Using Software Distribution Tools to Install Internet Explorer 8
Overview: Automating the deployment of Internet Explorer 8
Using automated software distribution tools like Microsoft® System Center Configuration Manager (SCCM) 2007 or Microsoft Systems Management Server (SMS) 2003 to automate your deployment can help eliminate desktop visits and human error. You distribute your custom browser package over the network from a central location to users' computers. You can choose the group of users' computers on which you want to install the package automatically, and the dates and times when you want the installation to occur. This flexibility can help you avoid network congestion, and ensure that the deployment occurs after users have had sufficient time to receive training and prepare for the installation.
SCCM and SMS can install browser software without requiring user interaction, and can install software with administrative credentials even if a user without administrative credentials is logged on. Users do not need to log on to servers or computers that are based on Microsoft Windows NT® to perform updates. This makes SCCM ideal for off-hours distribution or distribution to security-enabled servers. SCCM also provides status reports so that you know when the software has been successfully installed, and, more importantly, when it hasn’t.
Preparing to deploy Internet Explorer 8 automatically
If your organization is using Automatic Updates, and you want to prevent users from automatically receiving Windows® Internet Explorer® 8, we recommend that you follow these precautions:
Download and deploy the Internet Explorer 8 Blocker Toolkit (available at RC1 from the Microsoft Download Center at http://go.microsoft.com/fwlink/?LinkId=160106). The Blocker Toolkit does not expire. It includes a Group Policy template and a script that sets a registry key to prevent Automatic Updates, Windows Update, and Microsoft Update from offering Internet Explorer 8 as a high-priority update. Using the Blocker Toolkit also prevents automatic upgrades from earlier versions of Internet Explorer to Internet Explorer 8.
For more information, see the Internet Explorer 8 Blocker Toolkit FAQ (http://go.microsoft.com/fwlink/?LinkId=160107).
The Blocker Toolkit will not prevent users who are local administrators from manually installing Internet Explorer 8—for example, from external media or the Microsoft Download Center.
The Blocker Toolkit for Internet Explorer 8 will be available with the RC1 release of Internet Explorer 8.
Deploy an update management solution that provides full control over the updates deployed to computers in your network. Microsoft offers several update management products:
IT administrators who are using an update management solution should use the standard features of their product to control Internet Explorer 8 distribution.
Prevent users from running as local administrators on their computers. Users who are not local administrators are not offered the updates and are normally restricted from manually installing Internet Explorer 8 (or any other application).
For more information about default security settings, see http://go.microsoft.com/fwlink/?LinkId=83130.
If the previous options are not feasible for your organization, you can instruct your users to select Don’t Install when they are prompted at the Internet Explorer 8 welcome screen. Users do not take special action to receive this notification, and all users have the opportunity to decline the installation.
Step 1: Building a custom browser package for SCCM deployment
Use the Internet Explorer Customization Wizard 8 to build the custom browser package that you want to deploy to your users. You can use the wizard to customize the appearance and functionality of the browser, its components, and Windows Update Setup for Internet Explorer 8. You can also preset browsing options, and set system policies and restrictions for your users.
When you build a custom browser package for SCCM deployment, you must select the following options:
The Corporate version of the Internet Explorer Customization Wizard 8. This option is selected when you install the Internet Explorer Administration Kit 8 (IEAK 8), and it requires that you accept the Corporate Administrator License Agreement. IEAK 8 does not support switching to a different version of the Internet Explorer Customization Wizard 8.
The Flat media type. The required User Rights deployment option is available only with this media type.
The User Rights deployment option. The account used to log on to the users' computers is granted the administrative credentials necessary to perform the installation. This change in user rights is temporary—administrative credentials are granted only for the Internet Explorer 8 installation, and they expire when the installation is completed.
If you deploy your package with the User Rights deployment option on computers running Windows Vista® or Windows® XP, after the computers are restarted, members of the user group may receive a prompt indicating that Internet Explorer 8 is not the default browser. Attempts to set Internet Explorer 8 as the default browser do not succeed. To resolve the issue, you must add two registry keys for Internet Explorer 8 when you process the RunOnceTemp key.
Build a custom browser package for SCCM deployment
When you install IEAK 8, select Site License and Intranet (internal use) Distribution License so that you are running the Internet Explorer Customization Wizard 8 (Corporate version). This option requires you to confirm that you signed the license terms that permit the functionality included with this version of IEAK 8.
To start the Internet Explorer Customization Wizard 8, click Start, point to All Programs, point to Microsoft IEAK 8, and then click Internet Explorer 8 Customization Wizard.
Follow the steps in the wizard, and select the any appropriate options:
Select the target operating system from the Platform Selection page.
Select the target Language.
Select File on the media selection page.
Select the appropriate Features on the Feature selection page.
Synchronize the IEAK 8 components if required.
Select the appropriate Features on the Feature selection page.
Select any appropriate Custom Components.
Select the desired Corporate Install settings.
Select any Completely Silent and Do Not Restart on the User Experience setting. You can use the SCCM/SMS features to control reboots.
Complete the remaining screens, as appropriate for your organization.
Finish the IEAK 8 Wizard and make note of the build location.
When you click Finish, the Internet Explorer Customization Wizard 8 builds the custom browser package in the \build_directory\Flat\Win32_Platform\language folder. You should find one or more files called IE8-Setup-Full.exe.
Step 2: Creating an SCCM package for Internet Explorer 8
Complete the following steps to create the SMS package (this is the actual package that SCCM/SMS uses for distribution). Do not confuse this package with the custom browser package that you created with the Internet Explorer Customization Wizard 8 in Step 1: Building a Custom Browser Package for SMS Deployment earlier in this section.
