Auto Light Dark
Auto Light Dark

(Windows) Batch File Template for Deployment with GPO and AD

This batch file template is a companion to the article Windows Agent - Deploy with Group Policy Object and Active Directory. Use it to create the batch (.bat) file that you place in the GPO deployment network share.

Before you start: share permissions

The scheduled task runs as NT AUTHORITY\SYSTEM. When it reads from or writes to the network share, it uses the server's computer account (for example, DOMAIN\SERVER01$), not a user account. Set these permissions on the share and on the folders (NTFS):

Folder

Group

Permission

Installer folder (contains the .msi and .bat)

Domain Computers

Read

Logs folder (the LOGFOLDER path in the script, a Logs subfolder of the share)

Domain Computers

Modify (write)

Deploying to more than one domain? Each domain has its own Domain Computers group. Add the Domain Computers group of every domain whose servers run the script. If a domain's servers can't read the installer, nothing installs on them, and the script logs cannot read installer.

How to use the template

  1. Copy the script below into a text editor such as Notepad.

  2. Edit the values in the Edit these values block (values within < >):

    • SOURCEFOLDER: network path of the folder holding the installer

    • SOURCEFILE: name of the installer, for example cloudamizeAgent.msi

    • TARGETFOLDER: local folder on each server where the installer is copied (default C:\temp\Cloudamize)

    • LOGFOLDER: network path of the Logs folder

    • CUSTOMERKEY: your customer key from the Cloudamize Settings page

  3. Save the file with a .bat extension.

  4. Place it in the network share created in the companion article.

The script is safe to run more than once: it skips servers that already have the agent, and it never restarts a server.

The script

Bash
@echo off
REM ==================================================================
REM  Cloudamize Windows Agent - GPO deployment script
REM  Run it as a Group Policy scheduled task (it runs as NT AUTHORITY\SYSTEM).
REM  See the Cloudamize Knowledge Base article "(Windows) Batch File
REM  Template for Deployment with GPO and AD" for setup and log details.
REM ==================================================================
setlocal EnableExtensions

REM ---- Edit these values -------------------------------------------
SET FRIENDLYNAME=Cloudamize Agent
SET SOURCEFOLDER=\\<server>\<share>\agentDeploy
SET SOURCEFILE=<cloudamizeAgent.msi>
SET TARGETFOLDER=C:\temp\Cloudamize
SET LOGFOLDER=\\<server>\<share>\agentDeploy\Logs
SET CUSTOMERKEY=<customer key from the Cloudamize Settings page>
REM ------------------------------------------------------------------

SET LOGFILE=%LOGFOLDER%\%COMPUTERNAME%.txt
SET CSV=%LOGFOLDER%\InstallationLog.csv
SET LOCALLOG=%TARGETFOLDER%\cloudamize_deploy.txt
SET MSILOG=%TARGETFOLDER%\cloudamize_msi.log

if not exist "%TARGETFOLDER%" mkdir "%TARGETFOLDER%"

for /f "delims=" %%U in ('whoami 2^>nul') do set RUNAS=%%U
call :log "Start. Domain %USERDOMAIN%, running as %RUNAS%"

REM 1. Skip servers that already have the agent
call :isInstalled
if "%INSTALLED%"=="1" goto alreadyInstalled

REM 2. Check this computer can read the installer, then copy it locally
if not exist "%SOURCEFOLDER%\%SOURCEFILE%" goto cannotRead
copy /Y "%SOURCEFOLDER%\%SOURCEFILE%" "%TARGETFOLDER%\%SOURCEFILE%" >nul 2>&1
if not exist "%TARGETFOLDER%\%SOURCEFILE%" goto copyFailed
call :log "Copied installer to %TARGETFOLDER%"

