Printable View
we have quite a few pc's here any many located at offsite locations and i am wanting to enable SNMP on them all, problem is if i was to do each pc individualy it would take me more time then its worth, We are running active directory and most machines are XP with the handfull of 2k machines.
Any idea how i can deliver SNMP windows install through a group policy?
I'm not so sure you can do it through Active Directory via publishing or assigning a package. Though, you can do it via scripting.
You can assign a startup script to the clients via group policy. You'll have to be sure that the workstations know where the install media is. Obviously, you should have different media paths for both the 2k and xp workstations.
If I were doing it... I might do the following.
Copy install media for each OS to some available network resource accessible by the workstations. I use distributed file system to manage remote office servers and install files... so I'd use that UNC.
Create two .reg files to change the path of the install media. One for XP and one for 2k.
Create a script (kixtart should do) that checks the OS and imports the appropriate registry settings. Once it has imported those settings, then use Sysocmgr.exe to install the snmp component. (this may require a reboot?)
I'd assign this script at the computer level to get around permission problems with nonadmins trying to install or modify the system. Otherwise, use cpau to execure the script with appropriate permissions.
After the install is sucessful, I'd have the script add a registry key that you can check via your script in the future to make sure it doesn't try to reinstall everytime the computer starts up or the user signs on.
Maybe you'll want to have the script write the computer name, date and time to some file too, so you can see which computers have updated that component.
To set the community name and other snmp settings, you can do a couple of things. You can use the builtin SNMP settings in GP via computer, admin templates, network, snmp. If all the settings you want to deploy are not there, I'd create a custom .adm file and deploy that via group policy. If you wanted, you could also do this via a .reg file and import that via script.
Beware of either approach. Both the .reg and the adm would contain the snmp settings (passwords and such) and people could easily find out your snmp settings by viewing either the .reg or .adm file containing those settings.
Otherwise, you'll have to manually configure snmp. Even still, users can find out the snmp settings unless you lock down the control panel, services mmc, regedit, etc.
BTW: If and when you do this, be sure you apply the MS06-074 security patch. If you're using WSUS, you probably already have that update approved. Otherwise, you can download it from the above links and just install it with the same script you use to install snmp in the first place.
I would also add IP restrictions so that only your SNMP management servers can talk to your workstations over the SNMP protocol. You can do this in the registry, same place you enable SNMP to run and setup the community strings, etc...