Group Policy Objects phần 4

1. Figure 11.17: Published applications are available to the user via the Add/Remove Programs applet in Control Panel Note The option of publishing an application is only available within the User Settings portion of GPO
Nội dung trích xuất từ tài liệu:
Group Policy Objects phần 4 1. Figure 11.17: Published applications are available to the user via the Add/Remove Programs applet in Control PanelNote The option of publishing an application is only available within the User Settings portion of GPO. It is impossible to publish an application to a computer. (Notice that the Published option is grayed in Fig. 11.16.) Thus, when deploying applications on a per-computer basis, you can only assign applications.Lets briefly review what happens to the system registry when you publish or assign anapplication.As previously mentioned, when you publish an application, it will show up as an optionin the Add/Remove Programs Control Panel applet after the user (or machine) logs on tothe network. Note that to display the list of published applications, the client needs toquery Active Directory. After that, if the user chooses to install the published applicationand clicks the Add button (Fig. 11.17), the setup routine for that application will start toinstall it on the local computer.On the other hand, when you assign an application, an icon for that application will beplaced to the users Start menu or Desktop, and filename extension association for thatapplication will be created in the registry under HKEY_CLASSES_ROOT. Then, even ifthe application has yet to be installed, the user can invoke the installation process bysimply accessing a file that has such an extension type. Suppose Microsoft Word hasbeen assigned to the user but has not been installed. After the user double-clicks a filethat has the DOC filename extension, the installation procedure will start.Note When you assign an application to a machine, that application is actually installed at system startup. This lets you deliver application installations in an unattended way to a workstation or server.In summary, when you assign an application, three things happen to the usersenvironment: A shortcut is placed on the desktop (if specified in the application package). An association(s) is made in HKCR for that applications supported file extensions. OLE/COM registrations are made in HKCR for that applications supported components.Note What really happens in HKCR during application assignment is a function of the particular users security rights. If the user has administrative access over a machine, registrations are made in HKLMSoftwareClasses. If the user is a normal user — without sufficient rights to write to HKLM — then assigned application registrations are written to HKCUSoftwareClasses. However, you can override this default behavior within the MSI package, where you can specify that the application is installed only on a per-user or per-machine basis.Active Directory Class Store and the System RegistryAs mentioned throughout this book, the system registry keeps all information aboutapplications and COM (Component Object Model) components installed on a localsystem. All information related to how, and from what location, machines and users runinstalled applications resides under the HKEY_CLASSES_ROOT key. As a result, thiskey is often viewed as the registry of applications. However, as previously outlined inthis chapter, HKEY_CLASSES_ROOT, as well as other parts of the system registry,have one common limitation: they represent the local configuration database. The numberof local registries equals the number of Windows-based computers within a network, andthere is no easy way of ensuring that application information in all local registries is up-to-date. In previous Windows versions, there also was no easy method of pushing achange to all local registries on client workstations.When Active Directory was introduced with Windows 2000, the situation improved.Active Directory serves as a global repository of various objects, such as computers,users, and groups. It includes Class Store, which is associated with Group Policy Objects(GPOs). When an application is published or assigned within specific GPO, a Class Storeis created that reflects the COM classes that the application has registered (Fig. 11.18).To view Class Store information, start the Active Directory Users and Computer MMCsnap-in, then select the Advanced Features command from the View menu. Youll findClass Store information nested within System | Policies container, which stores all GPOs(identified by their GUIDs) defined for a specific domain. Under a specific GUID, thereare two more subcontainers: Machine and User. Class Store can be either machine- oruser-specific, depending upon how application deployment has been defined. After anapplication is published or assigned, the Microsoft Installer (MSI) package is queried todetermine all COM classes defined within that package. These classes are stored byGUID in Class Store.Figure 11. ...