Re: Firewall Client Deployment
- From: Brian Edwards <BrianEdwards@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Mon, 13 Nov 2006 15:05:01 -0800
I think I may have found the answer.
In my VMware test environment, I have a control machine that is not a member
of the AD 2003 domain, and I have two domain machines for testing, one Win2k
and one WinXPSP2.
I set up a GPO with the following settings:
- User Configuration -> Software Settings -> Software Installation:
--- create a package and point it to the MS_FWC.msi installer in the mspclnt
share
--- in the Deployment tab:
----- Deployment Type: Assigned
----- Deployment Options: only "Auto-install this application..." is
checkmarked
----- Installation User Interface Options: Basic
- User Configuration -> Windows Settings -> Scripts -> Logon:
--- created a script called "copy_ini.bat" with the following instructions:
----- @echo off
----- mkdir "c:\documents and settings\%username%\local settings\application
data\microsoft\firewall client 2004"
----- copy \\testserver\mspclnt\*.ini "c:\documents and
settings\%username%\local settings\application data\microsoft\firewall client
2004\" (I should also mention that I copied a "management.ini" file with the
"TrayIconVisualState" flag set to 1 into the mspclnt share as well as an
"application.ini" file with the settings I want to use)
In Group Policy Management Security Filtering, I applied the GPO to
"Authenticated Users". I also linked the GPO to the domain.
When a regular user logs into the XPSP2 machine, the FWC software loads
without prompting the user for anything, and the FWCMgmt screen never shows
up. But the software definitely gets loaded. When the user tries to open
the FWCMgmt item in the Start Menu, an install script runs but errors out,
telling me that the user does not have access to view/make any changes.
However, subsequent logins still display the configuration script loading,
albeit for only a few short seconds.
When an "administrator" logs into the XPSP2 machine, the FWC software loads
in the background, doesn't prompt the user, but the FWCMgmt screen does open
one time, and does have the "Hide icon..." setting checkmarked. When the
user clicks OK the first time, they never see the screen again, unless
opening it from the Start Menu.
Problem solved, for me anyway. Hope that helps *someone* else ;)
"Brian Edwards" wrote:
Gentlemen:.
Let me take this a step further...
I am currently testing deployment scenarios for the firewall client software
on a test network. I have a special GPO set up to deploy the software. I
have tried both the Computer Configuration and User Configuration templates
for Software Installation, and the exact same results apply to both. When a
user with simple user-level permissions on the local computer logs in and the
software gets installed, this procedure repeats itself each time the user
logs in. As in, it appears that the software gets reinstalled every login,
until a user with admin permissions logs in. After the admin logs in, the
install never again occurs for a regular user, but each time the user logs
in, they are presented with the FWCMgmt screen. It's not a huge deal but it
is annoying. However, this brings up some questions:
- when used concurrently with the "Install with elevated priviliges" setting
enabled, why does the firewall client software try to reinstall with every
user login until an "Administrator" logs in?
- does deploying the firewall client software require the use of a script
that will set a registry entry when the software is installed, such that each
subsequent login checks the registry setting (flag) in order to determine if
the software needs to be installed?
I know there is a flag in the INI file that can be set so that the FWCMgmt
screen does not show up for the user. I think the easiest way to set this
flag is to probably have a login script that will copy the "management.ini"
file, with the "TrayIconVisualState" flag set to 1, from a central share to
the user's "c:\documents and settings\%username%\local settings\application
data\microsoft\firewall client 200x\" directory. I could be very wrong about
that, but it has worked for me.
In any case, what is the method to use to deploy the FWC software using a
GPO such that user-permission users can install the software once, and never
again? I'd really hate to have to remote into 1,000+ computers and login
just to install the client.
TIA
"lushtanet" wrote:
Hi Edvord,
I have the same problem with ISA 2004 firewall clinet, when ever I deploy
the ISA clinet from a destribution share thru GPO this happens, but not when
you simply run the setup file. I can not tell why is this happening, maybe it
requres some switches to make it work, for now I'm in a midle of research on
this issue as soon as I know more I let you know.
It seems to be a general problem.
Bujar Lushta
CCNA. MCP
"Ori Yosefi [MSFT]" wrote:
Hi Edward,
This indeed sounds strange. Can you please explain how your machines got
into this situation? Is this reproducible?
Did you happen to create a shortcut to FWCMgmt in the startup folder by any
chance?
I am not familiar with such a scenario, please provide any information that
may help us understand how you got to to this scenario.
Thanks,
Ori.
--
Please do not send email directly to this alias. This alias is for newsgroup
purposes only.This posting is provided "AS IS" with no warranties, and
confers no rights.
"Edward" <Edward@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1DC1B186-03CB-4784-AE45-C96CA65892AA@xxxxxxxxxxxxxxxx
Hi All
I am deploying ISA Server's Firewall Client 2006 to client machines
running
Windows XP Professional SP2. The client software has successfully been
deployed on these computers, but whenever a user logs in the Firewall
Client
opens up a window with all its settings.
How can I prevent this windows from opening and instead just minimizing to
the tasktray such as previous versions done?
Regards
Edward
- References:
- Re: Firewall Client Deployment
- From: Ori Yosefi [MSFT]
- Re: Firewall Client Deployment
- From: Brian Edwards
- Re: Firewall Client Deployment
- Prev by Date: Re: Firewall Client Deployment
- Next by Date: netlogon error 5176 on isa2004
- Previous by thread: Re: Firewall Client Deployment
- Next by thread: Firewall Client deployment (FWC 2004)
- Index(es):
Relevant Pages
|