Create an SMS package for Internet Explorer 8
To open the SCCM ConfigMgr Console, click Start, point to All Programs, point to Microsoft Systems Center, and then click Config Mgr Console.
In the left pane, expand Site Database.
Right-click Packages, click New, and then click Package.
Click the General tab, and type the name of the package, its version, its publisher, its language, and a descriptive comment. (The only required value on this tab is Name.)
Click Change Icon and browse for the Internet Explorer 8 Setup file so that you will use the correct Setup icon.
Click the Data Source tab.
On the Data Source tab, select the This Package Contains Source Files check box.
Under Source Directory, click Set to open the Set Source Directory dialog.
Type the path to the Internet Explorer 8 Setup files, or click Browse to locate the IEAK 8 build directory. Click OK to return to the Data Source tab.
Click the Distribution Settings tab. Select your preferred priority and sender.
Click OK to create the package.
Every SCCM/SMS package must include at least one program to define the command line parameters to use when running the Setup. Some packages will have multiple programs.
Create a program
To open the SCCM ConfigMgr Console, click Start, point to All Programs, point to Microsoft System Center, and then click ConfigMgr Console.
In the left pane, expand Site Database, expand Packages, and then expand your Internet Explorer 8 package.
Right-click Programs, click New, and then click Program.
In the General tab, enter a descriptive name for the program.
In Command line, enter the exact command line to be used when this program is run.
In the Run drop-down list, select one of these options to determine how the Setup window will be displayed when the program is run: Normal, Minimized, Maximized, or Hidden.
In the After running drop-down list, select the option that describes the action to take after the program has completed.
Click the Requirements tab. Enter the information for the Internet Explorer 8 software requirements that apply to this program. Use the drop-down lists to determine how much disk space should be available for the setup, the maximum amount of time to let the program run, and the operating systems that are supported by this program.
Click the Environment tab. In the Program can run drop-down list, select the option that applies to this program. If the program will require user intervention for even one click, you must select Only when a user is logged on. If this is the case, also click the User input required box.
Under Run mode, click the option that describes the required user permission level. If the program will require administrative permissions, click Run with administrative rights, and then select Use Software Installation Account.
Under Drive mode, click the option that best fits the program. Select Reconnect to distribution point at logon if the program requires a computer restart to finalize.
Click the Advanced tab. Under When this program is assigned to a computer, select Run once for the computer.
Click OK to save the program.
If you do not select the Use Software Installation Account option when creating your SMS program, Internet Explorer 8 will install, but your custom settings may not be applied.
Step 3: Selecting the SCCM distribution servers
Your distribution servers are the distribution points for your package. SCCM/SMS copies all the files from the package source folder to a folder on your distribution servers. Setup runs from these distribution servers to support the users on your network.
To select the distribution servers
On the SCCM ConfigMgr Console, in the left pane under Packages, right-click the package that you designated for Internet Explorer 8, and then click Distribution points.
On the New Distribution Points Wizard welcome page, click Next.
On the Copy Package page, select your distribution servers from the Distribution points list, and then click Finish.
Step 4: Creating and running a job to distribute the package
After you create the package for Internet Explorer 8, you must create a job to distribute it. This job includes:
The list of users' computers that will receive the package for Internet Explorer 8. This is defined as a collection. Every computer in a collection will receive an advertisement for the job when it is assigned.
The schedule for running the package.
An advertisement for the package, which will be sent to the users' computers.
To create and run a job to distribute the package
On the SCCM ConfigMgr, in the left pane, expand Site Database.
Right-click Advertisements, point to New, and then click Advertisement.
In the Advertisement Properties dialog box, select values for the following fields:
Name. The name for the job.
Comment. A description of the package. This field is optional.
Package. The package for Internet Explorer 8 that you created in Step 2: Creating an SMS package for Internet Explorer 8 earlier in this section.
Program. The Internet Explorer executable file, which is part of the custom browser package that you built in Step 1: Building a custom browser package for SMS deployment earlier in this section.
Click the Schedule tab, and then select the dates and times when you want the package to run.
When the job runs, you can view it by clicking Advertised Programs in the Windows Control Panel. The job also creates an error log file (Iesmswrap.mif), which is located in the \Windows\Temp folder. You can perform a search for *.mif to locate the file.
The installation process
At the scheduled date and time, SCCM/SMS sends the package to the specified users' computers. When these computers recognize that the package is available, the installation process begins. The Internet Explorer 8 Setup process occurs in three phases:
Internet Explorer 8 Setup performs the following tasks:
Modifies the registry to enable automatic logon.
Disables the functionality of the keyboard and mouse.
Records the path to the distribution server that executed the package.
Executes the shutdown function to restart the users' computers.
Internet Explorer 8 Setup performs the following tasks:
All tasks will run with administrative credentials.
Runs from the registry in Quiet mode.
Finishes the initial phase of its installation.
Calls the shutdown function to restart the users' computers.
Internet Explorer 8 Setup continues with the final phase of the installation by making one last call to the shutdown function with a 30-second timer. (You might need to adjust the timer to allow sufficient time for Internet Explorer 8 to finish its configuration.)
At this point, the Internet Explorer 8 installation is complete. After the installation, Internet Explorer 8 Setup performs the following tasks:
Disables automatic logon, removes administrative credentials, and enables the keyboard and mouse services.
Restarts the users' computers. The program is now set for the users to log on.
Configures Internet Explorer 8 for the users' computers the first time the users log on.