Microsoft User Experience Virtualization Deployment Guide

Transcription

1 Microsoft User Experience Virtualization Deployment Guide Microsoft User Experience Virtualization (UE-V) is an enterprise-scalable user state virtualization solution that can provide users a consistent Windows and app experience across devices no matter how you deliver Windows or apps. It is part of the Microsoft Desktop Optimization Pack (MDOP). This guide helps you choose a deployment method for UE-V and provides step-by-step instructions for each.

2 UE-V DEPLOYMENT GUIDE INTRODUCTION 1 Introduction People are using more devices, and this trend drives demand for IT departments to provide consistent Windows and app experiences physical or virtual from different locations. Microsoft User Experience Virtualization (UE-V) addresses this need by offering users the ability to change the device and keep their experience. UE-V is a new member of the Microsoft Desktop Virtualization family of products, and it is part of the Microsoft Desktop Optimization Pack (MDOP). UE-V focuses on three key areas: Personal and Flexible. Users get consistent, personal Windows and app experiences that match their unique workstyle. Simple and Versatile. Deployment is easy. IT can provide users personal and flexible experiences across many computers while maintaining just the right level of oversight. Integrated and Scalable. UE-V integrates into your existing infrastructure and management tools to provide a familiar management experience for all size businesses. To learn more about taking advantage of UE-V in your business, see the Windows Enterprise website. This guide describes how to deploy UE-V. It first describes the UE-V components. Then it shows you how to prepare for deployment and provides step-by-step instructions for deploying the UE-V Agent by using the following tools and technologies: Group Policy software installation Microsoft Deployment Toolkit 2012 (MDT) System Center 2012 Configuration Manager Scripted installation (e.g., Command Prompt)

3 UE-V DEPLOYMENT GUIDE UE-V COMPONENTS 2 UE-V Components Figure 1 illustrates a UE-V solution combined with Microsoft Application Virtualization (App-V), Offline Files, and Folder Redirection. App-V, Offline Files, and Folder Redirection are not required for UE-V; but together they provide a more powerful user-state-virtualization solution. Figure 1. UE-V combined with App-V, Offline Files, and Folder Redirection The UE-V components that Figure 1 illustrates are: Settings Storage Location. The settings storage location is where the UE-V Agent stores users experiences. You can use home folders, defined in Active Directory Domain Service (AD DS), as the settings storage location, or you can create a simple file share with permissions that allow the UE-V Agent to create a subfolder for each user. Settings Location Template. Settings location templates are XML files that define the settings that the UE-V agent will synchronize with the settings storage location. UE-V synchronizes only the settings locations that templates define. The concept is similar to administrative templates in Group Policy or migration XML files in the User State Migration Tool. UE-V includes settings location templates for some Microsoft apps and

4 UE-V DEPLOYMENT GUIDE UE-V COMPONENTS 3 Windows settings. You can create custom settings location templates using the UE-V Generator. For example, you can create a custom settings location template for a line of business applications that your business uses. Settings location templates do not contain actual settings or files; they only define the locations of settings and files to roam. Settings Template Catalog. The settings template catalog is a network share that contains custom settings location templates. By default, the UE-V Agent downloads settings location templates from the catalog once a day. The UE-V Agent registers templates that you add to or update in this folder since the last update. The UE-V agent deregisters templates that you remove from this folder. Creating a settings template catalog is only required if you plan to distribute custom settings location templates. UE-V Generator. You use the UE-V Generator to create custom settings location templates. The UE-V Generator monitors an app when you open and close it to discover the registry settings and files that it accesses. It is very easy to use. You can also use the UE-V Generator to edit and validate existing templates. UE-V Agent. You install the UE-V Agent on each computer to synchronize users experiences with the settings storage location. The UE-V Agent synchronizes the Windows experience when users log onto or off of Windows, lock or unlock the screen, or connect to or disconnect from a Remote Desktop session. It synchronizes app experiences when they open or close apps that are defined in the registered settings location templates. Settings Package. A settings package contains a user s experience based on the information in the corresponding settings location template. Offline Files. Offline Files makes shared network files available to users when they are disconnected (e.g., traveling) or using a slow link (e.g., DirectAccess over mobile broadband). Using Offline Files enables UE-V to provide continuous access to users experiences when they disconnect from the network. When the user once again connects to the network, Offline Files will synchronize their experiences with the settings storage location.

5 UE-V DEPLOYMENT GUIDE UE-V COMPONENTS 4 Using Offline Files for virtual desktops is not desirable because they have a consistent network connection and Offline Files will consume hard drive space unnecessarily. You can disable the requirement for using Offline Files. For more information, see the section titled Enabling Offline Files on page 10. Folder Redirection. Folder Redirection changes the location of users folders (e.g., Documents, Pictures, Videos, Favorites, and so on) from the local user profile to a network share. By combining Folder Redirection with UE-V, you can provide consistent access to not only users experiences but also their documents. Microsoft Application Virtualization. App-V transforms applications into centrally managed services that are never installed and avoid conflict with other applications. When users change their device, their virtual applications are available on demand. Like Folder Redirection, combining UE-V with App-V can provide users a consistent experience on each device they use.

