Uninstall this application when it falls out of the scope...

[senormic]

of management.

Hi all. I had this problem today where all of my Adobe Reader 8.1 GPSI installs (originally deployed in Sept 07) started uninstalling on my end users as they started up their computers or rebooted. I know this is because I de-linked this policy from my computer OU's late yesterday afternoon, not realizing that I had the box checked to "Uninstall this application when it falls out of the scope of management.".... it was a fun fun FUN day...

My question is.... I went and edited the GPSI and unchecked this option to uninstall... What I really need to know is, if I de-link this policy again from the computer OU's, will it still uninstall the Adobe Reader installs (300+) that were originally installed back in Sept 07? Or do I have to re-deploy to every computer in the orginization again?

Ideally, I'd love to be able to uncheck the box and then have the computers inherit the updated policy, without having to uninstall and reinstall all over again. I want to be able to de-link this policy from my OU's and just have it on a specific one that I use for imaging workstations. But now since my disaster this morning, I'm afraid to de-link and test out. And the kicker is that I de-linked this policy to fix ONLY one end users bad install - bad move.

Has anyone had this type of problem before or perhaps know the answer to my question?

It would be much appreciated!!!

Thanks,

Chris

[jdobiash]

Unfortunatly, I found out that once a machine gets the package installed while the option is checked, it remembers that setting even if you change the policy. The only way to fix it would be to uninstall all of them, change the option and then reinstall them with it unchecked.

A good option for your situation, and one i use quite well, is to create a Security Group for workstations you DON'T want to have a package installed on. Then just modify the security of the GPO and set that group to "DENY" on "Apply Group Policy". This will make it not be installed (or uninstalled if already installed) only on the machines in that group, while not effecting the rest of your installs. If you need to fix a botched install, add the computer to the "No" group, reboot and let it uninstall, remove it from that group, reboot and it will install again.

[PreviousPoster]

Hi,

This is where the magic is:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Group Policy\AppMgmt]

All GPSI deployed software - which is within the Scope of Management (SOM) - is represented here with a GUID - you should find your software GUID in here.

Below the GUID, eg.:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Group Policy\AppMgmt\{ae8406c4-ff96-4b77-888b-6e11541653da}]
you'll find the "AppState" key - this key holds the info about whether it should stay or be removed when out of SOM.

My expirience (computer assignment) says:
DWORD of 9 = normal (leave alone)
DWORD of 11 = uninstall
- there are other values, but I don't have them here...

So, tweaking that key on the clients could get you far! Just be sure it's set to 9 and remove the GPO link (or move the AD account object) - nothing should be removed at reboot (or actually re-startup) from that point. A policy update (removing the "Uninstall this application when it falls out of the scope of management" checkmark, will do the exact same thing (just more safely). My testing shows it works just fine - as long as you get the AppState value updated you're OK.

If you do this stuff manually however (which is not recommended - and it shouldn't be necessary either), I've found that the first following reboot will take longer time (loading computer settings...). Instead you could delete the entire Software GUID key, in my case:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Group Policy\AppMgmt\{ae8406c4-ff96-4b77-888b-6e11541653da}]
That gives a faster reboot in my opinion - but please test it in your environment (isolated). I think the CSE does that "cleanup job" for you if you only change the AppState key, and that's probably what's taking extra time during startup.

Hope that helps!

Tip 1: Do your own testing in a virtual environment
Tip 2: Use a small MSI package for testing

[senormic]

Bummer!

Guys thanks for all of the info. I don't currently use security groups to shield any of my clients, so I'll have to give that a shot.

Thanks for all the help.

Chris