Software Deployment Through Group Policy

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

As TigerMatt mentioned you could edit the MSI or create an MST file, but in most cases you should also be able to specify it on the commandline i.e MYMSI.MSI /QN INSTALLDIR="%ProgramFiles%\MyPath" /NORESTART.

Hope that helps.

Cheers

StuFox100

Check out this site:
http://www.appdeploy.com/packages/
It is very useful for different apps when packaging and deploying through AD.
Cheers
Stu

ASKER

Tigermatt, your awesome! I used the orca tool on the MSI and miraculously found the line that contained the default path, changed it and ran it to see if it changed, and it did! I think I even found the lines that have the install for just me or everyone buttons but I do not know what to change to get it to default to everyone. Any ideas? Thanks!

I wonder, does the latter part of this article help? http://support.microsoft.com/kb/835460

-tigermatt

use the switch AllUsers=2 or change the property AllUsers within the MSI

ASKER

Also, another problem... I have the GP setup with the package and it does seem to be installing. Any ideas on what could be hanging me up? Thanks again!!!

Which part of the GPO have you implemented it in, Computer or User Configuration?

ASKER

Computer configuration. The path is correct using UNC and I know the MSI works because I ran it manually. I thought that maybe the _ in the MSI was a problem so I changed that. The GPO is linked and enforced to the OU that I want to apply it to and I have checked the computers that reside there which it hasn't installed. We have never deployed this app via GP before but there is a previous version on there and the MSI is supposed to install to the same directory. That should not matter right?? because it should just upgrade the app. Thanks for you help!

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Domain Computers have full control permissions all the way down to the MSI file now. I have rebooted one of the machines a couple of times and the prograqm is still not getting updated.

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Yes, it shows up as assigned in the rsop on one of the machines. I am glad you have some ideas because I am pretty much clueless at this point.

Is this the modified MSI which you are installing? What happens if you manually try to install it on a station - does the installation go successfully, or does it fail? I'm starting to think the MSI is corrupt for some reason.

ASKER

Well, I ran the MSI on another machine just to test it out and the modified one worked fine. So I do not hink it is corrupt. If it already sees files in the directory it is installing to will it not install?

>>> "If it already sees files in the directory it is installing to will it not install? "
That could be causing a problem. If it sees files there, it might think it's already installed, and therefore fail because it is asking to do a Repair/Reinstall instead.

ASKER

Is there any way to force it? If I have to go around and unistall this app before I use the GP to install it that would kind of defeat the purpose of the GP.

Not that I'm aware of, I've had a look in Orca but can't see a place to force it to repair itself as such.

ASKER

Well, I am trying it on a machine that has never had it installed to see if it actually goes through so then maybe we can rule that out. I will let you know.

ASKER

Ok, test done and it installed on a machine that has never had it without a problem. So I need to figure out an automated way to remove the program from all the machines and redeploy via GP. Ths app also requires permissions set on the application folder so that non admins can use it. Any idaes on accomplishing this? Thanks!

You can set permissions on the folder through a Group Policy. There's an interface which allows you to push permissions changes for both the file system and registry. I suggest that in the same deployment policy which you are using to push the application MSI, you go to Computer Config, Windows Settings, Security Settings, File System, and follow the instructions there. There's more information on this at http://windowsitpro.com/article/articleid/82361/jsi-tip-8724-how-can-i-use-group-policy-to-set-file-system-andor-registry-permissions.html.

As for forcing it to install, I'm not sure how you would go about this. What method was used to install it previously? A manual installation?

-tigermatt

ASKER

Yes, it was a manual installation. It looks like the only thing that it installs is a new shortcut for the program. As far as updating the files it does not change the files which are already there. That is a problem... There will probably be updates to this program in the future and getting the setup via GP to push the software out will greatly ease administration.

Perhaps you could add

msiexec /package <Path to old MSI> /uninstall /quiet

to your logon or startup script in order to remove the application?

ASKER

So I would add msiexec /package c:\program files\myprogram /uninstall /quiet to the GP? Would I just create a little batch file with this in it and add it to the logon scripts under computer settings for the same GP? Would this also result in that command running and completing before it initiates the package install. Would I need to remove that command after they are all updated so it doesnt continually uninstall/reinstall? Sorry for all the questions. You have been really helpful and have more knowledge than I do. This makes the whole process of getting this figured out easier. Thanks!

It's only a suggestion, it depends on how the program is configured as to whether it will work. You'll need to actually reference that command in your logon or perhaps a computer startup script, but you have to have the path to the OLD MSI which the old version of the program was installed with.

It might work, it might not.

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Ok I have this script and tested it by manually running it on the tartget machine and it uninstalls.

msiexec /uninstall "\\server\My original install app\myapp.msi" /quiet

I put it in the GP as a computer startup script and it does not seem to uninstall the program. Any ideas? I feel that I am really close to getting this issue resolved. Thanks!

And again, the Domain Computers account has full control over the path on the server in both NTFS and Share permissions to read the MSI?

ASKER

Yes both NTFS and share permissions have been set for Domain Computers. The uninstall command I posted is in startup scripts under computer settings. The actual batch file is in the sysvol folder as well.

'tap' 'tap' hello is this thing turned on...

damn must be talking to myself..

ASKER

Oh yes Matrixnz I hear you now your last post was sort of in Greek. I am trying to keep this simple because I am an aspiring expert not an expert yet. :) I think I am almost there if I could just get the old program uninstalled then the package would install no problem. What script/GP change do you think I should try to get this to work? Thanks!

Try using the commands matrixnz has recommended - MYMSI.MSI /QN REINSTALLMODE=VOMUS INSTALLDIR="%ProgramFiles%\MyPath" /NORESTART - should get the entire application reinstalling, without the need for the GPO.

