Nik,
No problem.
Okay - the big picture is that we need to put the Service Pack on a
networked Server, create the package and deploy it to the necessary
computers. That sounds easy enough, right?
Well, let's look at the details for doing this.
I do not know in what format you have the Service Pack - whether it is the
single file .exe or the CD-ROM. if you have the single file executable you
will need to extract it. That should be easy enough. WinZip will do it for
you. You could also use some switches from the command prompt to do this.
I would suggest that you create a shared folder first, though. For things
like this I like to hide the shares so that when people are browsing the
network these types of folders are not directly visible. So, share it as
W2KSP4$. The "$" makes it a hidden share. You will need to include the "$"
later when you are telling AD the path to update.msi.......I like to give
either Domain Admins or Administrators Full Control on both the Share and
NTFS permissions and - in this particular case - Domain Computers Read on
the Share permissions and then Read and Execute, List Folder Content and
Read on the NTFS permissions.
You would then copy the directory structure into this shared folder.
This is the end of Part 1.
Now, you need to create an Organizational Unit ( OU ) and move the computer
account objects that need to have SP4 installed into this OU. Please keep
in mind that it is a really bad idea to move a computer account object into
an OU to which a GPO that installs software is linked, let the software be
installed and then move the computer account object out of that OU ( like
back to the default COMPUTERS container ). So, one the computer account
objects are in an OU they should generally stay there. Generally.
This is the end of Part 2.
Now, we need to create the Group Policy Object and link it to the OU in
which the computer account objects directly reside. Sidenote: please do
not be fooled by the name. Groups really have very little to do with Group
Policy Objects. You can not place a group inside this OU that you have
created and create and link the GPO to this OU and think that because the
computers are members of this group that the GPO will apply. It will not.
This is a common mistake that a lot of people make. The computer account
objects must directly reside inside the OU.....Period!
So, right click the OU, select Properties and go to the Group Policy tab.
Simply click on the New... button. Sidenote: Why is there and Add...
button? Because you can use this button to link an existing GPO to this OU.
So, forget about SP4 for a moment. Say that you have created a GPO and
linked it to the OU in which the Marketing user account objects reside. Say
that the Finance people see what happens when the Marketing people log on
and want/need this to happen for them. Instead of having to recreate this
GP you simply use the existing one and link it to the OU in which the
Finance user account objects reside. You see, it is an object ( thus the
GPO - for Group Policy Object ) and can be linked to many different levels
if necessary. Now, back to SP4. You need to give this a 'friendly name'.
I would call it something original - like WIN2000 SP4 or whatever. Now, you
have actually created the Group Policy. Granted, it is pretty much blank.
But the Group Policy object has been created and linked. You have given it
the 'Friendly name', you have Group Policy Container, or GPC, in the Domain
partition for this policy and you have created the Group Policy Template, or
GPT, in the SYSVOL folder. This is all happening, by default, on the Domain
Controller in this domain that holds the FSMO role of PDC Emulator. So, how
do you change this ( remember, it is pretty much blank at the moment )?
Well, you click on the Edit... button. You would open up the Computer
Configuration and click on Software Installations and then right click on
Software Settings and select NEW. And sorry if the terms are a bit off. I
am going from memory. You now need to tell AD where the .msi file is. So,
you enter the following:
\\servername\W2KSP4$\update\update.msi. You then need to tell it to Assign
this package ( and ***NOT**** publish ).
You are pretty much finished.
Give it a moment and then go to the computers in question and reboot them.
SP4 should be installed upon booting up. It will take a bit of time.
What if things do not work? Make sure that the clients are pointing ONLY to
your internal DNS Servers ( and not to the DNS Servers of your ISP ). That
is the first thing. You can also use GPOTool and GPResults. I would even
navigate to the update.msi file and manually double click it to see if it
runs. Sometimes things do not extract so well. But I would do the other
things first.
HTH,
Cary
. However, I really have never