Solved

GPO do not catch up

Posted on 2012-04-13
38
323 Views
Last Modified: 2012-05-16
i have a WDS setup ready and various software packages i want to deploy:

these packages are small ones (about 20MB),so there shouldnt be network issues.
i created a MSI package and a GPO for each one and created a directory c:\software from where it shall be distributed.

same goes for the IE9 package: its in c:\software as well.

i typed gpupdate /force on the WDS and client but the packages werent installed after a few attempts.


atuenticated users and those computers have the "apply group policy" right granted.
on the clients (win 7 sp1), there the following message:

"group policy client extension software was unable to aply one or more settings..."

i rebootet those client several times,but no software were installed.

i posted some PS`s so its easier to follow up.
o1.png
o2.png
o3.png
o4.png
o5.png
0
Comment
Question by:quickslvr
  • 23
  • 15
38 Comments
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
Your software path is pointing towards c:\software\xxx. You need to use a UNC instead as when the client processes the GPO it will look for c:\software\xxx on its own C drive.

Change the path to a UNC and ensure the share has read permissions enabled
0
 

Author Comment

by:quickslvr
Comment Utility
ah i see.
i did this all,but the GPO still dont seem to catch up.
0
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
Are the GPOs applied to the OU that contain the relevant computer accounts?
0
 

Author Comment

by:quickslvr
Comment Utility
yes
0
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
Can you connect from one of the clients to the UNC path and install one of the packages manually? This will clear a few possible issues.
0
 

Author Comment

by:quickslvr
Comment Utility
yes,i could do that. the UNC path is visible
0
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
Ok, can you run gpresult on a client and confirm wether the GPO is being picked up or not?
0
 

Author Comment

by:quickslvr
Comment Utility
ok,heres more info:

i created those MSI packages with the exe-to-msi converter tool. i assume that this tool has some impact as well
0
 

Author Comment

by:quickslvr
Comment Utility
ok,wait a min
0
 

Author Comment

by:quickslvr
Comment Utility
ok, the GPO has not been picked up
0
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
Do a double check and confirm the GPO containing computer configuration is being applied to an OU containing computer accounts.
0
 

Author Comment

by:quickslvr
Comment Utility
YES,THIS IS THE CASE
0
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
I notice you have set security at some levels. Remove all the permissions you originally set. To limit the GPO its easier to set filtering within the GPO console.
0
 

Author Comment

by:quickslvr
Comment Utility
pls have a look here. do you see something which leds to those issues?
GPReport.html
0
 

Author Comment

by:quickslvr
Comment Utility
i think i found the reason:

 all software packages reside in the same folder.
i ran gpresult /h and saw that the last package "wins".

i assume that the last package in that folder will be deployed.

could you confirm that fact?
0
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
It doesn't matter where the software is located as long as there is a separate link to each package within the GPO (or a separate GPO for each package).
0
 

Author Comment

by:quickslvr
Comment Utility
but thats what i just described,right?

a software delivery GPO must have a dedicated UNC path to make it work,right?
i created a different subfolders for each GPO under the software folder.

would that work then?
0
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
I don't know if you need to use different subfolders for each package, but thinking about it I've always done it like that anyway!
Try it (just ensure you update each GPO with the new path)
0
 

Author Comment

by:quickslvr
Comment Utility
ok,ill let you know
0
Why do Marketing keep bothering you?

Is your marketing department constantly asking for new email signature updates? Are they requesting a different design for every department? Do they need yet another banner added? Don’t let it get you down! There is an easy way to manage all of these requests...