6 UE-V DEPLOYMENT GUIDE PREPARING FOR DEPLOYMENT 5 Preparing for Deployment Deploying UE-V is a simple process: You install the UE-V Agent on each computer where you want the agent to synchronize users experiences. However, prior to deploying the agent, you must complete the following steps to prepare for deployment: 1. Create and share a folder for the settings storage location. 2. Prepare Group Policy to manage UE-V Agent configuration. 3. Configure the settings storage location for the UE-V Agent. 4. Ensure that Offline Files is enabled. The following sections provide detailed information about each step. Afterward, you can deploy the UE-V Agent as the section titled Deploying the UE-V Agent on page 12 describes. Creating the Settings Storage Location For the settings storage location, you can use home folders in AD DS to store each user s experiences. If you are using home folders, you can skip the remainder of this section. You do not need to create and share a folder for the settings storage location because UE-V will store settings packages in each user s home folder. Otherwise, you can create and share a folder to use as the settings storage location. Microsoft recommends that you create a security group in AD DS to manage access to the UE-V settings storage location. By doing so, you can centrally manage access to the settings storage location. This deployment guide assumes that you create a group named UE-V Users in AD DS. The settings storage location can contain users confidential information. To protect it, ensure that the NTFS and share permissions are configured as this section describes. The NTFS and share permissions in this section allow the UE-V Agent to create settings storage locations for users at the root of the network share, giving users full control of their own settings storage locations while preventing access to them by other users.

7 UE-V DEPLOYMENT GUIDE PREPARING FOR DEPLOYMENT 6 To create and share the UE-V settings storage location 1. On SERVER, create SettingsStore. SERVER is the name of the server computer where you want to create the UE-V settings storage location, and SettingsStore is the name of the folder containing the store. 2. Configure the NTFS permissions for SettingsStore as Table 1 describes. Ensure that you remove any user accounts not listed in Table 1. The administrator account or group supporting UE-V must also have access to this folder. To configure NTFS permissions, right-click the folder, click Properties, and then click Advanced on the Security tab. Table 1 NTFS Permissions for the Settings Storage Location Account Permissions Applies to Administrators Full control This folder, subfolders, and files Creator Owner Full control Subfolders and files only UE-V Users List folder/read data Create folders/append data This folder only

8 UE-V DEPLOYMENT GUIDE PREPARING FOR DEPLOYMENT 7 3. Share SettingsStore with the permissions that Table 2 describes. Ensure that you remove from the permissions list any user accounts not listed in Table 2. The administrator account or group supporting UE-V must also have access to this share. To configure the share, right-click the folder, click Properties, and then click the Sharing tab. Table 2 Share Permissions for the Settings Storage Location Account Permissions Administrators Full control UE-V Users Full control 4. When SERVER is running a Windows Server operating system, you can optionally configure the UE-V Agent to automatically verify that the built-in Administrators group or the user account is the owner of the user s settings storage location. Enable this feature by setting the REG_DWORD value RepositoryOwnerCheckEnabled to 1 in the registry key HKLM\Software\Microsoft\UEV\Agent\Configuration. Installing the Administrative Templates You can manage the UE-V Agent configuration by using Group Policy. Doing so provides a central location for configuring the agent and allows you to easily configure unique settings for different groups. In preparation, download the Group Policy administrative template from the Microsoft Download Center at Install the template on any computer from which you will configure the UE-V Agent by using Group Policy, including domain controllers and administrator PCs running the Remote Server Administration Tools. Optionally, install the template in the central store for ADMX files to make them available to all administrators editing Group Policy.

9 UE-V DEPLOYMENT GUIDE PREPARING FOR DEPLOYMENT 8 For more information about configuring a central store for ADMX files, see the article Scenario 2: Editing Domain-Based GPOs Using ADMX Files. Even though this guidance was written for Windows Server 2008, it still applies to Windows Server 2008 R2 and Windows Server To install the Group Policy administrative template locally 1. Copy the ADMX file to %SystemRoot%\PolicyDefinitions on the local computer. 2. Copy the ADML file to %SystemRoot%\PolicyDefinitions\en-US on the local computer. To install the Group Policy administrative template in the central store for ADMX files 1. Copy the AMDX file to %SystemRoot%\SYSVOL\domain\Policies\PolicyDefinitions on a domain controller. Create the PolicyDefinitions folder if it does not already exist. 2. Copy the ADML file to %SystemRoot%\SYSVOL\domain\Policies\PolicyDefinitions\en-US on a domain controller. Create the en-us folder if it does not already exist. The UE-V Group Policy administrative templates are supported only on Windows Server 2012 and Windows Server 2008 R2 operating systems. Configuring the Settings Storage Path After you create and share the UE-V settings storage location, you need to configure the UE-V Agent to use it. Table 3 describes each method for configuring the settings storage path in the UE-V Agent and helps you choose the best method for your environment. The following sections describe each option in more detail.

