Deploying VNC via Group Policy


VNC isn’t packaged as an MSI, and so it’s a little tricky to deply via Group Policy - however it’s not impossible. Here’s how to do it…

  1. Grab http://www.bozteck.com/Downloads/realsilent.zip and extract to \\servername\clientapps\RealVNC 
  2. Ensure that Domain Computers (or a group containing all domain computers, such as Authenticated Users) has access to the share / folder 
  3. Replace the contents of the .reg file with the following (need to replace the password with your preferred password in hex - the easiest way to get this is to install it yourself, set the password and then grab it from the registry)
    Windows Registry Editor Version 5.00
    [HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4]
    "Password"=hex:<password in hex>
    "SecurityTypes"="VncAuth"
    "ReverseSecurityTypes"="None"
    "QueryConnect"=dword:00000000
    "QueryOnlyIfLoggedOn"=dword:00000000
    "PortNumber"=dword:0000170c
    "IdleTimeout"=dword:00000e10
    "HTTPPortNumber"=dword:000016a8
    "LocalHost"=dword:00000000
    "Hosts"="+," 
  4. Create a file in the directory called install.bat, and insert the following (adjust to suit your environment)
    @echo off
    cls
    :checkifinstalled
    if exist "%programfiles%\RealVNC\VNC4\vnc_installed.txt" (goto end) else (goto installvnc)
    :installvnc
    \\sbs-svr\clientapps\RealVNC\RealSilent.exe
    date /t > "%programfiles%\RealVNC\VNC4\vnc_installed.txt"
    :end 
  5. Now, create a GPO, and add the aforementioned install.bat as a Computer Startup Script (as opposed to a login script. A startup script won’t require users to have local admin permissions). 
  6. Add the GPO to your OU(s) containing all PC’s 
  7. And finally, modify your Group Policy to allow RealVNC through the firewall when using the Domain Profile. This setting can be found here on an SBS Server:
    ComputerConfig => Administrative Templates => Network => Network Connections => Windows Firewall => Domain Profile => Windows Firewall: Define Port Exceptions
    Enable this policy, and add the following:
    5900:TCP:*:Enabled:RealVNC - Port

2 Comments

  1. Comment by fariszainal on February 4, 2009 1:52 am

    hi, i tried ur method to deploy Realvnc via AD. but instead of deploying VNC, it prompting that it detected for a file named as program, and then recreated that files again.

  2. Comment by birdman on February 4, 2009 8:40 am

    Try it now instead… I missed a couple of “’s - and it was creating a file called c:\Program instead of %programfiles%\RealVNC\VNC4\vnc_installed.txt

    Thanks for the heads up. :)

Comments RSS TrackBack Identifier URI

Leave a comment

You must be logged in to post a comment.


Birdman’s Blog is proudly powered by WordPress and themed by Mukka-mu