Install Windows Server 2008 R2 Features and Roles through Group Policy

Question

Can I install windows built-in features and roles through group policy? If there is not a way to do this with group policy, is there some other method to this unattended to a bunch of servers that have already been deployed?

In this particular case I am interested in SNMP, but I will probably want to do this for other roles and features down the road.

Solution 1

One way to do it would be using a startup script. Windows 2008 was designed to be maintained from the command line and has tools to add roles and features

See: Installing Windows Features on a server running a Server Core installation of Windows Server 2008 R2

I haven't tested, but it looks like the command you would need is Dism /online /enable-feature /featurename:SNMP.

Theis page might be useful since it covers the registry settings you might want to make to configure it.

http://msdn.microsoft.com/en-us/library/ms907066.aspx

Solution 2

You can also use pkgmgr with an unattend file to install a role with a customised set of sub-ordinate features:

pkgmgr /n:\\somesserver\someshare\unattend\IISUnattend.xml

The unattend file looks something like:

<?xml version="1.0"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
  <servicing>
   <package action="configure"> 
     <assemblyIdentity 
        name="Microsoft-Windows-Foundation-Package"
        version="6.0.6001.18000"
        language="neutral"
        processorArchitecture="amd64"
        publicKeyToken="31bf3856ad364e35"
        versionScope="nonSxS"
     />
    <selection name="IIS-WebServerRole" state="true"/>
    <selection name="IIS-WebServer" state="true"/>
    <selection name="IIS-CommonHttpFeatures" state="true"/>
    <selection name="IIS-StaticContent" state="true"/>
    <selection name="IIS-DefaultDocument" state="true"/>
    <selection name="IIS-DirectoryBrowsing" state="true"/>
    <selection name="IIS-HttpErrors" state="true"/>
    <selection name="IIS-HttpRedirect" state="true"/>
    <selection name="IIS-ApplicationDevelopment" state="true"/>
    <selection name="IIS-ASPNET" state="true"/>
    <selection name="IIS-NetFxExtensibility" state="true"/>
    <selection name="IIS-ASP" state="true"/>
    <selection name="IIS-CGI" state="true"/>
    <selection name="IIS-ISAPIExtensions" state="true"/>
    <selection name="IIS-ISAPIFilter" state="true"/>
    <selection name="IIS-ServerSideIncludes" state="true"/>
    <selection name="IIS-HealthAndDiagnostics" state="true"/>
    <selection name="IIS-HttpLogging" state="true"/>
    <selection name="IIS-LoggingLibraries" state="true"/>
    <selection name="IIS-RequestMonitor" state="true"/>
    <selection name="IIS-HttpTracing" state="true"/>
    <selection name="IIS-CustomLogging" state="true"/>
    <selection name="IIS-ODBCLogging" state="true"/>
    <selection name="IIS-Security" state="true"/>
    <selection name="IIS-BasicAuthentication" state="true"/>
    <selection name="IIS-WindowsAuthentication" state="true"/>
    <selection name="IIS-DigestAuthentication" state="true"/>
    <selection name="IIS-ClientCertificateMappingAuthentication" state="true"/>
    <selection name="IIS-IISCertificateMappingAuthentication" state="true"/>
    <selection name="IIS-URLAuthorization" state="true"/>
    <selection name="IIS-RequestFiltering" state="true"/>
    <selection name="IIS-IPSecurity" state="true"/>
    <selection name="IIS-Performance" state="true"/>
    <selection name="IIS-HttpCompressionStatic" state="true"/>
    <selection name="IIS-HttpCompressionDynamic" state="true"/>
    <selection name="IIS-WebServerManagementTools" state="true"/>
    <selection name="IIS-ManagementConsole" state="true"/>
    <selection name="IIS-ManagementScriptingTools" state="true"/>
    <selection name="IIS-ManagementService" state="true"/>
    <selection name="IIS-IIS6ManagementCompatibility" state="true"/>
    <selection name="IIS-Metabase" state="true"/>
    <selection name="IIS-WMICompatibility" state="true"/>
    <selection name="IIS-LegacyScripts" state="true"/>
    <selection name="IIS-LegacySnapIn" state="true"/>
    <selection name="WAS-WindowsActivationService" state="true"/>
    <selection name="WAS-ProcessModel" state="true"/>
    <selection name="WAS-NetFxEnvironment" state="true"/>
    <selection name="WAS-ConfigurationAPI" state="true"/>
  </package>
</servicing>
</unattend>

I used WAIK's Windows System Image Manager to help create the unattend file. Again, this would need to be included in a startup script.

Solution 3

You can add/remove roles via PowerShell cmdlet and command line - http://technet.microsoft.com/en-us/library/cc732263.aspx.

To do so via group policy use start up scripts.

Comments

[tony roth]

I've used dism a lot in this fashion, one of the cool thing is that it works in offline mode also, I use it against both offline vhd images and boot from san volumes. It would be nice to be able to do this via gpo's though!

[Kyle Brandt]

Put this in a startup script. Also made a group policy for the community and allowed managers registry entries. Then after rebooting the servers I was able to run SNMP queries against them.