Deliver DigiCert Trust Assistant using Group Policies

Download the DigiCert​​®​​ Trust Assistant Windows installer. See Download installer.

You must use the Group Policy PowerShell script runner because Group Policy software installation supports installers in the format of Microsoft Software Installer (.msi) and the DigiCert​​®​​ Trust Assistant installer is provided as a bundled binary (.exe),

Copy the following PowerShell Installer Script to the Domain Controller in your Windows domain:  

# Script to install DigiCert Trust Assistant. Can be used via GPO Startup/Shutdown/Logon/Logoff scripts
# Usage: DTAInstall.ps1 -i installer_path [-t install_type]
#        installer_path - UNC path of installer, for example: \\DOMAIN-COMPUTER-1\share\DigiCert-Trust-Assistant-Setup-1.0.0.exe
#                         * Make sure the user or computer that runs this script has read and execute permission to this file
#        install_type   - (optional) Specify 'user' or 'machine' to indicate type of install. Default is 'user'.
#                         * Specifying 'machine' will require Local Administrator privilege 
#                         * Default target installation directory is:
#                             'user'    -- %userprofile%\AppData\Local\Programs\DigiCert Trust Assistant
#                             'machine' -- C:\Program Files\DigiCert Trust Assistant
#
# Log from this script can be found in following locations:
#     install_type = 'user'   : %userprofile%\AppData\Local\Temp
#     install_type = 'machine': %systemdrive%\Windows\Temp
Param($i,$t='user')
$logfile = "$env:TEMP\DigiCert-Trust-Assistant-installation.log"
function WriteLog {
    Param ([string]$LogString)
    $Stamp = (Get-Date).toString("yyyy/MM/dd HH:mm:ss")
    $LogMessage = "$Stamp $LogString"
    Add-content $LogFile -value $LogMessage
}
# Check installer_path
if (-not $i) {
    $msg = "-i option is required. Please specify UNC Path of the installer. For example: '-i \\DOMAIN-COMPUTER-1\share\DigiCert-Trust-Assistant-Setup-1.0.0.exe'"
    WriteLog $msg
    throw $msg
}
if (-not (Test-Path -Path $i)) {
    $msg = "$i not found, check if the file exists or permission is properly applied to user or computer."
    WriteLog $msg
    throw $msg
}
# Check install_type
if (($t -ne 'user') -and ($t -ne 'machine')) {
    $msg = "-t option needs to be either 'user' or 'machine'. Specified '$t'"
    WriteLog $msg
    throw $msg
}
# Fix below to change from default installation directory
if ($t -eq 'user') {
    $installDir = "$env:userprofile\AppData\Local\Programs\DigiCert Trust Assistant"
} else {
    $installDir = 'C:\Program Files\DigiCert Trust Assistant'
}
$install = $false
if (-not (Test-Path -Path "$installDir\DigiCert Trust Assistant.exe")) {
    $install = $true
    WriteLog "DTA not installed"
} else {
    $currentVersion = (Get-Item "$installDir\DigiCert Trust Assistant.exe").VersionInfo.FileVersion
    $newVersion = (Get-Item $i).VersionInfo.ProductVersion
    if ($currentVersion -ne $newVersion) {
        $install = $true
        WriteLog "DTA current version=$currentVersion, upgrading to $newVersion"
    }
}
if ($install) {
    WriteLog "Installing DTA using $i"
    $dArg = '/D="' + $installDir + '"'
    if ($t -eq 'user') {
        $process = start-process -FilePath $i -ArgumentList '/S',$dArg,'--force-run' -PassThru -Wait
    } else {
        $process = start-process -FilePath $i -ArgumentList '/S','/AllUsers',$dArg -PassThru -Wait
    }
    WriteLog "Process finished with exitcode=$($process.ExitCode)"
}

The usage of the script is described at the top of the script.

The DigiCert​​®​​ Trust Assistant can be installed per machine or per user. In this section, both the methods are covered, but it is recommended to use per-machine installation when using Group Policy because the user cannot uninstall the application without local administrator privilege.

2024/09/29 00:17:57 DTA not installed
2024/09/29 00:17:57 Installing DTA using \\DOMAIN-COMPUTER-1\share\DigiCert-Trust-Assistant-1.2.0-win-x64.exe
2024/09/29 00:20:05 Process finished with exitcode=0

To update DigiCert​​®​​ Trust Assistant using the group policy, reuse the same GPO as the one used from the installation procedure, but additionally perform the following:

To uninstall DigiCert​​®​​ Trust Assistant using Group Policy, you must use a different PowerShell script:

# Script to uninstall DigiCert Trust Assistant (both PerUser and PerMachine). 
# Can be used via GPO Startup/Shutdown/Logon/Logoff scripts
#
# Log from this script can be found in following locations:
#     install_type = 'user'   : %userprofile%\AppData\Local\Temp
#     install_type = 'machine': %systemdrive%\Windows\Temp

# Following is the default installation directory
$installDirPerMachine = 'C:\Program Files\DigiCert Trust Assistant'
$installDirPerUser = "$env:userprofile\AppData\Local\Programs\DigiCert Trust Assistant"

$logfile = "$env:TEMP\DigiCert-Trust-Assistant-installation.log"
function WriteLog {
    Param ([string]$LogString)
    $Stamp = (Get-Date).toString("yyyy/MM/dd HH:mm:ss")
    $LogMessage = "$Stamp $LogString"
    Add-content $LogFile -value $LogMessage
}

if (Test-Path -Path "$installDirPerMachine\DigiCert Trust Assistant.exe") {
    WriteLog "Uninstalling DTA (PerMachine)"
    $process = start-process -FilePath "$installDirPerMachine\Uninstall DigiCert Trust Assistant.exe" -ArgumentList '/S' -PassThru -Wait
    WriteLog "Process finished with exitcode=$($process.ExitCode)"
}
if (Test-Path -Path "$installDirPerUser\DigiCert Trust Assistant.exe") {
    WriteLog "Uninstalling DTA (PerUser)"
    $process = start-process -FilePath "$installDirPerUser\Uninstall DigiCert Trust Assistant.exe" -ArgumentList '/S' -PassThru -Wait
    WriteLog "Process finished with exitcode=$($process.ExitCode)"
}

Copy the above PowerShell Uninstaller Script to the Domain Controller. The configuration steps are the same as the installation, but use the different script at Step 7 and omit Step 8 because Script Parameters are not required.

The uninstall script creates a result log in the same path as the installer. Here is a sample log output for uninstallation:

2024/09/29 23:52:06 Uninstalling DTA (All users)
2024/09/29 23:52:12 Process finished with exitcode=0

On the target user's computer, reboot and check if the DigiCert Software KeyStore application is upgraded. Run the gpupdate /force command if required.

On the target user's computer, reboot and check that DigiCert Software KeyStore application is uninstalled. Run the gpupdate /force command if required.

Troubleshooting:

Sometimes the .msi file does not install and shows the following warning in the Windows Event Viewer:

The assignment of application DigiCert Software Keystore from DTA Target Machines failed. The error was: %%1274

This is usually an issue with asynchronous policy processing and can be resolved by enabling the following Group Policy, which forces the computer to wait for the network to be available before starting the installation:

Under the same GPO, navigate to Computer Configuration > Policies > Administrative Templates > System > Logon and set Always wait for the network at computer startup and logon to Enabled.