IntelliMirror Software Distribution in Windows 2000

This article provides an overview of how Microsoft Windows 2000 uses IntelliMirror technologies to automate centralized software distribution. By combining Active Directory, Group Policy, and the Windows Installer service, network administrators can deploy, update, repair, and remove software automatically across network-connected client computers without visiting physical workstations.

Core Architectural Components

IntelliMirror relies on three primary Windows 2000 components to manage software lifecycle:

  1. Active Directory (AD): Serves as the central repository for policy settings, network resources, and target recipient definitions (users and computers grouped into Organizational Units).
  2. Group Policy Objects (GPOs): The administrative mechanism used to define and enforce which software packages are distributed to specific users or computers.
  3. Windows Installer (.msi): A client-side service and package format that manages installation states, tracks file dependencies, enables rollbacks on failed installations, and runs with elevated administrative privileges to install software even when a standard user is logged in.

The Distribution Workflow

Software distribution through IntelliMirror follows a standardized operational sequence:

1. Software Packaging and Share Configuration

Administrators place Windows Installer setup files (.msi packages) and associated transforms (.mst files) on a shared network distribution point. The shared folder must have appropriate Read permissions for the target users or computer accounts. Legacy applications lacking a native .msi package can be wrapped using third-party repackaging tools or deployed using text-based .zap files, though .zap packages do not support elevated privileges or automatic self-healing.

2. Defining Policies in the Group Policy Editor

Within the Active Directory Users and Computers console, an administrator navigates to the Software Installation extension under either Computer Configuration or User Configuration within a targeted GPO. The administrator points the policy to the Uniform Naming Convention (UNC) path of the .msi package.

3. Selecting the Deployment Method

IntelliMirror executes distribution using two primary delivery models:

  • Assigning Software:
    • Assigned to Computers: The software is mandatory. Windows 2000 automatically installs the application during the computer's boot process, before any user logs on.
    • Assigned to Users: The application appears to be installed immediately. Shortcuts and registry entries (file associations) are created in the user's profile upon logon. The actual installation binaries are fetched and installed on demand when the user clicks the shortcut or opens a file associated with that software.
  • Publishing Software:
    • Published software is optional and can only be targeted at users, not computers.
    • It does not create default desktop shortcuts. Instead, the application is listed in the user's Add/Remove Programs applet in the Control Panel under "Add New Programs." Alternatively, the software installs automatically if the user double-clicks an associated document file type (document invocation).

Client Execution and Maintenance

When a targeted client connects to the domain, the Windows 2000 Group Policy engine evaluates the relevant GPOs:

  • Privilege Elevation: The local Windows Installer service executes under the LocalSystem account context, enabling the installation of services, drivers, and files into restricted areas (such as %ProgramFiles% and HKEY_LOCAL_MACHINE) without requiring administrative permissions for the end user.
  • Self-Healing: Windows Installer continually checks critical application components. If an essential file or registry key is deleted, the application triggers a silent reinstallation directly from the network share to repair itself.
  • Software Removal and Upgrades: When an administrator removes a package from the GPO, IntelliMirror can immediately uninstall the software across the network or allow existing installations to remain while preventing new ones. For upgrades, administrators can configure a new .msi package to automatically uninstall or patch the previous version.