Deployment Solution

I am working on RightFax Print driver application. This is unsigned driver and ultimately ending up with Windows logo testing warning. I could suppress this warning from the Driver signing policy. But as the group policy gets refreshed after certain time span, and the registry value gets reset back to the original one, the warning comes up again.
Has anyone faced similar issue? Kindly help on this. 

Can you modify the registry, install it, and modify it back?

Hi Mike,

I have tried that.

I am installaing RightFax client. and There are total 3 installations I am doing with the setup.exe. RightFax FaxUtil, RightFax Print Driver and AutoReply. Installation is done in the same sequence.

And I am working in the AD environment. Logo testing policy is handled through GPO. If the group policy gets refreshed anytime during the installation, the warning comes up again.

Is there any other workaround to tacle this?

has anyone else faced this kind of issue?

Regards,

Smita

Is this in Windows XP or Windows 7?

Its Windows XP.

Are you attempting to run this as a local admin or a specific user across all machines?

Tried as local admin first and then also attempted to deploy from altiris with Driver sugning policy set to show warning.

As long as GPO is not refreshed, install goes fine both the ways.

I realize your AD administrators may not want to disable that policy, but they may be able to change the rights of the policy to "deny" that specific userid the ability to apply that policy.  This should help you out.  Otherwise, if they don't want to do that, you could potentially block all traffic to/from your domain controllers (i.e. place them into a host file with their hostname/domain name pointing to 127.0.0.1 and/or remove DNS servers from TCP/IP settings).  If the client can't connect to the domain controller, the GPO's can't be updated.  You'll just have to make sure that you clean it up afterwards.

If this were in Windows 7, it would be easier as you can actually modify the registry so that you can temporarily disable Group Policy Processing service (GPSVC).

You might be able to get your administrators to make a change in the policies where the refresh interval is increased to allow you to install your software.  That way there is a compromise without a compromise of security.

This is located in the following areas:

Computer Configuration -> Administrative Templates -> System -> Group Policy -> Group Policy Refresh Interval for Computers

User Configuration -> Administrative Templates -> System -> Group Policy -> Group Policy Refresh Interval for Users

Thanks Brian, I will give it a try and let you know how it goes. But your information was useful.

One more thing I would like to ask about it is, is there anything that we can do at the time of deployment. I have never worked on deployment. But I have seen different scenarios, where setting diff options in deployement console can solve the issue.

For Ex., you have mentioned above about temperorily disabling group policy. Since this is for a particular instance. and not going to reflect all the machines in production, can we set it at the deployment console? again I am not sure about deployment.

If anyone is aware of something like this, please post your openion. That would help me.

Depending on the situation you are attempting, there are some things you can do via DS.

The easiest is probably to replace the hosts file with one that redirects all requests to domain controllers or the domain to 127.0.0.1.  This would probably mean that you would have to do your install as a local administrator as the domain wouldn't be available for authentication.

An example would be:

If your domain controllers are dc1, dc2 and dc3 and the domain name is domain.local (i.e. dc1.domain.local, etc.), your hosts file might look like this:

domain.local      127.0.0.1
dc1                   127.0.0.1
dc2                   127.0.0.1
dc3                   127.0.0.1
dc1.domain.local  127.0.0.1
dc2.domain.local  127.0.0.1
dc3.domain.local  127.0.0.1

I can't say for certain this would work though, so you would have to test it out.  To remove the DNS servers from your TCP config, you could do a configure computer job in DS.

You can't enable/disable policies on the fly via DS for the domain though, that would be something that your administrators would have to do for you.

Another note, however, if you are doing this as part of a build, you might consider doing the software install prior to joining the computer to the domain, thus the policies wouldn't be pushed down at that point.