How To: Bulk Install, Upgrade, and Reconfigure Login for Windows via Group Policy

Version Affected: 9.2 and later

 

Overview

This article explains how to deploy, upgrade, and reconfigure Login for Windows (L4W) in bulk using Active Directory Group Policy, instead of installing or updating it on each machine by hand.

• Use Method 1 for an initial bulk deployment.
• Use Method 2 to upgrade or reconfigure machines that already have Login for Windows deployed.

In this article

• Method 1: Initial Bulk Deployment
• Method 2: Upgrading or Reconfiguring an Existing Deployment

Method 1: Initial Bulk Deployment

1. Configure a realm to accept Login for Windows connections and create a Login for Windows configuration file, following the configuration guide for your SecureAuth version:
   • 9.2 / 9.3: Login for Windows Configuration Guide
   • 19.07.01 / 20.06: Login for Windows Configuration Guide
   • 21.04: Configure Identity Platform and Login for Endpoints
   • 22.02: Configure Identity Platform and Login for Endpoints
   • 22.12: Configure Identity Platform and Login for Endpoints
   • 23.07: Configure Identity Platform and Login for Endpoints
   • 24.04: Configure Identity Platform and Login for Endpoints
2. Download Login for Windows from SecureAuth's product downloads page.
3. Create a network share to hold the Login for Windows installer and the configuration file created in step 1. Grant Read access to every user who needs it, and confirm you can reach the share and see both files from a client machine.

4. (Optional, but strongly recommended) On a client computer, browse to the network share and double-click the SecureAuthLogin....msi file to confirm the package installs successfully, and that users are prompted for MFA as expected after installing.
5. Once the manual installation works as expected, create a Software Installation deployment in Active Directory Group Policy — this step needs to be carried out by whoever has the required Active Directory permissions. Microsoft's own documentation on this is at Use Group Policy to install software. As an example:
   • Create or edit a Group Policy Object (GPO) to install Login for Windows, and link it to the Organizational Unit (OU) containing the computer objects that should receive it.
   • In the GPO, go to Computer Configuration > Policies > Software Settings > Software Installation.
   • Right-click, choose New > Package, and provide the UNC path to the installer in the network share — for example, \\dc\L4E\SecureAuthLogin-22.12.00-x64.msi. Do not browse to the file and double-click it.
   • Click OK, then close the Group Policy Management Editor.

The application installs on any computer in the linked OU the next time that computer restarts on the domain network.

 

Method 2: Upgrading or Reconfiguring an Existing Deployment

Use Group Policy again, but have the new deployment package overwrite and replace the existing one — this ensures the old package is removed at the same time the new package or configuration is applied.

1. Create a new folder in the same network share used for the initial deployment, and place the new installer and configuration file in it. For a reconfiguration only, copy the same installer version alongside the new configuration file instead.

2. Open the GPO created in Method 1 and go to Computer Configuration > Policies > Software Settings > Software Installation.
3. Right-click, choose New > Package, and provide the UNC path to the installer in the new folder — for example, \\dc\l4e\UpdatedConfiguration01\SecureAuthLogin-22.12.00-x64.msi.
4. Choose Assigned and click OK.
5. Right-click the old deployment package, select All Tasks > Remove..., and on the Remove Software window select Immediately uninstall the software from users and computers — see Special Considerations below before doing this.

6. Close the Group Policy Management Editor.
7. Restart the affected computers while they are on the domain network, so the Group Policy change takes effect.

Special Considerations

Like any Group Policy change, this only takes effect once a machine is on the domain network and can reach a domain controller — a machine that already has an old package or configuration keeps using it until it next contacts a domain controller.

Making changes in Active Directory can be extremely harmful on a company-wide scale. If you are unsure about any part of the Group Policy setup, contact Microsoft or your internal Active Directory team for expert help before proceeding.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.