Can I install windows built-in features and roles through group policy? If there is not a way to do this with group policy, is there some other method to this unattended to a bunch of servers that have already been deployed?
In this particular case I am interested in SNMP, but I will probably want to do this for other roles and features down the road.
One way to do it would be using a startup script. Windows 2008 was designed to be maintained from the command line and has tools to add roles and features
See: Installing Windows Features on a server running a Server Core installation of Windows Server 2008 R2
I haven't tested, but it looks like the command you would need is Dism /online /enable-feature /featurename:SNMP.
Theis page might be useful since it covers the registry settings you might want to make to configure it.
You can add/remove roles via PowerShell cmdlet and command line - http://technet.microsoft.com/en-us/library/cc732263.aspx.
To do so via group policy use start up scripts.
You can also use pkgmgr with an unattend file to install a role with a customised set of sub-ordinate features:
pkgmgr /n:\\somesserver\someshare\unattend\IISUnattend.xml The unattend file looks something like:
<?xml version="1.0"?> <unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"> <servicing> <package action="configure"> <assemblyIdentity name="Microsoft-Windows-Foundation-Package" version="6.0.6001.18000" language="neutral" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" versionScope="nonSxS" /> <selection name="IIS-WebServerRole" state="true"/> <selection name="IIS-WebServer" state="true"/> <selection name="IIS-CommonHttpFeatures" state="true"/> <selection name="IIS-StaticContent" state="true"/> <selection name="IIS-DefaultDocument" state="true"/> <selection name="IIS-DirectoryBrowsing" state="true"/> <selection name="IIS-HttpErrors" state="true"/> <selection name="IIS-HttpRedirect" state="true"/> <selection name="IIS-ApplicationDevelopment" state="true"/> <selection name="IIS-ASPNET" state="true"/> <selection name="IIS-NetFxExtensibility" state="true"/> <selection name="IIS-ASP" state="true"/> <selection name="IIS-CGI" state="true"/> <selection name="IIS-ISAPIExtensions" state="true"/> <selection name="IIS-ISAPIFilter" state="true"/> <selection name="IIS-ServerSideIncludes" state="true"/> <selection name="IIS-HealthAndDiagnostics" state="true"/> <selection name="IIS-HttpLogging" state="true"/> <selection name="IIS-LoggingLibraries" state="true"/> <selection name="IIS-RequestMonitor" state="true"/> <selection name="IIS-HttpTracing" state="true"/> <selection name="IIS-CustomLogging" state="true"/> <selection name="IIS-ODBCLogging" state="true"/> <selection name="IIS-Security" state="true"/> <selection name="IIS-BasicAuthentication" state="true"/> <selection name="IIS-WindowsAuthentication" state="true"/> <selection name="IIS-DigestAuthentication" state="true"/> <selection name="IIS-ClientCertificateMappingAuthentication" state="true"/> <selection name="IIS-IISCertificateMappingAuthentication" state="true"/> <selection name="IIS-URLAuthorization" state="true"/> <selection name="IIS-RequestFiltering" state="true"/> <selection name="IIS-IPSecurity" state="true"/> <selection name="IIS-Performance" state="true"/> <selection name="IIS-HttpCompressionStatic" state="true"/> <selection name="IIS-HttpCompressionDynamic" state="true"/> <selection name="IIS-WebServerManagementTools" state="true"/> <selection name="IIS-ManagementConsole" state="true"/> <selection name="IIS-ManagementScriptingTools" state="true"/> <selection name="IIS-ManagementService" state="true"/> <selection name="IIS-IIS6ManagementCompatibility" state="true"/> <selection name="IIS-Metabase" state="true"/> <selection name="IIS-WMICompatibility" state="true"/> <selection name="IIS-LegacyScripts" state="true"/> <selection name="IIS-LegacySnapIn" state="true"/> <selection name="WAS-WindowsActivationService" state="true"/> <selection name="WAS-ProcessModel" state="true"/> <selection name="WAS-NetFxEnvironment" state="true"/> <selection name="WAS-ConfigurationAPI" state="true"/> </package> </servicing> </unattend> I used WAIK's Windows System Image Manager to help create the unattend file. Again, this would need to be included in a startup script.
