Deploy Omitly with Group Policy

This is for the person rolling Omitly out to a Windows fleet, not the person installing it on one machine — see Install Omitly on Windows for that. It’s written against what the current Windows build actually does, not what a GPO-based deployment ideally would do, so it says plainly where Group Policy’s usual tooling doesn’t apply yet.

GPO Software Installation isn’t available

Group Policy’s built-in Software Installation extension only assigns or publishes .msi packages. Omitly for Windows ships as a single NSIS installer (Omitly_<version>_x64-setup.exe) — the release pipeline actively fails the build if an .msi artifact ever appears in it, so there is no MSI for a Software Installation policy to target. If your rollout specifically needs that mechanism, there’s nothing below that substitutes for it. An MSI is available on request: ask support, saying roughly how many machines and that the deployment is Group Policy Software Installation. A requested MSI is a different build from the installer above — per-machine, with the in-app updater off (your own patch cycle applies) and the WebView2 runtime embedded — and it is hand-built and signed for that request rather than published for download.

Three GPO-native alternatives do work with the installer Omitly actually ships, covered below.

Silent install: logon script or a GPP scheduled task

The installer supports the standard NSIS silent switch:

\\fileserver\share\Omitly_<version>_x64-setup.exe /S

That runs unattended with no Omitly dialogs and no reboot. One exception: if the machine doesn’t have the Microsoft Edge WebView2 Runtime yet, the installer downloads and runs Microsoft’s WebView2 installer, and that shows its own progress window even under /S. Windows 11 already includes WebView2, so this mostly affects older Windows 10 machines — see WebView2 prerequisite below.

The installer is per-user, not machine-wide — bundle.windows.nsis.installMode is currentUser, so it installs into the current user’s own profile, not Program Files. That rules out the workaround GPO admins usually reach for in place of MSI Software Installation: a computer startup script runs as SYSTEM, and running a per-user installer as SYSTEM puts Omitly in SYSTEM’s own profile — not the profile of whoever actually logs in, so nobody ends up with a working install. Use a user-scoped delivery method instead:

• A user logon script (Group Policy → User Configuration → Windows Settings → Scripts → Logon) running the /S command above, or
• A Group Policy Preferences (GPP) Scheduled Task, targeted at the user and set to run once, pointing at the same command.

Either way the install runs in the logged-in user’s own context, which is what the per-user installer expects.

Licence delivery via Group Policy Preferences

The desktop app looks for its licence in two places, checked on every launch:

1. %LOCALAPPDATA%\com.omitly.app\license.json — the licence already activated for this user;
2. %USERPROFILE%\.omitly\omitly.license — an import inbox. Put a licence file here and Omitly verifies it on the next launch; it works from that launch on, and Omitly offers to import it into its own folder.

For a GPO-managed rollout, use a GPP Files item that copies the licence file from your purchase email to %USERPROFILE%\.omitly\omitly.license for each targeted user (User Configuration → Preferences → Windows Settings → Files). Omitly does the rest on launch — no editing JSON, no touching the registry.

The inbox is only read when there is no licence in the first location. If license.json is there but no longer valid — an expired term licence, say — Omitly stops at it and never looks in the inbox, so dropping a renewal into the inbox does nothing on that machine. To renew, import the new file from Import licence file… in Omitly’s About window, or remove the old license.json so the inbox is read on the next launch.

Beta builds keep their state separately, under %LOCALAPPDATA%\com.omitly.app.beta.

The OMITLY_LICENSE_FILE environment variable you may see in Omitly’s documentation applies only to its command-line and MCP tools. The desktop app ignores it, so don’t deliver the licence that way.

There is no registry-based claim-token or managed-configuration lookup in the shipped app today — no HKLM\SOFTWARE\Omitly\... key is read by anything Omitly installs, so don’t design a rollout around one. A managed, machine-scope licence lane for MDM/fleet deployments is an open design decision, not something the current build supports (tracked as decision D4 in the project’s licence-resolution spec).

WebView2 prerequisite

The installer fetches the Microsoft Edge WebView2 Runtime from Microsoft at install time if it isn’t already present on the machine. If that download or install fails, the Omitly installation stops and Omitly is not installed — and under /S nothing on screen says so. On a network that blocks outbound access to Microsoft’s update infrastructure, that means failed installs at scale. Two ways around it:

• Pre-stage WebView2 on the fleet through your normal channels (an Evergreen Standalone install, or via Intune/Configuration Manager) before running the Omitly installer, so the bootstrapper finds the runtime already present and skips the download — or
• Allowlist the WebView2 Evergreen Bootstrapper traffic. Microsoft’s own WebView2 enterprise deployment documentation lists the current hosts to allow; check it directly rather than relying on a list here, since Microsoft changes these from time to time.

If your network can’t be opened up at all, ask support about the offline installer variant, which embeds the WebView2 Evergreen Standalone runtime so no network access is needed at install time.

Device-bound licences (optional)

Licence binding is off by default — most Omitly licences are portable and need nothing device-specific. If your firm has specifically requested a device-bound licence, Omitly ties it to a one-way fingerprint of this machine’s MachineGuid (the value under HKLM\SOFTWARE\Microsoft\Cryptography, lowercased with any surrounding braces stripped, then hashed).

To request one, send the Device ID shown in Omitly’s About window for each target machine — that is the fingerprint, not the GUID. The raw MachineGuid never needs to leave the machine. To check for duplicate GUIDs across an image (see below), you can read it with reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid.

Golden-image and VDI caveat. MachineGuid is only as unique as your imaging pipeline. Machines cloned from an un-sysprepped golden image share one GUID — a licence bound to it works across every clone in the pool rather than being tied to one seat — and non-persistent VDI pools can churn the GUID per session, breaking an otherwise-valid binding repeatedly. Device binding is the wrong tool for VDI or golden-image fleets; use the default portable licence there instead.

Network posture

For your security review: every step above that touches a licence — resolving, verifying, importing — runs entirely locally. There’s no periodic check-in, no licence heartbeat and no remote kill switch built into any of it. The desktop app never checks for updates on its own; it connects to check only when someone clicks Check for updates, and it can reach a support endpoint from in-app support. Trusted timestamping is opt-in: if someone turns it on for a redaction or a signature, Omitly sends a 32-byte hash of the output — never its content — to the timestamp server they chose, so allow that server if your users will use it. In every case your document and its contents never leave the machine. See Where does your PDF go? for the full picture.

What this doesn’t resolve

Machine-wide installation as a published download. The per-machine MSI exists only on request (above); it becomes a standing, downloadable build once more than one firm asks for it, and this article will be revised when that happens. Everything else here documents what the shipped Windows build supports today.