5 Ways to Troubleshoot Group Policy Software Deployment

Published on
8,618 Points
2 Endorsements
Last Modified:
Group Policy Software Installation (GPSI) is an effective (and free) way to manage software deployment. While it may not have the bells and whistles of System Center or APP-V, it gets the job done! Like anything made by man, it can have problems. Let's walk through the top five issues and the solutions to a fix them!

Problem 1: Does the GPO apply?

If the software isn't installing on the computer, the first place to start is at the scope tab of your GPO. Basically, if the GPO can't apply to the computer (or user) - the application won't install. You can ensure the GPO is applying by running a GPResult on that computer and ensuring that the GPO applied and that the application appears under Software Installation.

Our Applied MSIsIf the software doesn't appear, take a look at The Top 10 Ways to Troubleshoot Group Policy.. One special note about software deployment. If you deploy the software to the user side (assigned or published), the GPO must be linked to an OU containing users (or you have to enable loopback).

Also remember that GPSI applies in the foreground. Installation can only happen on a reboot or logon (and only if the GPO was downloaded beforehand). In a default environment, it is easiest just to reboot twice. If you want to turn this into a single reboot, you can enable "Always Wait on the Network at Computer Startup or Logon". Be aware that this will slow down startups/logons.

Problem 2: Does the software install quietly?

For an MSI to deploy through GPSI, it must be able to install silently. To test this, you only need MSIEXEC! To test quietly, here is your syntax:


and here is a practical example:

Running MSIEXECAfter the installation progress bar has completed (and MSIEXEC.exe has terminated in the Task Manager), you should be able to launch your application through any created shortcuts. If the application errors out during install, you most likely need to specify additional options in your MST file. An example of this would be Adobe Photoshop Elements. If you do not include the serial number in the install, it can't be deployed through GPSI.

Problem 3: Where is the MSI?

As a best practice, do not store your MSIs in Sysvol. While it may look like a great way to create redundancy, it is going to be a management nightmare.  Instead, set up a dedicated file server (or better yet - use DFS!) and organize your MSI structure. For our environment, we organize the MSIs by manufacturer - then product - then version. This vertical hierarchy allows us to easily find (or update) any piece of software.

The second point to consider is how you load the MSI into Group Policy. Whenever possible, use a DFS Namespace (first choice) or a UNC path (second choice) over an IP. IPs can change (though you should be using a reservation).

 Notice our deployment source
Problem 4: Can X access the MSI?

So even though your software is compatible, your users/computers that need to install this software might not be able to reach it. Take a look at the share and file/folder permissions where the MSI is located. If you are deploying to a computer, that computer needs Read/Execute. The same thing applies to a user. In our environment, we actually grant authenticated users read/execute to the share and root folder. This ensures that every deployed MSI always have the correct permissions.

Problem 5: Where are the logs?

If you've made it this far, you likely have an installation issue. This can be caused by a misconfigured machine, an old piece of software breaking the upgrade, or a missing component. Lucky for us, GPSI does a decent job logging these kind of issues. Open up event viewer on the troublesome machine and selection the system log. Filter the log to show any issues by Application Management Group Policy (the source) and to only show Warnings and Errors.

 GPSI Warning
As you can see from the error above, GPSI couldn't install this software until another logon has occurred. If you receive any strange MSI errors - just do a quick search on Experts-Exchange or AppDeploy for that error (ex: 1204) plus MSI. Because these error codes are consistent across nearly all MSIs, you don't really need to search for your specific product.

As a final note, if you have any other GPSI troubleshooting tips or anything else to add - just leave me a comment!

This article first appeared on DeployHappiness.

Featured Post

Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

Join & Write a Comment

This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

Keep in touch with Experts Exchange

Tech news and trends delivered to your inbox every month