ASKER

Me again... :)

Ok lets recap on what is going on. I have 30+ machines that need a new version of an app that was originally installed with an older version by manually going around to each machine to install it. I have successfully created an app deployment in GP (computer settings) that puts the app on the machine only if the app old or new has never been installed. Because all the machines that need the deployment have the old version, I then I proceeded to create a script that would remove the old version so the new version would install. This scripts syntax is msiexec /uninstall "\\server\My original install app\myapp.msi" /quiet, however when added to the GP it does not run on the target machines leaving me back a square one. I have tried the various suggestions by tigermatt and matrixnz and they have not worked. One of the vomus commands used actually changed the date on the apps executable but when it is run still reflect the old version!?!?!?!?
If it helps I have both the old and new MSI installer files on a network drive and the location of the program on the target machines are in program files, of course. If anyone could provide me with the exact syntax so all I would have to do is insert the location of the files I have that would be great. Who knows maybe I am typing something wrong when using these suggestions by all the experts, so maybe with the exact switches and syntax provided by everyone and all I have to do is fill in the file paths then maybe I can get this working. Thanks!!!

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Well, I tried with this one msiexec.exe /x "\\server\My original install app\myapp.msi" /qn and it worked even through the gp. I tested it out on a couple of other machines and after a couple of reboots the software uninstalled/reinstalled all through group policy with the new version. I went to try a third and it uninstalled but would not reinstall. Here is what I got when looking at the RSOP through the affected machine.
Group Policy Infrastructure failed due to the error listed below.
The specified domain either does not exist or could not be contacted.

Note: Due to the GP Core failure, none of the other Group Policy components processed their policy. Consequently, status information for the other components is not available.

Any ideas?

There should be an associated log in either the Application or System Event Viewer. Can you post it here for us please?

ASKER

Are these what you are looking for?

Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1054
Date:            6/21/2008
Time:            2:42:51 PM
User:            NT AUTHORITY\SYSTEM
Computer:      CC1-comp-07
Description:
Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:      Error
Event Source:      NETLOGON
Event Category:      None
Event ID:      5719
Date:            6/21/2008
Time:            2:03:39 PM
User:            N/A
Computer:      CC1-comp-07
Description:
No Domain Controller is available for domain mydomain due to the following:
There are currently no logon servers available to service the logon request. .
Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 5e 00 00 c0 ^..À

And just to clarify, this has only happened on one computer?

Can you check its IP and DNS servers are correctly set, so the ONLY DNS servers are your Domain Controller(s).

ASKER

So far I have only tried about three or four.

They are all getting their IP address as reservations through DHCP and the DNS servers configured there are our DCs.

Do you think that the computer account needs reset or unjoined and rejoined??

Oh, so it didn't want to uninstall on all four PCs, if I understand what you're saying correctly? That's a blow. Yes, you might want to look at removing the PC and re-adding it to the domain.

Feroz Ahmed

Hi,
Software Deployment is done through Domain Controller or Administrator on any workstation ,and the process is just goto Active Directory users and Domaincontrollers there select domain and right click onto it and it opens with MMC (Microsoft Management Control) to GPedit.msc and give the path for the software which is to be installed on any workstation here you can specify the installation to automatic or on restart of that particular workstation.In this way software deployment is done.

@sm_feroz: Have you even read the entire question? This is NOT as simple as just explaining how to deploy an MSI file through Group Policy. If you had read some of the author's last comments, you would realise we are having a terrible time attempting to get the MSI to install, because the previous one must first be removed. In any event, I had already stated in my very first comment how to distribute the MSI by Group Policy! (http:#21786687)

ASKER

tigermatt, I unjoined the computer from the domain and rejoined. I tried to deploy again with the same result, it runs the removal script but does not deploy the app and shows the same error message in the RSOP. I checked the machine in AD and the creation date says 2006, shouldn't it say 2008? I don't think it was completely removed. Any more ideas, thoughts? Thanks for hanging!

The only last suggestion I've got in that case is to use a small program known as PsExec to manually do the uninstallation (using the uninstall code you are already using) on the remote stations. You can find more information on that tool at http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx, but essentially, it simply allows you to remotely execute commands on the remote workstation(s) you specify. You can also set a username and password to execute the command at the remote station with.

As stated in the article, you can use the command \\* where the computer name goes to run the command against all computers in the domain. This is probably the easiest solution for you, and the setup program should just quit immediately if it cannot find the program on a particular station to uninstall.

Hopefully after running PsExec and one or two restarts, the new MSI should be deployed correctly through GPO.

-tigermatt

Can you tellus what the name of the application is that you're trying to install?

ASKER

Matrixn,

I could probably attach the program to this question but I think this is pretty much solved at this point. I have tried what you all have given me here on and it has succeded on 5 of 6 machines it was tested on. That should be good enough to warrant not spending any more time troubleshooting because once we do this on the rest we may not even have any issue with anymore. The only other thing that I can think of is that this machine was imaged with the setup from another machine without running sysprep maybe creating some kind of insufficient trust relationship with the domian??? I dont know... Thanks for all your help. You and tigermatt got me through a lot. Now I just have to figure out how to award the points.

Hi there,

Glad to hear it is eventually working! There is a section in the Experts-Exchange help guide specifically detailed on how to assign points to expert comments and accept as the solution. See the sections on closing questions at https://www.experts-exchange.com/help.jsp#hs7.

-tigermatt

ASKER

You guys were awsome in answering this! We deviated from the orginal question a little but you guys stuck in there. I think that I may have figured out why we were having problems running this on that other mahcine. The machine was built using an image without sysprep being run. Could that be the issue?? It joins to the domain fine but has issues running all of the GPs, particularly this one. Anyway I hope that I have distributed the points fairly and thank you all again for all the help!