2.13.2 Distribution enforced as an automatic countermeasure for security (ITDM-compatible distribution)
The distribution function can be used to automatically distribute Windows Updates and mandatory software. It can also be used to automatically uninstall software prohibited by a security policy.
- Automatically installing Windows updates
-
When you set installation of Windows updates in a security policy, you can set installation of Windows updates as an automatic countermeasure.
When you set distribution of Windows updates as an automatic countermeasure, if Windows updates have not been installed on any computers for which the security policy is applied, Windows updates will be automatically distributed to and installed on those computers.
- Automatically installing mandatory software
-
When you set mandatory software in a security policy, you can set installation of the mandatory software as an automatic countermeasure.
When you set installation of mandatory software as an automatic countermeasure, if the mandatory software programs have not been installed on any computers for which the security policy is applied, the software programs will be automatically distributed to and installed on those computers.
However, for Windows Store apps, you can set installation for automated countermeasures but the actual installation will not be performed. If you want to install a Windows Store app, perform the operation individually on the target computer.
- Automatically uninstalling prohibited software
-
When you set prohibited software in a security policy, you can set uninstallation of the software programs as an automatic countermeasure.
When you set uninstallation of software as an automatic countermeasure, if the prohibited software programs have been installed on any computers for which the security policy is applied, the software programs will be automatically uninstalled from those computers.
Note that a software program that does not appear in the Add/Remove Programs window in Windows is not uninstalled. If you want to uninstall such a program, create an uninstallation task in the Tasks view, and execute the task. For execution of an uninstallation task, see 2.13.1 Managing packages and tasks (ITDM-compatible distribution).
For Windows Store apps, you can set uninstallation for automated countermeasures but the actual uninstallation will not be performed. If you want to uninstall a Windows Store app, perform the operation individually on the target computer.
If you set distribution of Windows updates as an automatic countermeasure when setting a security policy, the Windows Update file and task will be automatically created. In this case, the task is displayed in the Tasks view of the Distribution (ITDM-compatible) module. However, the Windows Update file is not displayed in the Packages view. You can check whether the Windows Update file has been registered in the Windows Update view of the Security module.
If you set installation or uninstallation of software, set a package when specifying a security policy. A task is automatically created. In this case, the package and task are displayed in the Packages view and Tasks view of the Distribution (ITDM-compatible) module.
The type of the task created when an automatic countermeasure is set in a security policy is Policy Based Task. A task executed as an automatic countermeasure cannot be edited or copied. Also, when you delete a task, cancel the automatic countermeasure setting, or delete the Software Use setting for the security policy. The task will be automatically deleted depending on the security policy setting.