10 UE-V DEPLOYMENT GUIDE PREPARING FOR DEPLOYMENT 9 Table 3 Configuring the Settings Storage Location Method Use This Method When Group Policy Home folders are not configured for user accounts. You will manage the UE-V Agent by using Group Policy. You want to store users settings packages in locations other than their home folders. Home Folders Home folders are already configured for user accounts. You want to store users settings packages in the same locations as their home folders. Agent Installation Home folders are not already configured for user accounts. You want to store users settings packages in locations other than their home folders. You are not planning to manage the UE-V configuration by using Group Policy. Using Group Policy The UE-V Group Policy administrative template defines a policy setting for configuring the settings storage path: Settings storage path. Enable the policy, and set the path to \\SERVER\SettingsStore\%USERNAME%. The UE-V Agent will then create a settings storage location based on the user s name in the network share. For more information about configuring the UE-V Agent by using Group Policy, see the section titled Managing the UE-V Agent on page 38. Using Home Folders You can use home folders in AD DS as the settings storage location. After you assign home folders to user accounts, the UE-V Agent automatically detects and uses the home folder as the

11 UE-V DEPLOYMENT GUIDE PREPARING FOR DEPLOYMENT 10 settings storage location. Other than setting a home folder for each user account in AD DS, no other configuration steps are required. During Agent Installation The UE-V Agent installer provides numerous command-line options for configuring the agent during installation. To configure the settings storage path during agent installation, use the SettingsStoragePath command-line option. You can install the UE-V Agent by running the AgentSetup.exe, AgentSetupx64.msi, or AgentSetupx86.msi files. Depending on how you run the setup program, you need to specify environment variables differently. Table 19 in Appendix C: Environment Variables on page 59 describes how to specify environment variables on the command line for each installation method. Enabling Offline Files By default, the UE-V Agent requires that you enable the Offline Files feature (see the section titled UE-V Components on page 2). Offline Files help ensure that users have continuous access to their settings packages even when they disconnect from the network. Offline Files is enabled by default in Windows 7 and disabled by default in Windows 8 and Windows Server. You can enable Offline Files by using the methods that Table 4 describes. Table 4 Enabling Offline Files Method Description Allow or Disallow use of the Offline Files feature Group Policy setting Enable this policy to turn on Offline Files for all computers within the Group Policy Object s (GPO s) scope. This policy setting is in Offline Files under Computer Configuration\Policies\Administrative Templates\Network. Use this method when you use Group Policy to perform ongoing management of UE-V. It is the easiest way to enable Offline Files on all computers running the UE-V Agent.

12 UE-V DEPLOYMENT GUIDE PREPARING FOR DEPLOYMENT 11 Method Description Service Controller (sc.exe) command Use the sc.exe tool to enable Offline Files from a command line. To enable the Offline Files feature using the sc.exe command, run the following from an elevated command prompt: sc config CscService start=auto Use this method when you are not using Group Policy to configure the UE-V Agent and you want to enable the Offline Files feature using MDT or Configuration Manager. In Virtual Desktop Infrastructure (VDI) environments or on computers that have consistent connections to the corporate network, you can disable the requirement for using Offline Files. Enable the Do Not Use Offline Files Group Policy setting, which the UE-V Group Policy administrative template defines, and add SyncMethod=None to the UE-V Agent installation command line.

13 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 12 Deploying the UE-V Agent You must install the UE-V Agent on each computer where you want to synchronize user experience. The agent installation files include the following: AgentSetup.exe. This setup program automatically detects the operating system type and installs the correct 32-bit or 64-bit Windows Installer package file. It will pass any installer properties you use on its command line to the Windows Installer package file. AgentSetupx64.msi. This Windows Installer package file contains the 64-bit version of the UE-V Agent. You can install this package by using Msiexec.exe (bypassing AgentSetup.exe) and you can specify installation properties on the command line. AgentSetupx86.msi. This Windows Installer package file contains the 32-bit version of the UE-V Agent. You can install this package by using Msiexec.exe (bypassing AgentSetup.exe) and you can specify installation properties on the command line. You can easily deploy the UE-V Agent by using almost any software or operating-system deployment tool. Table 5 lists the deployment methods that this guide describes, and it offers suggestions for when to use each method. You can also use a combination of these methods. For example, you could use MDT to deploy the UE-V Agent during operating system deployment and use Group Policy to deploy the UE-V Agent to existing computers. To drive consistency across UE-V Agent installations, use highly automated techniques to perform UE-V Agent deployments. For example, if you choose command-line deployment, ensure that you automate installation by using scripts (e.g., Windows PowerShell or batch scripts).

14 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 13 Table 5 Choosing a Deployment Method Method Use This Method When Group Policy You already deploy software by using Group Policy. You want to deploy the UE-V Agent to existing computers. You want to deploy the UE-V Agent after operating system images are deployed. You are configuring the UE-V Agent by using Group Policy and not by using command-line options. Computers have high-speed, persistent connections to the network share containing the installation files. Microsoft Deployment Toolkit 2012 You use MDT for operating system deployment. You want to deploy the UE-V Agent as part of the operating system deployment. System Center 2012 Configuration Manager You already use Configuration Manager for application and operating system deployment. You want to use one deployment tool to deploy the UE- V Agent to existing computers and during operating system deployment. Computers have high-speed, persistent connections to the distribution points where the UE-V Agent installation files are located.

