles, therefore the process is rather tedious and requires adding and removing groups which are no longer needed.

Ultimately we settled on putting all the groups under a single OU in AD and utilizing the ASDK to import those groups. For us putting the groups in AD makes adding and removing users simpler since every admin has the AD tools installed. This could also be helpful if there is resistance from people with regard to learning the console.

Attached is the script which imports all the groups under a specified OU and creates a filter, not a group, with only the users in AD in that filter. The script processes as follows:

1. Connect to OU in AD
2. Retrieve list of security groups from that OU
3. For each group:
      a) Check for a filter with the same name as the security group. Create the filter if it does not exist.
      b) Delete all users from the existing group. *This makes AD authoritative.
      c) Iterate through the list of users in the group and add them to the filter. This part is recursive and will handle nested groups.
      d) Update the filter.

The only dependency is that a rule to import users from AD is established and has run. The script can be run various ways but will require credentials with enough rights to read the necessary information. Domain Admin should be adequate. :-)

I am sure someone can find a use for this other than what we thought. If you do something neat with it let me know as I would be curious. If you have any questions feel free to contact me.