Will GPO Software Installation re-install already installed applications from a different policy?

Solution 1:

When I've had to do this in the past, I've avoided the Software Install GPO because they're limited and cause as many problems as they solve.

EDIT: In response to your edit, YES, software installation GPOs can and will reinstall software that's already installed. (Which is one of the problems they cause - far from the only one, though.) In your scenario, if you elect to use the Software Installation GPO, this is something you'll have to put in some work to prevent, such as the suggestion in Greg's answer.

When I've had to use GPOs to install software, the way I've done it in the past is to use GPO that kicks off a scripted install which checks to make sure the thing isn't installed already. See example below, for installing PC*Miler26 shudder to a bunch of XP machines.

The screenshot show the startup script GPO pointing at a location on our corporate DFS, (which I've redacted) and the script itself is a bat file, due to the limitations in our environment - with XP machines, and WMI being frequently broken on our clients, that's the only thing that works reliably.

echo off
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\ALK Technologies\PC*Miler 26.0"
if %errorlevel%==1 (goto Install) else (goto End)

REM If errorlevel returns a value of 1, it means the key is not present, thus the program is not installed.  So install it.
:Install
\\[Our DFS software share]\PCMiler26\Network\setup.exe /s

REM If errorlevel returns a value other than 1, the key is present, and the program is already installed, or something odd's going on.  No installation.

:End

Solution 2:

If it is a different GPO, it may attempt to reinstall. If it actually completes the reinstall depends on the package. Software Installation GPO's have numerous limitations and are not the most flexible method to deploy applications. You should only use it if you don't have a real deployment solution like BigFix or SCCM.

You can workaround this by creating a filter to specify a Group Policy Preference to look for a tag that would indicate if the application is installed. For example, if the ntrtscan service does not exist.

More info here:

http://evilgpo.blogspot.com/2012/05/inverting-wmi-filters.html

Note the example at the bottom. You would create an item-level targeting filter for a service that does not exist.

Solution 3:

I know this is an little old, but I was looking into something related to this and thought I'd share my experience too.

It depends on how you assign applications. Also GPO Applied applications are mostly bad. In my testing, I've assigned it via computers (2012 R2 Domain to Win7 computer, tested with Kaspersky MSI).

To test, I made a copy of the GPO that deployed the MSI and applied it to the previously linked OU. I ran a gpupdate /force and was not prompted to restart the computer(which means no changes were applied to the computer). To confirm the GPO applied, ran gpresult /R and confirmed Copy_of_GPO was bieng applied. To double check how the GPO was treating the installer, I looked up what the registry said in. "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt\" (thanks to Assigning software through group policy - how does client know if the package is installed or not) The GPO GUID of COPY_of_GPO showed up in GPOs. A single instance of Product ID was under AppMgmt and held the initial GPO GUID as it's source GPO.

Where this goes bad; Say you then un-link either one of the GPOs. Since the GPO that applies the MSI is no longer applied, the MSI is removed. Even if the other GPO assigned it. This hiccup matters because apparently GPOS that are applied are enumerated before their settings are applied(which is why if you assign multiple programs with multiple GPOs they all install at the same time). If GPOs that apply a software are processed and removed, a (losing) race condition is created. The GPO GUID exists but the PKG GUID that it contains doesn't.

This gets even worse with AV which can have issues with windows installs/uninstalls. In fact, Kaspersky even has a standalone uninstaller for removal of their own client. AV doesn't like to go away.

This gets even more compicated with a poorly setup MSI.

TL:DR Don't use Assigned Applications via GPO, especially with AV.

Extra Reading: https://msdn.microsoft.com/en-us/library/cc782152%28v=ws.10%29.aspx