15 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 14 Method Use This Method When Scripted Installation You want to script installation as part of operating system installation and you are not using MDT or Configuration Manager. You want to deploy the UE-V Agent by using a thirdparty electronic software distribution (ESD) system. Computers might not have high-speed, persistent connections to the enterprise network and installation from local media might be required. Group Policy Software Installation You can install AgentSetupx86.msi or AgentSetupx64.msi by using Group Policy software installation. (You cannot run AgentSetup.exe by using Group Policy.) You will create a network share for the UE-V Agent installation files and then create a GPO that installs the appropriate Windows Installer package file on each computer. To target UE-V Agent installation, you can link the GPO to specific Organizational Units (OUs), use security filtering, or use Windows Management Instrumentation (WMI) filtering. For example, you can filter the GPO to target computers in a particular security group or computers that are running Windows 7 or Windows 8.

16 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 15 The following sections describe the steps to complete these tasks: 1. Create and share a folder containing the UE-V Agent installation files. 2. Create and edit a GPO to install the UE-V Agent. 3. Configure the GPO to target computers by using security and WMI filtering. 4. Link the GPO to the appropriate organizational units. You cannot use command-line options when you deploy the UE-V Agent by using Group Policy. In this scenario, the easiest way to configure the UE-V Agent is by using the UE-V Group Policy administrative template. Alternatively, you can create a transform for the UE-V Windows Installer package files, and apply that transform when you create the GPO. Share the Installation Files You need to create a network share that contains the UE-V Agent setup files. This network share must be accessible to all computers on which you want to install the UE-V Agent. You can give read access to the Domain Computers group or to the Authenticated Users group. To create and share a folder for the UE-V Agent installation files 1. On SERVER, create UE-V Setup. SERVER is the name of the file server and UE-V Setup is the name of the folder you are creating to contain the UE-V Agent installation files. 2. Configure NTFS permissions for the folder UE-V Setup as Table 6 describes. To configure NTFS permissions, right-click the folder, click Properties, and then click Advanced on the Security tab.

17 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 16 Table 6 NTFS Permissions for the UE-V Setup Folder Account Permissions Applies to Administrators Full control This folder, subfolders, and files Authenticated Users Read and execute This folder, subfolders, and files 3. Share the folder UE-V Setup by using the permissions that Table 7 describes. To configure share permissions, right-click the folder, click Properties, and then click the Sharing tab. Table 7 Share Permissions for the UE-V Setup Folder Account Permissions Authenticated Users Read 4. Copy the files AgentSetupx64.msi and AgentSetupx86.msi from the MDOP distribution media to \\SERVER\UE-V Setup. Create a GPO to Install the Agent You create GPOs by using the Group Policy Management Console (GPMC) on a server or on a client running the Remote Server Administration Tools. You can create a GPO that only installs the UE-V Agent. Alternatively, you can configure the UE-V Agent by using the same GPO to keep all of your UE-V policies in one location. The steps in this section install both the x64 and x86 agent by using a single GPO, allowing Group Policy to determine the correct version to install. To create and edit a GPO to deploy the x64 and x86 UE-V Agent 1. In the GPMC, create a new GPO for UE-V Agent installation (e.g., UE-V Agent Installation): a. Right-click Group Policy Objects and click New. Group Policy Objects is under Forest\Domains\Domain.

18 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 17 b. In the Name box, type UE-V Agent Installation, and click OK. 2. In the details pane, right-click UE-V Agent Installation, then click Edit. 3. In the Group Policy Management Editor, right-click Software Installation, click New, and click Package. Software Installation is in Computer Configuration\Policies\Software Settings. 4. In File name, type the Universal Naming Convention (UNC) path and name of AgentSetupx64.msi, and click Open. Make sure you open the file from the network share you created earlier and not a local path. 5. In the Deploy Software dialog box, click Advanced, and click OK. 6. In the Name box on the General tab of the Microsoft User Experience Virtualization Agent dialog box, append x64 to the end of the name, and click OK. This will help you to later distinguish between the x86 and x64 versions. 7. In the Group Policy Management Editor, right-click Software Installation, click New, and click Package. Software Installation is in Computer Configuration\Policies\Software Settings. 8. In File name, type the UNC path and name of AgentSetupx32.msi, and click Open. Make sure you open the file from the network share you created earlier and not a local path. 9. In the Deploy Software dialog box, click Advanced, and click OK. 10. On the Microsoft User Experience Virtualization Agent dialog box, complete the following steps and click OK: a. On the General tab, in the Name box, append x86 to the end of the name. b. On the Deployment tab, click Advanced; then, clear the Make this 32-bit X86 application available to Win64 machines check box and click OK. Clearing this check box prevents Group Policy from installing the 32-bit UE-V Agent on 64-bit operating systems, ensuring that the correct version of the UE-V Agent is installed for each system type. 11. Close the Group Policy Management Editor.

19 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 18 Optionally Target the GPO When you link the UE-V Agent Installation GPO to an organizational unit (OU), Group Policy will apply it to all computers in that OU, installing the UE-V Agent on them. In some cases, this might not be desirable. You can target the deployment of the UE-V Agent to specific computers within an OU by using security or WMI filtering. See Table 8 for more information. Table 8 Filtering the UE-V Agent Installation GPO Method Description Security Filtering This filtering method allows you to target specific computers based on membership in AD DS security groups. The members of the security group can be computer objects or other security groups containing computer objects. You control the deployment of the UE-V Agent to specific computers by adding or removing them from the security group. For more information about security filtering, see Filter Using Security Groups. WMI Filtering This filtering method allows you to target specific computers based on a WMI query. For example, you could use a WMI query to target the operating system version on computers, and deploy the UE-V Agent only if the operating system is Windows 7 or Windows 8. You create a WMI filter separately and then link the WMI filter to the GPO that you created to deploy the UE-V Agent. For more information about WMI filtering and how to create a WMI filter, see Work with WMI Filters. Link the GPO to Organizational Units You must link the UE-V Agent Installation GPO to OUs to install the agent on the computers in those OUs. You can link the GPO to individual OUs. If the computers you want to target for installation are in multiple OUs, you can link the GPO to the domain and use security or WMI filtering to limit installation to specific computers, types of computers, or Windows versions. To link the GPO to an organizational unit 1. In the GPMC, right-click the OU to which you want to link the UE-V Agent Installation GPO, and click Link an Existing GPO.

