Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1082
  • Last Modified:

Deploying MSI Packages via Group Policy

I'm trying to to deploy XP SP2 through group policy.
Following the instructions here...
Guide for Installing and Deploying Microsoft® Windows® XP Service Pack 2
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/spdeploy.mspx

..it explains how to do this. I extracted the network install of SP2. I put it on a shared folder on the DC. I built a new OU called Test Environment and put a user and their machine account in there. I built a new group policy under the "Computer Configuration" part of the GPE and pointed to the network path of the Update.msi. Once I had that set up I ran SECEDIT /REFRESHPOLICY to propogate the policy through the domain. I went to the machine I am using to test it with and rebooted a few times...nothing is happening. What am I missing here?
0
DVation191
Asked:
DVation191
2 Solutions
 
jmelikaCommented:
If you go to Add/Remove Programs, does it show up under Add New Programs?
0
 
DVation191Author Commented:
No. Unless it was the fastest SP2 install I've ever seen, it isn't installed. System properties also refllect the OS is only at SP1
0
 
ViRoyCommented:

eh, SP2 seems to cause more problems than fix
our new policy is not to install office xp sp2 :(
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
Debsyl99Commented:
Hi

Download and install the GPMC on an XP client (It will work on an XP SP1 client with .net framework installed and will work on a pure 2000 server based domain) - It will tell you what policies are being applied, what aren't and any issues and is generally massively useful for administering group policy and it's results. You also need to make sure that Domain Computers have permissions to access the network share containing the MSI, and you also need to make sure that Domain Computers have read and apply rights on the group policy object. You don't need a user in there I don't think as this is a assigned to a machine, and on the policy itself it may help to disable the user configuration part as this can sometimes conflict. You'll also need to make sure the policy for "Always wait for the network at startup and logon" is configured on the workstations, as the fast logon optimisation feature can cause policy not to apply,

Once all this is set, from the XP workstation type this from a command prompt - gpupdate /force - It should then prompt for a reboot,

Description of the Windows XP Professional Fast Logon Optimization Feature
http://support.microsoft.com/default.aspx?scid=kb;en-us;305293
Enterprise Management with the Group Policy Management Console
http://www.microsoft.com/windowsserver2003/gpmc/default.mspx

Deb :))
0
 
jmelikaCommented:
DVation,

Did you choose to "Assign" or "Publish" the MSI package?  Here are the key points that I can think of:

- Is the Package setup correctly or not?  That includes the "Auto Install"
- Is the package available to the client over UNC?  Is the path to the package defined as UNC or regular path in GPO?
- Is the client in the correct OU that has the GPO assigned to?
- Does the isntallation even start?  It's possible that it starts but then it fails.  You could probably create a verbose output in the setup to test this one.

JM
0
 
DVation191Author Commented:
I've disabled Fast Logon Optimization through group policy to eliminate that possibility. I granted full read/write permissions to the share and the gpo for the time being to eliminate the possibility of it being a permissions issue. I have also left only the machine account in the testing OU. I removed the user account to avoid any conflicts.

I ran gpupdate /force  on the client. The command completed sucessfully. Upon reboot, nothing happened.

I am going to see what I can find out from the GPMC. In the meantime I'm open to more suggestions.
0
 
jmelikaCommented:
DVation,

Try to create some new setting in the same GPO, for instance to "Run these programs at user login" and have it run a CMD.exe for example.  Do the secedit thing to enforce your GP changes and reboot.  If CMD starts up, then we know that it's either bad package, bad path, or something other than GPO is just not running.

I try to eliminate what I can in troubleshooting to easily figure out where to look.

Let us know.

JM
0
 
DVation191Author Commented:
"Did you choose to "Assign" or "Publish" the MSI package? "
Per the MS document I was reading, I choose "Assign" ...should the be "Publish" ? What's the difference?

"Is the Package setup correctly or not?  That includes the "Auto Install"
I am using the Update.msi that came with XP SP2. I don't know what you are referring to when you say "Auto Install". I know there are parameters I can pass an .msi file to make an install silent, but I have no idea how to do this when deployed via group policy. That was going to be something I was going to tackle once I got this working :)

"Is the package available to the client over UNC?  Is the path to the package defined as UNC or regular path in GPO?"
From the client I can access the share using the UNC, that is correct. The GPO had the UNC define, not the local path. I was warned about that in the documentation I was reading and was careful about that.

