Skip to main content

Deploy through a Group Policy package

This document describes one supported option for deploying the Keep Aware client in environments that use Group and do not use a separate software distribution tool or MDM (e.g., SCCM, Intune, Jamf, etc.).

To deploy Keep Aware using Group Policy, you must obtain both:

  • Keep Aware MSI (keepaware.msi)
  • Keep Aware MST transform (keepaware.mst)

Request these from your Keep Aware technical representative. A valid transform will allow you to publish fully through a Group Policy Object.

Overview​

Group Policy can deploy MSI packages to Windows computers at startup. Keep Aware provides an MST (transform) to apply required configuration/customizations during installation.

  • MSI: the installer package Group Policy installs
  • MST: a transform applied during installation (cannot be deployed alone)

Requirements​

Environment​

  • Microsoft Active Directory domain
  • Group Policy Management Console (GPMC) access
  • Target devices are domain-joined Windows computers

Files (provided by Keep Aware)​

  • keepaware.msi
  • keepaware.mst

This guide uses SYSVOL because it is widely available in AD environments.

Note: SYSVOL replicates to all Domain Controllers. Avoid very large installers or frequent version changes in SYSVOL.

1) Create the KeepAware directory in SYSVOL​

Create a directory in SYSVOL and copy both files into it.

Recommended structure:

  • \\<YOUR_DOMAIN>\SYSVOL\<YOUR_DOMAIN>\KeepAware\v1\keepaware.msi
  • \\<YOUR_DOMAIN>\SYSVOL\<YOUR_DOMAIN>\KeepAware\v1\keepaware.mst

Example (replace example.com):

  • \\example.com\SYSVOL\example.com\KeepAware\v1\keepaware.msi
  • \\example.com\SYSVOL\example.com\KeepAware\v1\keepaware.mst

Notes​

  • Use the domain-based SYSVOL path (\\<YOUR_DOMAIN>\SYSVOL\...) instead of a specific DC path (\\DCNAME\...).
  1. Open Group Policy Management (gpmc.msc)
  2. Locate the OU that contains your target computers
  3. Right-click the OU → Create a GPO in this domain, and Link it here…
  4. Name the GPO, for example:
    • Deploy - Keep Aware Client

3) Add the MSI package (Computer Configuration)​

  1. Right-click your new GPO → Edit

  2. Navigate to:

    Computer Configuration → Policies → Software Settings → Software installation

  3. Right-click Software installation → New → Package…

  4. Select the MSI using the UNC SYSVOL path, for example:

    \\<YOUR_DOMAIN>\SYSVOL\<YOUR_DOMAIN>\KeepAware\v1\keepaware.msi

  5. Choose Assigned

4) Attach the MST transform​

  1. In the same location (Software installation), right-click the Keep Aware package → Properties

  2. Open the Modifications tab

  3. Select Add...

  4. Choose the transform using the UNC SYSVOL path:

    \\<YOUR_DOMAIN>\SYSVOL\<YOUR_DOMAIN>\KeepAware\v1\keepaware.mst

  5. Click OK, then Apply

Important​

  • Attach the MST before any clients install the MSI.
  • Avoid changing the MST after deployment. If you need a new transform, treat it like a new version rollout (see “Upgrades” section below).

To prevent failures caused by “network not ready” at boot, enable:

  1. In the same GPO, go to: Computer Configuration → Policies → Administrative Templates → System → Logon

  2. Set: Always wait for the network at computer startup and logon = Enabled

6) Validate deployment on a test machine​

On a target computer:

  1. Reboot the device (software installation applies at startup)
  2. After login, verify Keep Aware is installed
  3. If it did not install, reboot once more (startup processing timing can vary)

Troubleshooting​

Confirm SYSVOL access​

From a target computer, verify the folder is accessible:

  • \\<YOUR_DOMAIN>\SYSVOL\<YOUR_DOMAIN>\KeepAware\

Check logs on the client​

Open Event Viewer and review:

  • Applications and Services Logs → Microsoft → Windows → GroupPolicy → Operational
  • Windows Logs → Application (look for MsiInstaller events)

Common causes of failure​

  • MSI or MST path uses a mapped drive letter instead of a UNC path
  • Files moved/renamed after the GPO was created
  • Network is not available early enough during startup (enable “Always wait for the network…”)

Upgrades and versioning (do not overwrite in place)​

Do not overwrite keepaware.msi in SYSVOL when upgrading. This can break repair/uninstall behaviors and confuse client source resolution.

Recommended approach:

  • Create a versioned folder, for example:

    • \\<YOUR_DOMAIN>\SYSVOL\<YOUR_DOMAIN>\KeepAware\v1\keepaware.msi
    • \\<YOUR_DOMAIN>\SYSVOL\<YOUR_DOMAIN>\KeepAware\v1\keepaware.mst
    • \\<YOUR_DOMAIN>\SYSVOL\<YOUR_DOMAIN>\KeepAware\v2\keepaware.msi
    • \\<YOUR_DOMAIN>\SYSVOL\<YOUR_DOMAIN>\KeepAware\v2\keepaware.mst

Then deploy the new version as a new package (and use GPO “Upgrades” if desired).

Table of Contents