20 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT In Group Policy objects list on the Select GPO dialog box, click UE-V Agent Installation, and click OK. Microsoft Deployment Toolkit 2012 By using MDT, you can deploy the UE-V Agent during operating-system deployment. You do this as part of the Lite Touch Installation (LTI) process by adding the agent installation files as an application and then adding an Install Application step for the agent to your existing operatingsystem deployment task sequences. By installing the UE-V Agent as part of the operating-system deployment task sequence, MDT installs the agent automatically, requiring no input from the user. The agent will be ready for use before end users log onto the computer for the first time. The following sections describe the steps necessary to complete each of these tasks in the Deployment Workbench: 1. Add the UE-V Agent to the Applications node of your deployment share. 2. Configure the UE-V Agent application to hide it from the user and restart the computer. 3. Add an Install Application step to your existing operating-system task sequences. For more information about using MDT to install applications during operating-system deployment, see the MDT documentation. Add the Application When you add an application to your MDT deployment share, you must specify the command that installs it. Running AgentSetup.exe is the simplest way to start UE-V Agent installation with MDT. It will automatically choose the x64 or x86 Windows Installer package file based on the target computer s system type.

21 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 20 The command you specify for UE-V Agent installation must include the following command-line options (see the section titled Appendix A: Command-Line Options on page 54 for more information): /quiet. This command-line option runs AgentSetup.exe with no user interaction. Without using this command-line option, the setup program will stall the deployment process to wait for user interaction. /norestart. By default, AgentSetup.exe restarts the computer after installation. You must prevent the setup program from restarting the computer, allowing the task sequence to maintain control of computer restarts. You can force the task sequence to restart the computer after UE-V Agent installation by enabling the Reboot the computer after installing this application check box on the Details tab of the application s properties. If you are not using Group Policy to configure the UE-V Agent, you can configure the agent by using the Windows Installer properties that the section titled Appendix B: Windows Installer Properties on page 55 describes. Simply add the properties you want to configure to the installation command when you add the application to your deployment share. With MDT, you must escape the percent signs (%) in any environment variables that you use in the SettingsStoragePath property, as the section titled Appendix C: Environment Variables on page 59 describes. In particular, you must delay expansion of environment variables such as %USERNAME% by using the format ^%USERNAME^%. To add the UE-V Agent to your deployment share 1. In the Deployment Workbench, click Applications. It is under Deployment Workbench\Deployment Shares\Deployment Share, in which Deployment Share is the name of your deployment share. 2. In the Actions pane, click New Application.

22 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT Complete each page of the New Application Wizard: Page Steps Application Type 1. Click Application with source files. 2. Click Next. You could click the Application without source files or elsewhere on the network check box if you already have the installation files on a network share. For more information, see the section titled "Create a New Application That Is Deployed from Another Network Share" in the MDT documentation. Details 1. In the Application Name box, type UE-V Agent. 2. Click Next. The remaining text boxes on this page are optional and informational only. While they do not affect the deployment of the UE-V Agent, completing the remaining text boxes can prove useful later when you are maintaining the deployment share. Source 1. In the Source directory box, type the path of the folder containing the UE-V Agent installation files. The Source directory box supports autocomplete, but you can click Browse to locate the files. 2. Click Next.

23 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 22 Page Steps Destination 1. In the Specify the name of the directory that should be created box, optionally edit the name of the folder that the New Application Wizard will create in the deployment share. The wizard suggests a name based on the publisher, name, and version that you provided on the Details page. 2. Click Next. Command Details 1. In the Command line box, type the command you want to run to install the UE-V Agent. For example, type: AgentSetup.exe /quiet /norestart SettingsStoragePath= \\SERVER\SettingsStore\^%USERNAME^% 2. Click Next. At a minimum, you must add the /quiet and /norestart commandline options to the command. These options run AgentSetup.exe with no user interaction and prevent the program from restarting the computer. For information about Windows Installer properties that you can use to configure the UE-V Agent during installation, see the section titled Appendix B: Windows Installer Properties on page 55. Summary 1. In the Details area, review the information collected by the Add New Application wizard. 2. Click Next. Progress 1. Monitor the wizard s progress as it adds the application to your deployment share. Confirmation 1. Review the results, and click Finish.

