Deliver DigiCert Trust Assistant using Group Policies

Download the DigiCert​​®​​ Trust Assistant Windows installer. See Download installer.DigiCert Trust Assistant installer

You must use the Group Policy PowerShell script runner because Group Policy software installation supports installers in the format of Microsoft Software Installer (.msi) and the DigiCert​​®​​ Trust Assistant installer is provided as a bundled binary (.exe).

Copy the following PowerShell Installer Script to the Domain Controller in your Windows domain:

The DigiCert​​®​​ Trust Assistant can be installed per machine or per user. In this section, both the methods are covered, but it is recommended to use per-machine installation when using Group Policy because the user cannot uninstall the application without local administrator privilege.

Depending on whether the installation is per machine or per user, the timing of the application's installation differs. Perform the following and check whether DigiCert Trust Assistant is installed on the computer:

The installation may take a couple of minutes to finish.

You may be asked to reboot the computer depending on the configuration.

You can also check the log output of the PowerShell Installer Script for the installation status. Check the following path for the log:

Sample log output:

2024/09/29 00:17:57 DTA not installed
2024/09/29 00:17:57 Installing DTA using \\DOMAIN-COMPUTER-1\share\DigiCert-Trust-Assistant-1.2.0-win-x64.exe
2024/09/29 00:20:05 Process finished with exitcode=0

To uninstall DigiCert​​®​​ Trust Assistant using Group Policy, you must use a different PowerShell script:

# Script to uninstall DigiCert Trust Assistant (both PerUser and PerMachine). 
# Can be used via GPO Startup/Shutdown/Logon/Logoff scripts
#
# Log from this script can be found in following locations:
#     install_type = 'user'   : %userprofile%\AppData\Local\Temp
#     install_type = 'machine': %systemdrive%\Windows\Temp

# Following is the default installation directory
$installDirPerMachine = 'C:\Program Files\DigiCert Trust Assistant'
$installDirPerUser = "$env:userprofile\AppData\Local\Programs\DigiCert Trust Assistant"

$logfile = "$env:TEMP\DigiCert-Trust-Assistant-installation.log"
function WriteLog {
    Param ([string]$LogString)
    $Stamp = (Get-Date).toString("yyyy/MM/dd HH:mm:ss")
    $LogMessage = "$Stamp $LogString"
    Add-content $LogFile -value $LogMessage
}

if (Test-Path -Path "$installDirPerMachine\DigiCert Trust Assistant.exe") {
    WriteLog "Uninstalling DTA (PerMachine)"
    $process = start-process -FilePath "$installDirPerMachine\Uninstall DigiCert Trust Assistant.exe" -ArgumentList '/S' -PassThru -Wait
    WriteLog "Process finished with exitcode=$($process.ExitCode)"
}
if (Test-Path -Path "$installDirPerUser\DigiCert Trust Assistant.exe") {
    WriteLog "Uninstalling DTA (PerUser)"
    $process = start-process -FilePath "$installDirPerUser\Uninstall DigiCert Trust Assistant.exe" -ArgumentList '/S' -PassThru -Wait
    WriteLog "Process finished with exitcode=$($process.ExitCode)"
}

Copy the above PowerShell Uninstaller Script to the Domain Controller. The configuration steps are the same as the installation, but use the different script at Step 7 and omit Step 8 because Script Parameters are not required.

The uninstall script creates a result log in the same path as the installer. Here is a sample log output for uninstallation:

2024/09/29 23:52:06 Uninstalling DTA (All users)
2024/09/29 23:52:12 Process finished with exitcode=0

For DigiCert Software KeyStore Provider, you can use the .msi Group Policy Software installation. As this requires local administrator privilege, you can use only the Computer Configuration instead of User Configuration. Follow the steps below (refer to official Microsoft documentation for more detailed information):

On the target user's computer, reboot and check if the DigiCert Software KeyStore application is installed.

On the target user's computer, reboot and check if the DigiCert Software KeyStore application is upgraded. Run the gpupdate /force command if required.

On the target user's computer, reboot and check that DigiCert Software KeyStore application is uninstalled. Run the gpupdate /force command if required.

Troubleshooting:

Sometimes the .msi file does not install and shows the following warning in the Windows Event Viewer:

The assignment of application DigiCert Software Keystore from DTA Target Machines failed. The error was: %%1274

This is usually an issue with asynchronous policy processing and can be resolved by enabling the following Group Policy, which forces the computer to wait for the network to be available before starting the installation:

Under the same GPO, navigate to Computer Configuration > Policies > Administrative Templates > System > Logon and set Always wait for the network at computer startup and logon to Enabled.