GPO do not catch up

i have a WDS setup ready and various software packages i want to deploy:

these packages are small ones (about 20MB),so there shouldnt be network issues.
i created a MSI package and a GPO for each one and created a directory c:\software from where it shall be distributed.

same goes for the IE9 package: its in c:\software as well.

i typed gpupdate /force on the WDS and client but the packages werent installed after a few attempts.

atuenticated users and those computers have the "apply group policy" right granted.
on the clients (win 7 sp1), there the following message:

"group policy client extension software was unable to aply one or more settings..."

i rebootet those client several times,but no software were installed.

i posted some PS`s so its easier to follow up.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

James HaywoodCommented:
Your software path is pointing towards c:\software\xxx. You need to use a UNC instead as when the client processes the GPO it will look for c:\software\xxx on its own C drive.

Change the path to a UNC and ensure the share has read permissions enabled
quickslvrAuthor Commented:
ah i see.
i did this all,but the GPO still dont seem to catch up.
James HaywoodCommented:
Are the GPOs applied to the OU that contain the relevant computer accounts?
IT Pros Agree: AI and Machine Learning Key

We’d all like to think our company’s data is well protected, but when you ask IT professionals they admit the data probably is not as safe as it could be.

quickslvrAuthor Commented:
James HaywoodCommented:
Can you connect from one of the clients to the UNC path and install one of the packages manually? This will clear a few possible issues.
quickslvrAuthor Commented:
yes,i could do that. the UNC path is visible
James HaywoodCommented:
Ok, can you run gpresult on a client and confirm wether the GPO is being picked up or not?
quickslvrAuthor Commented:
ok,heres more info:

i created those MSI packages with the exe-to-msi converter tool. i assume that this tool has some impact as well
quickslvrAuthor Commented:
ok,wait a min
quickslvrAuthor Commented:
ok, the GPO has not been picked up
James HaywoodCommented:
Do a double check and confirm the GPO containing computer configuration is being applied to an OU containing computer accounts.
quickslvrAuthor Commented:
James HaywoodCommented:
I notice you have set security at some levels. Remove all the permissions you originally set. To limit the GPO its easier to set filtering within the GPO console.
quickslvrAuthor Commented:
pls have a look here. do you see something which leds to those issues?
quickslvrAuthor Commented:
i think i found the reason:

 all software packages reside in the same folder.
i ran gpresult /h and saw that the last package "wins".

i assume that the last package in that folder will be deployed.

could you confirm that fact?
James HaywoodCommented:
It doesn't matter where the software is located as long as there is a separate link to each package within the GPO (or a separate GPO for each package).
quickslvrAuthor Commented:
but thats what i just described,right?

a software delivery GPO must have a dedicated UNC path to make it work,right?
i created a different subfolders for each GPO under the software folder.

would that work then?
James HaywoodCommented:
I don't know if you need to use different subfolders for each package, but thinking about it I've always done it like that anyway!
Try it (just ensure you update each GPO with the new path)
quickslvrAuthor Commented:
ok,ill let you know
quickslvrAuthor Commented:
I re-created everything new.
theres a share for each software folder (I.E. Acrobat) and granted everyone and domain users read rights.

so far, nothing has been installed since an hour..
James HaywoodCommented:
Run gpupdate /force on the client pc.
Reboot and logon x 2
quickslvrAuthor Commented:
din not help.

i also created a GPO which maps drives. same there,it doesnt catch up.

i dont know what else i could do
James HaywoodCommented:
Ok, lets go back to the beginning and create the following:

1. Shared location containing a single software package (.msi) (read access set to everyone both NTFS and share permissions). Confirm this by connecting to the UNC and installing the package onto a client machine.
2. Create a new GPO, assign the relevant settings to the Computer Configuration side (use assigned not publish) using only the package tested above. Do not set any filtering or security at this point.
3. Assign the GPO to an OU that contains computer accounts
4. Run GPupdate /force on the client. You should receive a message saying some settings need to be run on startup and asking if you would like to reboot. If you don't receive this message double check #3
5. Reboot client. Check to see if software is installed. Sometimes it takes two reboots but Windows 7 usually works straight away.

Do all these steps one at a time. If this still doesn't work we can look at DC's etc.
quickslvrAuthor Commented:
ok, i can confirm all the steps above.

i also checked the "ignore languages2 and make 32bit applications available to 64bit machines (since they are all 64x Win 7 SP1)"

same goes with the drive maps. none of the GPO has worked.

i have to admit that those win 7 machines have been deployed thru WDS and sysprep
James HaywoodCommented:
And the clients are not picking up any of the new GPOs? Does GPresult show them now?
quickslvrAuthor Commented:
i will post gpresult in a minute
quickslvrAuthor Commented:
quickslvrAuthor Commented:
and no,the clients do not pick up the GPOs
quickslvrAuthor Commented:
and heres the gpresult from the DC
James HaywoodCommented:
Your source is still set to a local path (E:\Software\Win7Codecs\win7codecs_v350.msi)

This needs to be a UNC i.e. \\servername\sharename\win7codecs_v350.msi

If not then a client will look at its own E:\ for this path which will not exist.
quickslvrAuthor Commented:
are you sure?
i just lookes at the GPO and it is like this;pls see attachment
James HaywoodCommented:
I was looking at your gpreport above on the TEST-MC54 machine. Your extract above does show the UNC though so I'm not sure where the discrepancy is?

Can you remove this machine from the domain, remove all gpos then rejoin? That might help starting from fresh.

Removing GPOs (says XP but works with 7)

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
quickslvrAuthor Commented:
meantime,theres some success:

two of my software delivery GPO caught up,but there are two more packages not installed.

I`ve found out that the drive maps GPO shoulds is a user GPo and should be linked to
a user group. i will try this and report.

heres some:

  The following GPOs were not applied because they were filtered out
        Drive Mapping GPO
            Filtering:  Not Applied (Empty)
James HaywoodCommented:
Thats good. If two are installing then we know the infrastructure works, machines are talking etc. Do a double check on the GPOs that are not installing and make sure they have the same settings as the ones that are.

The Drive Mapping GPO will be filtered out as you have correctly stated as it applied to user accounts not computer accounts.
quickslvrAuthor Commented:
i have to correct my statement. the GPos are still not catching up.
i dont know where to look else
quickslvrAuthor Commented:
on hide/show this drive, what do i have to check?
quickslvrAuthor Commented:
i found another phenomenon:

those self-created MSI (with the freeware) do not work. i took an MSI from appdeploy and that worked right away.

so what i need,is a packaging tool which does all those tasks. since freeware dont do, im willing to pay for something which works.

suggestions which packaging tools do work 100% without any errors?
James HaywoodCommented:
That looks like the problem then1

I haven't really used any .msi creation tools myself. Have a google and try some out I suppose.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 7

From novice to tech pro — start learning today.