24 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 23 Configure the Application After adding the application to your MDT deployment share, you will want to configure it to: Hide the application from users so they cannot prevent installation during deployment. Trigger the task sequence to restart the computer after installing the UE-V Agent. The task sequence will continue running after the computer restarts. To customize the UE-V Agent in your deployment share 1. In the Applications node of the deployment share, right-click the UE-V Agent application that you previously added, and click Properties. 2. On the General tab of the Application Properties dialog box, select the Hide this application in the Deployment Wizard check box. 3. On the Details tab of the Application Properties dialog box, select the Reboot the computer after installing this application check box. 4. Click OK. Edit Task Sequences One of the best ways to install agent applications during operating-system deployment is by adding them to task sequences. By adding the UE-V Agent to your existing task sequences, you can install the agent automatically with no interaction from the user. This helps to ensure that the UE-V Agent is available immediately, before end users log onto the computer. To install the UE-V Agent in an LTI task sequence 1. In the Deployment Workbench, click Task Sequences. It is under Deployment Workbench\Deployment Shares\Deployment Share, in which Deployment Share is the name of your deployment share. 2. In the Details pane, right-click the task sequence to which you want to add the UE-V Agent, and click Properties. 3. On the Task Sequence tab of the Task Sequence Properties dialog box, click the Install Applications task sequence step. This step is in the State Restore group. The task sequence editor will add the new task sequence step immediately after this step. 4. On the Add menu, click General, and click Install Application.

25 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT Click the new Install Application task sequence step that you just added, do the following: a. In the Name box, type Install the UE-V Agent. b. Click Install a single application, click Browse, click the UE-V Agent application in the Select An Item dialog box, and then click OK. c. Optionally, on the Options tab, select the Continue on error check box. Select this check only if you want the task sequence to continue running if the UE-V Agent fails to install during operating-system deployment. 6. Click OK to close the Task Sequence Properties dialog box. System Center 2012 Configuration Manager You can deploy the UE-V Agent by using the application model in Configuration Manager. You create applications in the Applications node of the Configuration Manager Console. By using Configuration Manager, you can use a single deployment tool to install the UE-V Agent on existing computer as well as during operating-system deployment: Deployment to existing computers. This method deploys the UE-V Agent to targeted computers that already exist or deploys the UE-V Agent immediately after operatingsystem deployment completes. The advantage of this method is that it covers both scenarios (existing computers and new computers). Installation during operating-system deployment. This method installs the UE-V Agent during operating-system deployment so that the agent is immediately available. The process is similar to the process that the section titled Microsoft Deployment Toolkit 2012 on page 19 describes. After you create the application in the Configuration Manager Console, you simply add an Install Application step to the operating-system deployment task sequence. The following sections describe the steps necessary to complete each of these tasks in the Configuration Manager Console: 1. Create and share a content folder for the UE-V Agent installation files. 2. Create a Configuration Manager application for the UE-V Agent installation.

26 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT Distribute the Configuration Manager application to the distribution points. 4. Deploy the Configuration Manager application to the targeted computers. 5. Add an Install Application step to existing operating-system deployment task sequences. For more information about using Configuration Manager to deploy applications, see the article System Center Technical Resources on TechNet. Share the Installation Content When you create a Configuration Manager application, you need to specify a source for the application content. The source must be a network share that is accessible to Configuration Manager, as it uses the contents of the source folder to create the application. To create and share a folder for the UE-V Agent installation content 1. On SERVER, create UE-V Setup. SERVER is the name of the file server and UE-V Setup is the name of the folder you are creating to contain the UE-V Agent installation files. 2. Configure NTFS permissions for the folder UE-V Setup as Table 9 describes. To configure NTFS permissions, right-click the folder, click Properties, and then click Advanced on the Security tab. Table 9 NTFS Permissions for the UE-V Setup Folder Account Permissions Applies to Administrators Full control This folder, subfolders, and files Site Server Account Read and execute This folder, subfolders, and files

27 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT Share the folder UE-V Setup by using the permissions that Table 10 describes. To configure share permissions, right-click the folder, click Properties, and then click the Sharing tab. Table 10 Share Permissions for the UE-V Setup Folder Account Permissions Administrators Full control Site Server Account Full control 4. Copy the files AgentSetupx64.msi and AgentSetupx86.msi from the MDOP distribution media to \\SERVER\UE-V Setup. Create the UE-V Agent Application When you create a Configuration Manager application, you must specify the command that installs it. While you could run AgentSetup.exe to install the UE-V Agent, Microsoft recommends that you instead install AgentSetupx64.msi or AgentSetupx86. Creating applications in Configuration Manager based on MSI files: Allows Configuration Manager to detect if the application is installed already. Uses a well-known Configuration Manager deployment type. Simplifies the ongoing management of the UE-V Agent by simplifying updates. If you are not using Group Policy to configure the UE-V Agent, you can configure the agent by using the Windows Installer properties that the section titled Appendix B: Windows Installer Properties on page 55 describes. Simply add the properties you want to configure to the installation command when you edit the deployment type in Configuration Manager.

28 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 27 When deploying the UE-V Agent by using Configuration Manager, you must escape the percent signs (%) in any environment variables that you use in the SettingsStoragePath property, as the section titled Appendix C: Environment Variables on page 59 describes. In particular, you must delay expansion of environment variables such as %USERNAME% by using the format ^%USERNAME^%. To create the UE-V Agent application in Configuration Manager 1. In the Configuration Manager Console, click the Software Library workspace. 2. In the Software Library workspace, click Applications. Applications is in Overview\Application Management. 3. In the Create group on the ribbon, click Create Application. 4. Complete each page of the Create Application Wizard: Page Steps General 1. Click Manually specify the application information. 2. Click Next.

