In this article

Deploy the Windows Roaming Client to many computers at once with Group Policy in Active Directory Domain Services (AD DS).

Deploying the Roaming Client through Active Directory makes it easier to set policies for different user groups, such as executives and employees, or faculty and students. Integrate Active Directory Organizational Units (OUs) with the DNSFilter Sync Tool to apply policies quickly, and add a blanket network policy by setting up DNS Forwarding on the domain controller.

Active Directory deployment uses a Group Policy Object (GPO). A Microsoft Transform (MST) file adds any of the additional command-line options from the silent install article to the installer. This deploys the Roaming Client with preset tags, a shown or hidden tray icon, and an association with a specific network location (Site).

After deployment, manage Roaming Client settings such as tags, Site, Filtering Policies, and Block Pages. Assign settings to individual Roaming Clients or to groups to keep filtering policies as specific as the environment requires.

Deploy the Roaming Client with Group Policy

The installation procedure follows the standard method for installing software with Group Policy. The following video walks through this process.

This video was produced in 2019 and is technically accurate, but the app design and the location of some of these functions have changed.

Step one: Download the Roaming Client installer

1. From the DNSFilter dashboard, navigate to Deployments and select Roaming Clients.
2. Select Install Roaming Client.
3. Download the DNSFilter Windows installer.

Step two: Generate an MST file in Orca

Download the Orca tool for free from the Windows SDK.

Any line labeled SETCMD in the MST file can be changed, but most of these values are easier to customize in the DNSFilter dashboard than in Orca.

Keep the MST file as widely applicable as possible, and customize settings in the dashboard. Hardcoding too many values in the MST file increases deployment complexity in Active Directory.

If possible, generate only one MST file per location (Site) registered with DNSFilter.

1. In Orca, open the MSI file (the Windows installer).

2. Navigate to Tables and select Custom Actions. 

   The SETCMD entries in this table correspond to the command-line options.

3. Select Transform.
4. Select New Transform.
5. Enter the Site Secret Key:
   1. Return to the Roaming Clients install tab in the DNSFilter dashboard.
   2. Select a Site to associate with the deployment.
   3. Copy the Site Secret Key.
   4. Return to the transform file in Orca.

   5. Paste the Site Secret Key in the SETCMD NKEY line. 

      Edited fields turn green to show the change.

6. Update any additional command-line options as needed. 

   Use tags as a command-line option that match the user groups in Active Directory, such as Sales or Engineering. The DNSFilter dashboard then reflects the same structure as the Active Directory environment.

7. Select Transform.
8. Select Generate Transform.
9. Save the file and exit Orca.

Step three: Create a network share

A network share is required to distribute MSI files in Active Directory. If a network share is already set up, skip this step.

1. From the Windows Server, open Server Manager.
2. Navigate to File and Storage Services.
3. Select Shares.
4. From the Tasks dropdown menu, select New Share.

5. Select Next until Specify Share Name. 

   Note the Local Path. Step four uses this path.

6. Name the share.
7. Select Next until the end of the wizard.

Step four: Move the MSI and MST files to the network share

1. From the Downloads folder, cut the MSI and MST files.
2. Navigate to the network share's Local Path.
3. Paste the files.

Step five: Create the Group Policy Object

1. Navigate to Server Manager.
2. Select Tools.
3. Select Group Policy Management.
4. Select the OU that contains the target computers.
5. Right-click and select Create new GPO.
6. Name the new GPO.

Step six: Edit the Group Policy Object

1. Navigate to Policies and select Software Settings.
2. Select Software installation.

3. Right-click and select New Package. 

   A prompt for the MSI file opens.

4. Navigate to the network share and open the MSI file.
5. Under deployment method, select Advanced.
6. Select OK.
7. Navigate to Modifications.
8. Select Add.
9. Add the MST file.

During the next policy refresh, the Roaming Client completes a silent deployment across the OU, along with the certificate file for HTTPS Block Pages. The Roaming Client registers with DNSFilter and begins filtering and logging DNS query traffic in the DNS Query Log.

Related content

• Install Windows Roaming Client
• Windows Roaming Client Silent/Remote tool Install