"Is the client in the correct OU that has the GPO assigned to?"
I right-click the Test OU and go to properties, then edit the group policy tab. This Test OU has the one machine account I am traying to make this work on. So to answer your question...I think so :)

"Does the isntallation even start?  It's possible that it starts but then it fails.  You could probably create a verbose output in the setup to test this one."
If it starts, it fails too quickly for me to even tell.
0
 
DVation191Author Commented:
" Try to create some new setting in the same GPO, for instance to "Run these programs at user login" and have it run a CMD.exe for example. "

I don't know if I did this right, in the GPE
User Configuration > Admin Templates > System > Logon/Logoff > Run these programs at user login > enabled
I added C:\WINDOWS\SYSTEM32\cmd.exe
I forced a refresh on the client and rebooted. CMD.EXE did *not* show up.

I'd like to add that the GPO for the domain (Default Domain Policy) *is* working because my firewall settings and automatic update settings are unchangable and managed by group policy. So I know my domain policy is working...but I can't get this policy for this particular OU working. Maybe I did something wrong in creating it?

I right clicked domain.local in AD Users and Computers, went to New > Organizational Unit
I called it "Test Environment". I then found the computer I was testing  in the Computers OU and right clicked it, choose "Move..." and moved it to the new OU. To edit it's GP, I right click the new OU, go to properties, Group Policy tab, then I added the default policy and edit from there. Hopefully this will help you experts diagnose my problem here! Thanks for all the effort so far!
0
 
jmelikaCommented:
Bingo.  We have a thread now.  We know that this GPO is not being applied.  Before we go any further, do you happen to have multiple domain controllers?  It's likely in that case that you're authenticating to the other DC which does not have the changes replicated to it yet.  If you don't, then it can't be that.  Go to command prompt on this client and do
ECHO %LOGONSERVER%
it should display the name of the domain controller you're logging on to.  It's worth a shot.
0
 
DVation191Author Commented:
No, there is one one DC.
0
 
DVation191Author Commented:
"No, there is only one DC"

I don't really know how inheritance works...could that have something to do with it? There is an option to block inheritance although I don't think I want to do that because then the client would not get all the other domain-wide policies applied.

Also,
"Did you choose to "Assign" or "Publish" the MSI package? "
Per the MS document I was reading, I choose "Assign" ...should the be "Publish" ? What's the difference?
0
 
jmelikaCommented:
Assign will let execute the isntallation package upon login.  Publish will place it in the Add/Remote Programs under the Add New Programs list.  That is the reason I asked if you saw it there, but you answered no, so you assigned it which is the right thing to do.

We can tell that the entire GPO is not being executed for some reason.  That's why I asked you to test running the CMD file in the same GPO.  We know it's not the "Package" but it's the GPO itself.

Let's try to block inheritance.  It could possibly be something in the domain wide GPO that's causing this not to run.  It's worth a shot since we're playing around on a test machine and not domain wide.
0
 
DVation191Author Commented:
I have something interesting here. I ran the GPMC on the client. It turns out that the OU Policy is being denied.

Name: {049E9C8D-A22D-4C55-A610-F3FF061AD957}
Link: domain.local/Test Environment
Location:
Reason Denied: Inaccessible

So the question is, why is the GP inaccessible and how do I fix it?
0
 
DVation191Author Commented:
I think I got it... I went to the properties og the GPO and added the computer name with full permissions. When I ran the gpupdate /force on the client, it actually said it needed to reboot to apply the settings (it hadn't done that unitl now)...i think that may have done the trick...ill let you know how it goes!
0
 
DVation191Author Commented:
Holy Sh*t it's working! lol
Before I could even log on....XP is showing me a window...
"Installing managed software Windows XP Service Pack 2 (1033)"

Its working! Now I need to figure out what permissions I can make just read only so this works without full permissions.
0
 
jmelikaCommented:
Right On!

Read Only to the folder should work.  Glad to hear it's working for ya now.

JM
0
 
DVation191Author Commented:
SP2 installed but interestingly enough, cmd.exe didn't run. I think I know why though...because it was configured under "User Configuration" and the only object in the OU was a computer account right?
0
 
DVation191Author Commented:
Alright, well anyway...thanks for all your help jmelika. I have to award Debsyl99 some points too since the GPMC is what tipped me off. Thanks to both of you!
0
 
jmelikaCommented:
Great to hear you're all done!  Thanks for the points.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now