29 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 28 Page Steps General: General Information 1. In the Name box, type UE-V Agent. 2. Select the Allow this application to be installed from the Install Application task sequence action without being deployed check box. Selecting this check box allows you to use task sequence variables to install the UE-V Agent. 3. Click Next. The remaining text boxes on this page are optional and informational. While they do not affect the deployment of the UE-V Agent, completing the remaining text boxes can prove useful later when you are maintaining the deployment share. General: Application Catalog 1. Click Next. The text boxes on this page are optional. They prompt for information that you want to display in the application catalog. However, this deployment guide recommends that you hide the UE-V from the application catalog. General: Deployment Types 1. Click Add to add a deployment type for the x64 version of the UE-V Agent (AgentSetupx64.msi). 2. On the General page of the Create Deployment Type Wizard, click Browse, open AgentSetupx64.msi from the location in which you shared the installation sources (e.g., \\SERVER\UE-V Setup), and click Next. 3. On the Import Information page of the Create Deployment Type Wizard, click Next. 4. On the General Information page of the Create Deployment Type Wizard, do the following: a. In the Name box, append x64 to the end of the

30 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 29 Page Steps name for easier identification later. b. In the Installation program box, add /norestart to the end of the command. c. Click Next. At a minimum, you must use the /quiet and /norestart command-line options. These options run Msiexec.exe with no user interaction and prevent it from restarting the computer. For information about Windows Installer properties that you can use to configure the UE-V Agent during installation, see the section titled Appendix B: Windows Installer Properties on page On the Requirements page of the Create Deployment Type Wizard, do the following: a. Click Add. b. Click Operating system in the Condition list. c. In the operating-system list, select All Windows 7 (64-bit) and All Windows 8 (64-bit). (Select the 64- bit operating systems that you want to support.) d. Click OK. e. Click Next. 6. On the Dependencies page of the Create Deployment Type Wizard, click Next. 7. On the Summary page of the Create Deployment Type Wizard, review the deployment-type details, and click Next. 8. On the Completion page of the Create Deployment Type Wizard, click Close. 9. Repeat steps 1 through 8 on this page for the x86 version of the UE-V Agent (AgentSetupx86.msi), and then click Next.

31 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 30 Page Steps Summary 1. In the Details area, review the information that the Create Application Wizard collected, and click Next. Progress 1. Monitor the progress of the Create Application Wizard while it creates the application. Completion 1. Verify that the Create Application Wizard completed successfully, and click Close. Distribute the UE-V Agent Application After creating the UE-V Agent application in Configuration Manager, you must distribute the application content to your distribution points. Targeted computers will install the UE-V Agent from them. You use the Distribute Content Wizard in the Configuration Manager Console to distribute the UE-V Agent application. To distribute the UE-V Agent Configuration Manager application 1. In the Details pane, click UE-V Agent. 2. In the Deployment group on the ribbon, click Distribute Content. 3. Complete each page of the Distribute Content Wizard: Page Steps General 1. Click Next. General: Content 1. Click Next.

32 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 31 Page Steps General: Content Destination 1. Click Add, and click Distribution Point. 2. In the Add Distribution Points dialog box, select the distribution points to which you want to distribute the UE-V Agent installation content, and click OK. 3. Click Next. Summary 1. In the Details area, review the information that the Distribute Content Wizard collected, and click Next. Progress 1. Monitor the progress of the Distribute Content Wizard while it distributes the UE-V Agent installation content. Completion 1. Verify that the Distribute Content Wizard completed successfully, and click Close. After completing the Distribute Content Wizard, you must verify successful distribution of the installation content before continuing to deploy the UE-V Agent application. To do that, click Refresh in the Application area of the ribbon. Click UE-V Agent in the Details pane, and you see the distribution status on the Summary tab at the bottom. Once the content status shows that content distribution is successful, you can deploy the UE-V Agent application. Deploy the UE-V Agent Application You can deploy the UE-V Agent application to users or devices. Because the agent is a computer-centric agent, Microsoft recommends that you deploy it to computer collections not user collections. You use the Deploy Software Wizard in the Configuration Manager Console to deploy the UE-V Agent application after you have successfully distributed it. To deploy the UE-V Agent Configuration Manager application 1. In the Details pane, click UE-V Agent.

33 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT In the Deployment group on the ribbon, click Deploy. 3. Complete each page of the Deploy Software Wizard: Page Steps General 1. Click Browse next to the Collection box. 2. In the Select Collection dialog box, click Device Collections on the left side; on the right side, click a device collection to which you want to deploy the UE-V Agent; and click OK. 3. Click Next. You can choose one of the built-in collections or your own collection. For more information about creating collections in Configuration Manager, see the article How to Create Collections in Configuration Manager on TechNet. Content 1. Click Next. Deployment Settings 1. In the Purpose list, click Required. 2. Click Next. Selecting Required in the Purpose list forces installation of the UE-V Agent application on targeted computers. Configuration Manager will also reinstall the agent if users remove it. Scheduling 1. Click Next.

