Deploying MSI Packages via Group Policy

No. Unless it was the fastest SP2 install I've ever seen, it isn't installed. System properties also refllect the OS is only at SP1

eh, SP2 seems to cause more problems than fix
our new policy is not to install office xp sp2 :(

DVation,

Did you choose to "Assign" or "Publish" the MSI package?  Here are the key points that I can think of:

- Is the Package setup correctly or not?  That includes the "Auto Install"
- Is the package available to the client over UNC?  Is the path to the package defined as UNC or regular path in GPO?
- Is the client in the correct OU that has the GPO assigned to?
- Does the isntallation even start?  It's possible that it starts but then it fails.  You could probably create a verbose output in the setup to test this one.

JM

I've disabled Fast Logon Optimization through group policy to eliminate that possibility. I granted full read/write permissions to the share and the gpo for the time being to eliminate the possibility of it being a permissions issue. I have also left only the machine account in the testing OU. I removed the user account to avoid any conflicts.

I ran gpupdate /force  on the client. The command completed sucessfully. Upon reboot, nothing happened.

I am going to see what I can find out from the GPMC. In the meantime I'm open to more suggestions.

DVation,

Try to create some new setting in the same GPO, for instance to "Run these programs at user login" and have it run a CMD.exe for example.  Do the secedit thing to enforce your GP changes and reboot.  If CMD starts up, then we know that it's either bad package, bad path, or something other than GPO is just not running.

I try to eliminate what I can in troubleshooting to easily figure out where to look.

Let us know.

JM

"Did you choose to "Assign" or "Publish" the MSI package? "
Per the MS document I was reading, I choose "Assign" ...should the be "Publish" ? What's the difference?

"Is the Package setup correctly or not?  That includes the "Auto Install"
I am using the Update.msi that came with XP SP2. I don't know what you are referring to when you say "Auto Install". I know there are parameters I can pass an .msi file to make an install silent, but I have no idea how to do this when deployed via group policy. That was going to be something I was going to tackle once I got this working :)

"Is the package available to the client over UNC?  Is the path to the package defined as UNC or regular path in GPO?"
From the client I can access the share using the UNC, that is correct. The GPO had the UNC define, not the local path. I was warned about that in the documentation I was reading and was careful about that.

"Is the client in the correct OU that has the GPO assigned to?"
I right-click the Test OU and go to properties, then edit the group policy tab. This Test OU has the one machine account I am traying to make this work on. So to answer your question...I think so :)

"Does the isntallation even start?  It's possible that it starts but then it fails.  You could probably create a verbose output in the setup to test this one."
If it starts, it fails too quickly for me to even tell.

" Try to create some new setting in the same GPO, for instance to "Run these programs at user login" and have it run a CMD.exe for example. "

I don't know if I did this right, in the GPE
User Configuration > Admin Templates > System > Logon/Logoff > Run these programs at user login > enabled
I added C:\WINDOWS\SYSTEM32\cmd.exe
I forced a refresh on the client and rebooted. CMD.EXE did *not* show up.

I'd like to add that the GPO for the domain (Default Domain Policy) *is* working because my firewall settings and automatic update settings are unchangable and managed by group policy. So I know my domain policy is working...but I can't get this policy for this particular OU working. Maybe I did something wrong in creating it?

I right clicked domain.local in AD Users and Computers, went to New > Organizational Unit
I called it "Test Environment". I then found the computer I was testing  in the Computers OU and right clicked it, choose "Move..." and moved it to the new OU. To edit it's GP, I right click the new OU, go to properties, Group Policy tab, then I added the default policy and edit from there. Hopefully this will help you experts diagnose my problem here! Thanks for all the effort so far!

Bingo.  We have a thread now.  We know that this GPO is not being applied.  Before we go any further, do you happen to have multiple domain controllers?  It's likely in that case that you're authenticating to the other DC which does not have the changes replicated to it yet.  If you don't, then it can't be that.  Go to command prompt on this client and do
ECHO %LOGONSERVER%
it should display the name of the domain controller you're logging on to.  It's worth a shot.

No, there is one one DC.

"No, there is only one DC"

I don't really know how inheritance works...could that have something to do with it? There is an option to block inheritance although I don't think I want to do that because then the client would not get all the other domain-wide policies applied.

Also,
"Did you choose to "Assign" or "Publish" the MSI package? "
Per the MS document I was reading, I choose "Assign" ...should the be "Publish" ? What's the difference?

Assign will let execute the isntallation package upon login.  Publish will place it in the Add/Remote Programs under the Add New Programs list.  That is the reason I asked if you saw it there, but you answered no, so you assigned it which is the right thing to do.

We can tell that the entire GPO is not being executed for some reason.  That's why I asked you to test running the CMD file in the same GPO.  We know it's not the "Package" but it's the GPO itself.

Let's try to block inheritance.  It could possibly be something in the domain wide GPO that's causing this not to run.  It's worth a shot since we're playing around on a test machine and not domain wide.

I have something interesting here. I ran the GPMC on the client. It turns out that the OU Policy is being denied.

Name: {049E9C8D-A22D-4C55-A610-F3FF061AD957}
Link: domain.local/Test Environment
Location:
Reason Denied: Inaccessible

So the question is, why is the GP inaccessible and how do I fix it?

I think I got it... I went to the properties og the GPO and added the computer name with full permissions. When I ran the gpupdate /force on the client, it actually said it needed to reboot to apply the settings (it hadn't done that unitl now)...i think that may have done the trick...ill let you know how it goes!

Holy Sh*t it's working! lol
Before I could even log on....XP is showing me a window...
"Installing managed software Windows XP Service Pack 2 (1033)"

Its working! Now I need to figure out what permissions I can make just read only so this works without full permissions.

Right On!

Read Only to the folder should work.  Glad to hear it's working for ya now.

JM

SP2 installed but interestingly enough, cmd.exe didn't run. I think I know why though...because it was configured under "User Configuration" and the only object in the OU was a computer account right?

Alright, well anyway...thanks for all your help jmelika. I have to award Debsyl99 some points too since the GPMC is what tipped me off. Thanks to both of you!