Deploying Software via Group Policy not working

john1716 · 2014-10-07T15:54:22.000Z

This is pretty straight forward and i am out of ideas as to why this isn’t working.

I am deploying to the computer. Desktops and Laptops OUs.

I have authenticated users with read permissions to the msi.

I can go to the MSI shared folder from the target machines.

I can install from the msi using MSIEXEC.

I checked the registry folder to see if the program has been installed before, it hasn’t.

GPRESULT shows the policy being applied to the target machines.

I tried redeploying, i have also waited a day to see if just took time to update.

I have restarted target machines many times.

What am i missing?

ben · 2014-10-07T16:04:35.000Z

From a target machine can you browse to the msi file?

Is the GPO linked to the correct OU and security filtering set applied ot the machine?

Is there any Grou policy that allows the machine to load before the network is ready?

cheers

Ben

john1716 · 2014-10-07T16:27:09.000Z

Yes i can browse to the MSI.

GPO is linked to desktops and laptops and those OUs - on the target machines, gpresult shows the GPO was applied.

Not about the load, where can i check that?

georgejurcan · 2014-10-07T16:34:57.000Z

How are you actually deploying the files in the GPO? Can you post some screenshots?

overdrive · 2014-10-07T16:44:24.000Z

Check Event Viewer under the application log. What is the error for the software installation?

john1716 · 2014-10-07T16:45:32.000Z

there is no event referring to this.

overdrive · 2014-10-07T16:46:47.000Z

What OS are they running?

Have you done a gpupdate /force /sync /boot

?

overdrive · 2014-10-07T16:47:37.000Z

Dumb question (but not so dumb) - is the share on a Windows computer or a linux/unix computer using CIFS/Samba? - My main file server is OpenIndiana and I was not able to get GPO software installations to work properly when using a share off of that. Instead I decided to make a DFS share on my DC’s and use that for just GPO Software installations.

Don’t forget, it’s the computer accounts that need read access to the shares - authenticated users should be good enough, but confirm by using Effective Rights in the Advanced Security tab.

john1716 · 2014-10-07T16:52:04.000Z

Windows 7

I just tried gpupdate /force /sync /boot.

Did not work.

john1716 · 2014-10-07T16:56:19.000Z

its shared on a windows server.

I checked effective permissions against the computers. They can list read and travese

overdrive · 2014-10-07T16:57:45.000Z

look through the event viewer from startup (perhaps clear and reboot) and see what it says when the source is MsiInstaller

Run line by line

john1716 · 2014-10-07T17:17:39.000Z

i rebooted. There is no event about GPO or Application.

overdrive · 2014-10-07T17:21:04.000Z

launch cmd as admin

cd \Windows\security\database

del secedit.sdb

gpupdate /force

reboot

see if that fixes it.

john1716 · 2014-10-07T17:53:08.000Z

didn’t work.

I also removed antivirus software.

Rebooted 3 times…

overdrive · 2014-10-07T17:57:26.000Z

Do you have

Enabled:

Computer Configuration > Policies > Administrative Templates > System > Logon > Always wait for the network at computer startup and logon

Computer Configuration > Policies > Administrative Templates > System > Display highly detailed status messages

Disabled:

Computer Configuration > Policies > Administrative Templates > System > Shutdown > Require use of fast startup

overdrive · 2014-10-07T18:01:27.000Z

If that doesn’t fix it, check DC replication - is everything replicating properly?

from an administrator cmd prompt - with a user that has at least domain admin rights

repadmin /showrepl

thetj · 2014-10-07T19:39:38.000Z

Do you have the correct permissions on the file share itself? I have seen people set Domain Users as having read rights, but you need to make sure something like Authenticated Users or Everyone has read rights on your share permissions and NTFS permissions. When a computer boots up, it’s not using a domain user account.

john1716 · 2014-10-07T21:52:14.000Z

The permissions are correct.

I even added domain computers, domain user, authenticated users to all have read right.

I can browse to it no problem. I can manually install from the share too.

brianhenry2293 · 2014-10-08T08:37:41.000Z

Check rsop.msc. If it’s not in there I’d expect you’ve targeted it wrong (maybe added to the user section of the GPO and applied to a group of computers). If it’s in rsop with a yellow exclamation mark, there’ll be events in Event Viewer/Applications and Services Logs/Microsoft/Windows/Group Policy/Operational. If it was a permissions issue, there’d be events too.

john1716 · 2014-10-08T16:09:25.000Z

It doesn’t show in RSOP.
I added screen shots on the GPO.

The MSI folder is readable (share and NTFS) by everyone, authenticated users, domain computers.

gpo-details.jpg800×344 119 KB

gpo.jpg722×283 64.6 KB

…