 

Author Comment

by:quickslvr
Comment Utility
I re-created everything new.
theres a share for each software folder (I.E. Acrobat) and granted everyone and domain users read rights.

so far, nothing has been installed since an hour..
0
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
Run gpupdate /force on the client pc.
Reboot and logon x 2
0
 

Author Comment

by:quickslvr
Comment Utility
din not help.

i also created a GPO which maps drives. same there,it doesnt catch up.

i dont know what else i could do
0
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
Ok, lets go back to the beginning and create the following:

1. Shared location containing a single software package (.msi) (read access set to everyone both NTFS and share permissions). Confirm this by connecting to the UNC and installing the package onto a client machine.
2. Create a new GPO, assign the relevant settings to the Computer Configuration side (use assigned not publish) using only the package tested above. Do not set any filtering or security at this point.
3. Assign the GPO to an OU that contains computer accounts
4. Run GPupdate /force on the client. You should receive a message saying some settings need to be run on startup and asking if you would like to reboot. If you don't receive this message double check #3
5. Reboot client. Check to see if software is installed. Sometimes it takes two reboots but Windows 7 usually works straight away.

Do all these steps one at a time. If this still doesn't work we can look at DC's etc.
0
 

Author Comment

by:quickslvr
Comment Utility
ok, i can confirm all the steps above.

i also checked the "ignore languages2 and make 32bit applications available to 64bit machines (since they are all 64x Win 7 SP1)"

same goes with the drive maps. none of the GPO has worked.

i have to admit that those win 7 machines have been deployed thru WDS and sysprep
0
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
And the clients are not picking up any of the new GPOs? Does GPresult show them now?
0
 

Author Comment

by:quickslvr
Comment Utility
i will post gpresult in a minute
0
 

Author Comment

by:quickslvr
Comment Utility
0
 

Author Comment

by:quickslvr
Comment Utility
and no,the clients do not pick up the GPOs
0
 

Author Comment

by:quickslvr
Comment Utility
and heres the gpresult from the DC
GPReport.html
0
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
Your source is still set to a local path (E:\Software\Win7Codecs\win7codecs_v350.msi)

This needs to be a UNC i.e. \\servername\sharename\win7codecs_v350.msi

If not then a client will look at its own E:\ for this path which will not exist.
0
 

Author Comment

by:quickslvr
Comment Utility
are you sure?
i just lookes at the GPO and it is like this;pls see attachment
pgowsus1.png
0
 
LVL 17

Accepted Solution

by:
James Haywood earned 500 total points
Comment Utility
I was looking at your gpreport above on the TEST-MC54 machine. Your extract above does show the UNC though so I'm not sure where the discrepancy is?

Can you remove this machine from the domain, remove all gpos then rejoin? That might help starting from fresh.

Removing GPOs (says XP but works with 7)
http://cobracommunications.wordpress.com/2010/09/14/remove-group-polices-from-clients/
0
 

Author Comment

by:quickslvr
Comment Utility
meantime,theres some success:

two of my software delivery GPO caught up,but there are two more packages not installed.

I`ve found out that the drive maps GPO shoulds is a user GPo and should be linked to
a user group. i will try this and report.

heres some:

  The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
        Drive Mapping GPO
            Filtering:  Not Applied (Empty)
0
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
Thats good. If two are installing then we know the infrastructure works, machines are talking etc. Do a double check on the GPOs that are not installing and make sure they have the same settings as the ones that are.

The Drive Mapping GPO will be filtered out as you have correctly stated as it applied to user accounts not computer accounts.
0
 

Author Comment

by:quickslvr
Comment Utility
i have to correct my statement. the GPos are still not catching up.
i dont know where to look else
0
 

Author Comment

by:quickslvr
Comment Utility
on hide/show this drive, what do i have to check?
testgpo.png
0
 

Author Comment

by:quickslvr
Comment Utility
i found another phenomenon:

those self-created MSI (with the freeware) do not work. i took an MSI from appdeploy and that worked right away.

so what i need,is a packaging tool which does all those tasks. since freeware dont do, im willing to pay for something which works.

suggestions which packaging tools do work 100% without any errors?
0
 
LVL 17

Expert Comment

by:James Haywood
Comment Utility
That looks like the problem then1

I haven't really used any .msi creation tools myself. Have a google and try some out I suppose.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now