Deployment methodology

[Gazzieh]

I am investigating an improvement to our deployment method and would really like your thoughts and experiences.

At present we are using standard GPO deployment with MSIs. Where a program does not come as an MSI we create one using WinInstall 2003 LE. The issue is that we have over 700 workstations and deployment often fails on large scale deployments. This seems to be because WinInstall creates MSI wraps and so we end up with lots of files transferring across the network; blowing out the server. Equally we have some individual computers that do not successfully take on the MSI but flag into GPO that the deployment has been received. This seems to lock msiexec until we try a manual deploy and then all installs continue as if nothing happens.

We need a solution that allows us to identify what has been deployed to which workstations, allows us to tailor deployment more precisely than GPOs allow and to redeploy to individual workstations if necessary.

We are looking at SMS but need to know if this is more suited to our needs and the cost per unit.

I will not implement ghosting or imaging.

Any ideas or suggestions would be gratefully received.

 

[snootalope]

Sorry, I can't help you much with the SMS questions.. However, first thing that came to mind was why not deploy the MSI's to smaller groups of machines at a time, rather than the whole company at once.

For instance, separating the machines into departments by creating new OU's for them. That way, you can roll out the updates in just small chunks. Fix whatever didn't work and move on to the next group. Of course, you'd probably have to do some GPO arranging (just linking, not a huge deal) but at least you wouldn't have to worry about 700 machines at one time!

 

[Gazzieh]

I agree and in fact we looked at this model. However, the GPO method is a bit of a sledgehammer and we hav almost 60 separate titles to deploy and so we either have 60 separate GPOs (no way!) or we try to deploy the whoe list as a complete go one OU at a time (which would mean as many links to OUs as we have OUs and that is a lot!).

SMS does seem to be the way forward since we should be able to push to individual units or complete blocks of units; my concern now is cost, reliability and ease of implementation.

Nothing much really. )

 

[snootalope]

You wouldn't need 60 GPO's. You could link the one(s) you have now and just have a single GPO that distributes the MSI's and just assign that one to a particular OU as you go along..

 

[Gazzieh]

The 'Sheep Dip' method. )

Not a bad idea, though individual reporting wouldn't be possible it would be less of an issue on a smaller scale.

Thanks for the help!

 

[58sniper]

I always create a "standard" GPO that deploys applications that EVERYONE gets. This GPO might have a ton of apps in it, but it's much easier (and smarter) than doing a ton of individual GPOs. I use the same GPO for the standard printers that everyone gets as well.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP

 

[porkchopexpress]

We manage over 500 desktops using standard AD tools here with no problems but we do split them into 5 OU's for application deployment, this gives us a short testing period where the first 100 are using the apps and can give feedback and we can observe issues also you don't need to worry about overloading the server. Having said that i really can't remember a time when i've seen errors due to the server being overworked.