REM 3. Install silently with a verbose MSI log, without rebooting
call :log "Installing %FRIENDLYNAME%"
start "" /wait "%SystemRoot%\system32\msiexec.exe" /i "%TARGETFOLDER%\%SOURCEFILE%" CUSTOMERKEY="%CUSTOMERKEY%" /qn /norestart /l*v "%MSILOG%"
set RC=%ERRORLEVEL%
copy /Y "%MSILOG%" "%LOGFOLDER%\%COMPUTERNAME%_msi.log" >nul 2>&1

REM 4. Confirm the agent really is installed now
call :isInstalled
call :log "msiexec result %RC%, agent present afterwards %INSTALLED%"
call :csv "msiexec %RC%, installed=%INSTALLED%"
goto end

:alreadyInstalled
call :log "Agent already installed, nothing to do"
call :csv "already installed"
goto end

:cannotRead
call :log "CANNOT READ %SOURCEFOLDER%\%SOURCEFILE%. Give this domain's Domain Computers group Read on the share and the folder"
call :csv "cannot read installer"
goto end

:copyFailed
call :log "COPY FAILED to %TARGETFOLDER%"
call :csv "copy failed"
goto end

:isInstalled
set INSTALLED=0
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Cloudamize Windows Agent" /d 2>nul | findstr /i /c:"Cloudamize Windows Agent" >nul && set INSTALLED=1
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Cloudamize Windows Agent" /d 2>nul | findstr /i /c:"Cloudamize Windows Agent" >nul && set INSTALLED=1
exit /b 0

:log
>>"%LOCALLOG%" echo %DATE% %TIME% %~1
>>"%LOGFILE%" 2>nul echo %DATE% %TIME% %~1
exit /b 0

:csv
>>"%CSV%" 2>nul echo %COMPUTERNAME%,%USERDOMAIN%,%DATE%,%TIME%,%~1
exit /b 0

:end
call :log "End"
endlocal
exit /b 0

Checking the results

For every server, the script writes:

  • a line in InstallationLog.csv in the Logs folder (server, domain, date, time, result);

  • a log file <COMPUTERNAME>.txt in the Logs folder;

  • the detailed Windows Installer log <COMPUTERNAME>_msi.log in the Logs folder;

  • a copy of its log on the server itself, in C:\temp\Cloudamize\cloudamize_deploy.txt, in case it couldn't write to the share.

Result in InstallationLog.csv

Meaning

What to do

msiexec 0, installed=1

Installed successfully

Nothing

msiexec 3010, installed=1

Installed. Windows reports a restart is pending; the script doesn't restart the server

Nothing

already installed

The agent was already on the server

Nothing

cannot read installer

The server's computer account can't read the installer on the share

Give that domain's Domain Computers group Read on the share and the folder

copy failed

The installer couldn't be copied to TARGETFOLDER

Check the local folder path, free disk space and antivirus

msiexec 1625

The installation was blocked by a policy (for example, AppLocker or Software Restriction Policies)

Allow the Cloudamize installer in that policy

msiexec 1603 or another code

The installation failed

Send us <COMPUTERNAME>_msi.log

No line at all for a server

The script never ran on that server

Run gpresult /r /scope computer on the server to check the GPO applies, and check the scheduled task settings in the companion article

Note: an Immediate Task in Group Policy runs again at each policy refresh unless "Apply once and do not reapply" is selected. That's fine with this script, because it skips servers that already have the agent.

Note: the Mass Agent Deployment Scripts are sample scripts created by Cloudamize, and they may or may not work in your environment. Whether they work depends on the configuration of the environment where the mass deployment is run. Cloudamize does not offer support for the mass deployment tools themselves, because they are not Cloudamize products.

If a server still fails, email helpdesk@cloudamize.com with:

  • its line from InstallationLog.csv and its <COMPUTERNAME>_msi.log;

  • if the agent installed but doesn't appear in Cloudamize, C:\Program Files (x86)\Cloudamize\log_backup.txt from the server.

If you have any queries, please get in touch with the helpdesk via our Helpdesk Portal or by email at helpdesk@cloudamize.com.