Skip to main content
Certified Build

Deploy with Active Directory

You need:

  • The NVM for Windows MSI and the MST1 from the customer portal.
  • Administrative access to the domain controller to create group policies.

Prepare the file server​

Group Policy reads the MSI and the MST from a network share. Domain Computers must reach that share when the policy applies.

  1. Copy the MSI and the MST from the deployment pack to a file server.
  2. Make the share available to Domain Computers and to users in the GPO scope.
  3. Grant those accounts read access.
Source Files

1. Open the Group Policy Management Console​

Use one of these methods:

  • Run: Press Windows Key + R, type gpmc.msc, and select OK.
  • Start menu: Select Start, type Group Policy Management, and open the top result.
  • Server Manager: Open Server Manager, select Tools, and select Group Policy Management.

2. Create Group Policy​

  1. Right-click the organizational unit that contains the target computers where NVM for Windows will be installed.
  2. Select Create a GPO in this domain, and link it here.
  3. Select the GPO.
  4. In the right pane, select the Scope tab.
  5. Under Security Filtering, select Add.
  6. In Enter the object name to select, add Domain Computers.
  7. Add security groups if you must limit the NVM for Windows install.
  8. Select Check Names.
  9. Confirm that every name resolves.
  10. Select OK.
  11. If Authenticated Users is under Security Filtering, remove it.
  12. Select the Delegation tab.
  13. Confirm that Domain Computers and your groups are in the list.
Delegate Read for Authenticated Users

Removing Authenticated Users from Security Filtering prvents NVM for Windows installations from running on every device in the domain. It also removes the GPO Read permission. On the Delegation tab, add Authenticated Users with Read only. Without that Read permission, the GPO can fail to apply.

Create GPO

3. Configure Group Policy Installation Package​

  1. Right-click the GPO and select Edit.
  2. Go to Computer Configuration > Policies > Software Settings > Software installation. Select Computer Configuration. Do not select User Configuration. Certified Builds install at machine level2. The Community Build does not.
Find the GPO Software Installation Path
  1. Right-click Software installation.
  2. Select New > Package. A file dialog opens.
Use a UNC path

In the file dialog, open \\server\share\.... Do not open a mapped drive. The computer account applies this policy at startup. A mapped drive is not available to that account.

  1. Open the file-server folder that holds the NVM for Windows media.
  2. Select the .msi file.
  3. Select Open. The Deploy Software dialog opens.
  4. Select Advanced.
  5. Select OK.
  6. Select the Deployment tab.
  7. Set the deployment type to Assigned.
  8. Select Uninstall this application when it falls out of the scope of management only if you want removal when the computer leaves the scope.
Automatic uninstall when the computer leaves scope

Automatic uninstall runs when a computer leaves the management scope. That uninstall can remove Node.js for a user that you remove by mistake.

The MSI deletes %LOCALAPPDATA%\Author Software\nvm for the user who runs the uninstall. That folder holds that user's Node.js versions and global modules. Other user profiles on the same computer can keep their own folders. Copy that user's storage directory before you remove the product. You can restore that folder if you install NVM for Windows again.

Default storage directory: %LOCALAPPDATA%\Author Software\nvm\installs

  1. Select the Modifications tab.
  2. Select Add.
  3. Open the file server and select the .mst file1. You then accept the EULA on behalf of every user who receives the install. This step is required.
  4. Select OK.

The GPO now installs NVM for Windows on the target computers.

What Happens on Target Computers
  1. The MSI registers NVM for Windows as a Event Tracing for Windows event provider.
  2. Legacy SYSTEM NVM_HOME, NVM_SYMLINK, and Community Build PATH entries are removed.
warning

Do not add these scripts to this GPO:

  • Remediation/machine-startup.ps1
  • Register-EventLogSource.ps1
  • Remove-LegacySystemEnv.ps1

Use these scripts only when the MSI did not register the event provider or did not remove the legacy entries. Use them for that failed step, or for an offline retry. The v2 installer already registers the event provider and removes the legacy entries.

4. License the fleet​

The MSI does not write the organization access token or private key.

Access token and private key
  • Certified Build. The access token is the license. Set-NvmWindowsAccessToken.ps1 writes AccessToken and JwksCose. It does not write AccessKey.
  • Governance. Set-NvmWindowsLicensing.ps1 writes AccessToken, AccessKey, and JwksCose. AccessKey signs a short-lived JWT for requests to the Author Node.js mirror. See Node.js mirror.

The Certified Build pack includes Set-NvmWindowsAccessToken.ps1.

Add a Computer Configuration startup script. Do not put secret files on the software share.

Pass the access token on the command line:

powershell.exe ^
  -ExecutionPolicy Bypass ^
  -File \\fileserver\software\nvm-windows\<version>\Licensing\Set-NvmWindowsAccessToken.ps1 ^
  -AccessToken "<jwt-from-portal>" ^
  -JwksCoseUrl "https://assets.nvm-windows.com/nvm-jwks.cose"

See the license secret notes.

Apply the install on a client

A computer-assigned package installs when the computer starts. gpupdate /force refreshes policy. It does not install the MSI.

Restart the computer after the refresh. Or run gpupdate /force /boot. That command refreshes policy, then restarts the computer so Software Installation can run.

A computer-assigned package has no supported install path that skips the restart.

Alternative: User Configuration with elevated privileges

You can put the package under User Configuration and raise privileges for the install.

The install then runs at the next logon. Sign out and sign in on the client. A restart is not required for this path. Active Directory temporarily bypasses user limits so the MSI runs with administrative rights.

  1. Create or edit a GPO. Link it to the OU that contains the target users.
  2. Add the MSI under User Configuration > Policies > Software Settings > Software Installation.
  3. Select Advanced.
  4. Select Install this application at logon.
  5. Raise installer privileges:
    1. Go to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Installer.
    2. Double-click Always install with elevated privileges.
    3. Set it to Enabled.
    4. Select Apply, then OK.
    5. Go to User Configuration > Policies > Administrative Templates > Windows Components > Windows Installer.
    6. Double-click Always install with elevated privileges.
    7. Set it to Enabled.
  6. Turn on loopback processing so this user policy applies on the target computers:
    1. Go to Computer Configuration > Policies > Administrative Templates > System > Group Policy.
    2. Double-click Configure user Group Policy loopback processing mode.
    3. Select Enabled.
    4. Select Merge or Replace.
    5. Select OK.
Enable Loopback Processing
Temporary security risk

Always install with elevated privileges lets a standard user run any Windows Installer package with elevated rights. An attacker can use that setting.

Footnotes​

  1. You must apply the MST. The MST accepts the EULA. ↩ ↩2

  2. An upgrade from a Community Build to a Certified Build keeps existing Node.js installations and user preferences. The Certified Build MSI does that move. ↩