views:

336

answers:

5

Is there anything built into Windows and the .Net framework for programmatically installing and executing applications remotely? Ie: an API for remote software deployment. I'd like to build a tool that can install services on a pool of new computers from one central admin workstation.

Update: The computers are part of an internal IT network, and the applications and services are mostly internally developed. The deployment program would be completely internal, and not sold commercially.

A: 

All of the pieces are there (copying files to a remote machine, spawning a process on a remote machine, etc.) You will be looking at a fair amount of programming to put it all together into a robust application. You will also need to make sure the clients are configured properly and safely. Naively configuring the client to allow you to do this would most likely wind up with massive security holes on your client machines. I would suggest looking at SMS or one of the many similar third party apps. At the very least even if you can't afford to use an already written app (highly recommend that you do) then you could look at their feature lists to get an idea of what sort of issues you need to be thinking about.

With the further provided information, I would ask if you are using Group Policies in your environment. If you are, then you may be able to package your application as an MSI then deploy via policy.

EBGreen
+1  A: 

"I'd like to build a tool that can install services on a pool of new computers from one central admin workstation."

So would everyone else who wants to build a bot-net to send spam email all day long. Sure, you may have good reasons for this. But there are security considerations that make this undesirable and rather difficult.

Start with Microsoft Deployment Services.

Microsoft has extensive Desktop Deployment information.

S.Lott
Well, if I'm going to install a botnet it's going to be on my own company computers. I'm figuring there's probably something out there for IT departments where administrator access is assumed.
C. Lawrence Wenham
@Chris Wenham: "administrator access is assumed"? Can't parse this. Do you mean "administrator access already granted"? If so, could you clarify your question. I'm not sure I understand what your use case is.
S.Lott
@Chris Wenham: You would need more than simple admin access. WMI would have to be configured properly if you want to start/stop services, RDP would need to be configured properly to kick off process execution. Depending on your needs, even more would need to be uniquely configured.
EBGreen
@Chris Wenham: "it's going to be on my own company computers" If your implementation shares any Windows security problems, you may have opened the door to someone leveraging your idea to make a bot-net.
S.Lott
S.Lott: I understand what risks are. What I'm looking for are APIs for software distribution that have had all the security issues thought out and covered, precisely so I don't have to write my own and risk having it exploited.
C. Lawrence Wenham
@Chris Wenham: "What I'm looking for are APIs for software distribution" Please update the question to add that useful piece of additional information.
S.Lott
A: 

Depending on your needs, SysInternals' PsExec program might work for you. The documentation says that you don't need to install anything on the other computers. I use it at work to start build processes on remote machines.

Tim Stewart
PSExec will work as long as RDP is configured properly and admin access is available. It will allow you to remotely run an executeable. If that is the *only* need for the system then it is a reasonable solution.
EBGreen
+2  A: 

I am assuming that all the computers concerned are XP Pro, a member of an AD Domain and under the control of a single company. This is then the same as our set up at work. We use group policy to set firewall configuration on members computers, this opens the DCOM port because it is required to allow 'Offer Remote Assistance' to work. Obviously our network is seperated from the internet by a firewall which does NOT allow this type of traffic in! The DCOM port also allows WMI remote execute. XP also exposes the administritive share (c$ etc) so you can copy files onto the PC. If you can set your installer up so that it can run un-attended then there is no reason why you can't copy it onto a remote machine and then run it. You should also be able to then remotely start the service using WMI.

You should try Group policy first. We use it at work to do several software deployments and it works. We failed to make it deploy a .net written service though, and we also have an alternative in-house system for our .net client applications, that updates the application before running it, so I do accept that it has some drawbacks.

We are currently in the process of rolling out SCCM (SMS), so I can't comment on its abilities but if your organisation can afford it then I expect it would be better than an in-house system.

pipTheGeek
A: 
  • PsExec is a poor-man's way which I've used many a time.
  • Microsoft Deployment Toolkit has tools for deploying apps. It's free, but from what I understand, a lot to learn. It would probably be a wise investment, however.
  • The most flexible way which wouldn't require a ton of work is to assign MSIs using group policy. You won't have to install extra software or think about how the bits get from one place to another.
  • There are a ton of third-party apps which, based on the size of your environment and your current IT infrastructure, may have added benefits beyond app deployment in adopting. You have System Center, Symantec Altiris, and plenty more.
halr9000