34 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 33 Page Steps User Experience 1. In the User notifications list, click Hide in Software Center and all notifications. 2. Click Next. Selecting Hide in Software Center and all notifications prevents Configuration Manager from notifying users about the installation of the UE-V Agent. This recommended setting prevents any user interaction or interference with deployment. Alerts 1. Click Next. Summary 1. In the Details area, review the information that the Deploy Software Wizard collected, and click Next. Progress 1. Monitor the progress of the Deploy Software Wizard while it deploys the UE-V Agent application. Completion 1. Verify that the Deploy Software Wizard completed successfully, and click Close. Edit Existing Task Sequences As the section Microsoft Deployment Toolkit 2012 on page 19 described, one of the best and simplest ways to install agent applications during operating-system deployment is by adding them to existing task sequences. By adding the UE-V Agent to your existing task sequences, you can install the agent automatically with no interaction or interference from the user. This helps to ensure that the UE-V Agent is available immediately, before end users log onto the computer. To install the UE-V Agent in a Configuration Manager sequence 1. In the Configuration Manager Console, click the Software Library workspace.

35 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT In the Software Library workspace, click Task Sequences. Task Sequences is in Overview\Operating Systems. 3. In the Details pane, right-click the task sequence to which you want to add the UE-V Agent, and click Edit. 4. Click the Install Applications group, which is under the State Restore group. The task sequence editor will add the new step in this group. 5. On the Add menu, click General, and click Install Application. 6. Click the new Install Application task sequence step that you just added, do the following: a. In the Name box, type Install the UE-V Agent. b. Click New (i.e., the button that looks like a star), click the UE-V Agent application in the Select The Application To Install dialog box, and then click OK. c. Optionally, on the Options tab, select the Continue on error check box. Select this check only if you want the task sequence to continue running if the UE-V Agent fails to install during operating-system deployment. 7. Click OK to close the Task Sequence Editor dialog box. Scripted Installation If you do not use MDT or Configuration Manager to deploy applications in your environment, and you do not want to use Group Policy software installation, you can script installation by using batch scripts, Windows PowerShell scripts, and so on. With this technique, you are essentially performing a command-line installation. You can use the same technique to install the UE-V Agent by using any third-party Electronic Software Distribution (ESD) system. The following sections describe the steps necessary to complete each of these tasks: 1. Create and share a folder containing the UE-V Agent installation files. 2. Run AgentSetup.exe from the network share containing the installation files.

36 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT 35 Share the Installation Files Create a network share that contains the UE-V Agent installation files. This network share must be accessible to all computers on which you want to install the UE-V Agent. If users will run the setup program in their own security context, give the UE-V Users group permissions to the folder. The section Creating the Settings Storage Location on page 5 described the UE-V Users group. Otherwise, configure the share s NTFS and share permissions to permit access by the accounts that will actually install the UE-V Agent. To create and share a folder for the UE-V Agent installation files 1. On SERVER, create UE-V Setup. SERVER is the name of the file server and UE-V Setup is the name of the folder you are creating to contain the UE-V Agent installation files. 2. Configure NTFS permissions for the folder UE-V Setup as Table 11 describes. To configure NTFS permissions, right-click the folder, click Properties, and then click Advanced on the Security tab. Table 11 NTFS Permissions for the UE-V Setup Folder Account Permissions Applies to Administrators Full control This folder, subfolders, and files UE-V Users Read and execute This folder, subfolders, and files 3. Share the folder UE-V Setup by using the permissions that Table 12 describes. To configure share permissions, right-click the folder, click Properties, and then click the Sharing tab. Table 12 Share Permissions for the UE-V Setup Folder Account Permissions UE-V Users Read

37 UE-V DEPLOYMENT GUIDE DEPLOYING THE UE-V AGENT Copy the UE-V installation files (i.e., AgentSetup.exe, AgentSetupx64.msi, AgentSetupx86.msi, etc.) from the MDOP distribution media to \\SERVER\UE-V Setup. Running AgentSetup.exe For a scripted installation, the command you use to install the UE-V Agent must include the following command-line options (see the section titled Appendix A: Command-Line Options on page 54 for more information): /quiet. This command-line option runs AgentSetup.exe with no user interaction. Without using this command-line option, the setup program will stall the deployment process to wait for user interaction. /norestart. By default, AgentSetup.exe restarts the computer after installation. You must prevent the setup program from restarting the computer, allowing the script to maintain Installing the UE-V Agent Remotely You must install the UE-V Agent from an elevated Command Prompt. Therefore, users with restricted accounts cannot run scripts that install the UE-V Agent. A variety of tools and techniques are available to work around this limitation. Examples include: Use PowerShell Remoting to run the UE-V Agent setup program on a list of remote computers. For more information about PowerShell Remoting, see the article Running Remote Commands on TechNet. Use the Sysinternals PsExec tool to run processes remotely with specific credentials. For more information about PsExec, and the other amazing tools in the Sysinternals toolset, see the article PsTools on TechNet. Use Group Policy preferences to schedule a job in Task Scheduler that runs the UE-V Agent on targeted computers with credentials that you specify in the task. For more information about scheduling tasks by using Group Policy preferences, see the article Configure a Scheduled Task Item on TechNet. Additionally, a variety of third-party tools are available to script the installation of programs that require elevated permissions. Many of them are free or have a nominal cost.