Intelligent Install is an application delivery tool that can be used to automate the selective delivery of applications to computers on a network

Unfortunately Intelligent Install can no longer be purchased as a stand alone product and is now incorporated into our UMS product

The Windows Installer Service manages application installation, modification, repair and removal. It also helps reduce DLL conflicts and allows improved management of desktop applications. Windows Installer packages are self-contained database files containing requirements and instructions that are followed when applications are installed. Among several key benefits gained include:

• Consistent installation rules
• Better management of shared components
• Dynamic configuration and control

See Microsoft's MSDN for further information.

A managed application is a Windows Installer package, installed by an Elevated rights Windows Installer service, that allow a package, once installed to be maintained by any logged user.
This enables a user with any no extra priviledges, at a "locked down" workstation to self-heal and install components of an application, and without being able to install new software.

Currently, we are only aware of 1 other application delivery system that installs applications in this way: Microsoft Group Policies

See MSDN for Microsofts definition of a managed applications

In order for a service running under the System account (the 2.1 Workstation Agent must run under the System account to correctly install Windows Installer applications) of a workstation to access a network share on a Windows XP Workstation or Windows 2003 Server, outside of a domain, you need to enable the following items:

• Add anonymous users to the everyone group
• Add the Intelligent Install share to the list of shares available to anonymous logons
• Enable RPC for anonymous users
• Enable srvsvc interface for anonymous users (required for Windows XP SP2)

This needs to be set on the 'server' machine and can be set in one of two ways; through local system policy, or the equivalent local registry value

Enable the following local policy setting:

Computer\
Windows Settings\
Security Settings\
Local Policies\
Security Options\
Network access: Let Everyone permissions apply to anonymous users

Or set the following registry value:

HKEY_LOCAL_MACHINE\
SYSTEM\
CurrentControlSet\
Control\
Lsa\
Everyoneincludesanonymous = 1

Configuring the Intelligent Install share for access by workstation Agent On Windows Server 2003 or XP this can be achieved by modifying the "Network Access: Shares that can be accessed anonymously" Policy to include the network share name.

Or, to enable “NullSessionShares” access to the share on previous systems, modify the following registry key on the Server that hosts the network share:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters, Value: NullSessionShares

Add the share name to the list.  This will enable the IIAS service under System account to access the share.  The file access permissions will need to be Everyone “Read Only”.  (the service will appear as non-authenticated access).

Starting with Windows XP SP2 the anonymous access to RPC has been disabled.  It appears that Microsoft Windows Installer requires access to the NetShareGetInfo (level 1) when it detects the installation source is from a UNC path.

This API (accessed through IPC$) is by default no longer available and Windows Installer reports error 1619: "This installation package could not be opened".  To re-enable access, modify:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\RPC, Value: RestrictRemoteClients = 0

Starting with Windows Server 2003 SP1 and Windows XP SP2, Microsoft have changed which named pipes are available to unauthenticated (NULL session) users.  This update includes the srvsvc pipe.

The Windows Installer service requires access to the APIs provided through the \pipe\srvsvc to install an MSI from a remote host.

When accessed outside of the domain model, anonymous access to this pipe needs to be re-enabled.

To re-enable access, modify:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\, Value: NullSessionPipes, append: srvsvc

In order for a service running under the System account (the 2.1 Workstation Agent must run under the System account to correctly install Windows Installer applications) of a workstation to access a network share in Active Directory, the Computer object (or Domain Computers) must have the appropriate privileges to access the share/directory & file permissions.

In order for a service running under the System account (the 2.1 Workstation Agent must run under the System account to correctly install Windows Installer applications) of a workstation to access a network share in an NT4 Domain, you need to enable “NullSessionShares” access to the share.

The Installer checks the return code from the installation executable to check is it executed correctly.  It interprits the following return codes:

0	ERROR_SUCCESS, The operation completed successfully.
3010	ERROR_SUCCESS_REBOOT_REQUIRED, The requested operation is successful. Changes will not be effective until the system is rebooted.
3011	ERROR_SUCCESS_RESTART_REQUIRED, The requested operation is successful. Changes will not be effective until the service is restarted.

Any other return code is interpretted as an error, even if the executable has completed successfully.  It is possible to 'wrap' and executable with another executable to discard any unwanted error codes.

These issues are usually based around the Intelligent Install server share not having been configured correctly.  The following FAQ articles relate to configuring the server share:

• How do I configure the 2.1 Workstation Agent to have access to an Active Directory network share?
• How do I configure the 2.1 Workstation Agent to have access to a share on a Windows XP SP2 workstation or Windows Server 2003 (no domain)?

Intelligent Install parsers all IDS files to compile a single list of applications to install for the current session.  Therefore all conditions are resolved before the first application is installed.

Applications that rely on other applications through a condition, will therefore not be installed until the next session (execution of the Installer- IINSTALL.EXE)

There is currently no facility within Intelligent Install to detect slow connections.  This function has typically been controlled before at a higher level (i.e. the log on script only runs if you are on the LAN, not through dial-up).