The client software is easily deployed via Active Directory and Group Policy, but there’s a problem where the Outlook integration installer requires elevation, even though the only changes that are being made are restricted to the user’s profile. This is obviously ridiculous in a corporate environment, as new user setups require the user to be made a local administrator for their first login just to install Shoretel’s Outlook integration.

I lived with this as an inconvenience over the last few years, but the time has now come to plan for a replacement of our Melbourne office’s out-dated Ericsson PABX system. This issue, then, will be a show-stopper as we’re not going to make 80+ users local administrators – even temporarily.

Last week, I sat down to think about the problem and remembered something I’d read about “shimming” applications in Vista & Windows 7. This then led me to wonder if I could create a shim that stops UAC from being triggered by the Shoretel Outlook integration installer – %programfiles%\Shoreline Communications\ShoreWare Client\UninstWrpr.exe

The above process will obviously break any functionality within UninstWrpr.exe that does actually require elevated privileges, but that’s not a concern to me. I went ahead and created a new Security Database using Microsoft’s Application Compatibility Toolkit, and set up the shim as per one of the technet documents. I installed the resulting sdb file on a test machine using the inbuilt sdbinst.exe command, and voila! The Outlook integration installed without a single UAC prompt, and worked properly to boot.

The only part of the process left, is to figure out how to deploy the shim to the client machines. For the sake of brevity, I’ll detail the entire process in a new post shortly.

It can be done by simply creating a transform (MST) file using Orca. This is advantageous over importing the MSI into Advanced installer for the following reasons:

1. You’ll be using MYOB’s original MSI file
2. You don’t need to make any changes to the MSI file itself. All changes are specified in the transform file.

This will install Premier to the root of C drive, which is MYOB’s default location. For example, Premier 11 will be installed to C:\premier11.

You’ll need Orca installed. Instructions for Premier 12 are below. For Premier 11, follow the same instructions – but take note of point 4.2.2

1. Copy the default MSI and CAB files from the CD to your deployment share.
2. Right-click the MSI and choose “Edit with Orca”
3. Go to the Transform menu, and select “New Transform”. Any changes you now make to the MSI will be effected in a separate “MST” file.
4. Make the following changes:
1. In the CustomAction table:
   1. Select “ISVerifyScriptingRuntime” and press delete (or right click on it and choose “Drop Row”
   2. Do the same for ISSetupFilesExtract
   3. Do the same for ISSetupFilesCleanup
2. In the Directory table:
1. Change directory “KEY_NAME_SC” DefaultDir to “MYOB|MYOB” (without the quotes)
2. If deploying Premier 11:
1. Change directory  “ISYourCompanyDir” to MYOB|MYOB
2. Change directory “ISYourProductDir” to PREMIE~1|Premier11
5. Go to the Transform menu, and select “Generate Transform”. Save the transform file into the same network share/folder as your MSI and CAB file
6. You’re now ready to deploy Premier. Ensure you take note of the key points below:
   1. Make sure you choose the ‘Advanced’ Deployment Method, when you start adding the package to the policy.
   2. Assign the software package to the computer, in the “Computer Configuration” section of the policy.
   3. In the “Modifications” tab, make sure you specify the transform file that we created above.
   4. In the “Deployment” tab, be sure to check the “Uninstall this application when it falls out of the scope of management” checkbox.

If you’re not experienced in deploying software via MSI, the following links may be useful:

• How to use Group Policy to remotely install software in Windows Server 2003: http://support.microsoft.com/kb/816102
• How to assign software to a specific group by using Group Policy: http://support.microsoft.com/kb/302430/

After many attempts over the years to get MYOB Premier deployed via AD GPO, I stumbled across a method this morning using only free tools.

These two tools are an essential part of my MSI toolkit, keeping in mind that i’m not some sort of MSI guru like the guys at appdeploy.com
1. Orca
2. WinInstall LE 2003 (WinInstall LE 2003 used to be distributed for free, but now you have to trawl around the net to find it)

The steps are as follows. I used this method for Premier 11, so that’s what i’ll use below.

1. Import Premier’s MSI into WinInstall, making sure you tick the option to copy the source files
2. In WinInstall, turn off components you don’t need installed. I did this over creating a transform file, as that’s overly complicated for my needs
3. Close WinInstall and open Orca
4. Delete CustomAction->ISVerifyScriptingRuntime
5. Change Directory->ISYourProductDir to “PREMIE~1|Premier 11″
6. Change Directory->ISYourCompanyDir to “MYOB|MYOB”
7. Change Directory->KEY_NAME_SC to “MYOB|MYOB Premier 11″
8. Save the MSI file and close Orca

This worked for me, so good luck.

1. Set up a DFS shared folder to contain all your installation source files and any other related files
2. Create one GPO to install most of your software. I called mine “Software Deployment”. I still use a seperate GPO for Microsoft Office Std & Microsoft Office Pro, as they usually need to be installed first.
1. Assign permissions on a “Software Installation” level, and not on a GPO level
3. You can use ZAP files to publish non-MSI apps. You’ll need a way to run the install as another user, i’ll cover this later. (http://support.microsoft.com/kb/231747)

My reasoning behind the use of a DFS share is that you can move the location of the software, decommission servers, commission new servers, etc without breaking the GPO (Group Policy Object)

If you’re not already using the Group Policy Management Console, download it from MS (http://go.microsoft.com/fwlink/?LinkId=23529)

I haven’t figured out how to consolidate everything into one GPO, as I can’t see any way of ordering the individual software installations contained within a GPO. This causes problems where certain applications have prerequisites. For example, our phone system’s software client needs Outlook installed first. If Outlook isn’t installed, it won’t install the Outlook integration part. Therefore Office needs to be installed first. In order to overcome this problem, I have had to seperate our Office deployments from the main ‘Software Deployment’ GPO. That way I can change the ordering of the GPOs so that the Office ones take effect first.