Program pushed via GP won't install on all computers


  • I have a batch file attached to a group policy that is supposed to install an .msi. For some reason, when I apply the GP to the OU I want and restart said computers, the program will only install on some (not all) of the computers in the OU. The MSI in question is located on a network share that is accessible by all computers. I created a log export for the GP, compared it to the installs that work and I noticed two things:

    1) Failed to grab execution mutex. System error 258
    2) MainEngineThread is returning 1618

    It looks like the 1618 is due to an application already running. How can I fix my group policy (or batch file) to resolve this issue? I'm just starting to work with batch files and any help would be greatly appreciated. 


    Wednesday, August 26, 2015 2:52 AM

All replies

  • Group policy can install MSI files natively without using a batch file. I would review this link and possibly test using GPO without the batch file.  It seems like from your errors that the install is trying to run while another MSI is already running.


    Wednesday, August 26, 2015 6:31 AM
  • First thing to try is to run the msi locally on a failed machine, does this install? check event logs for a workstation that doesnt install it should gleen some info. 

    Wednesday, August 26, 2015 7:25 AM
  • Yes, if I go to the machine and run the batch file manually it will install fine.  I checked the install logs and saw that I was receiving the two errors in my original post.
    Wednesday, August 26, 2015 12:28 PM
  • I need the batch file because the install is a little weird and needs custom settings. 

    Going off of the multiple MSI's...any idea how to modify a batch file so multiple computers don't try and run recursive msi's? It'd be good to know if the computers could see if the installer is in use, wait till it's done and then start the install so it doesn't fail with the mutex error?

    Wednesday, August 26, 2015 12:30 PM
  • As part of the MSI install, use the /log switch to generate a log file to say the %TEMP% directory. For info on MSIEXEC switches, run msiexec /?

    Then for failed installs view the log file which reveals much more info than the return code. There could be many reasons for your error such as a bootstrapper launching a different process or the install time exceeding the computer startup time limit so it returns that error code.

    To get to the root of the issue the MSI log file will help.


    Wednesday, August 26, 2015 3:44 PM
  • Thanks for the response. I did create a log and that's how I knew about execution mutex failure and the 1618 error. See below:

               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (64:6C) [20:43:48:276]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (64:6C) [20:43:51:276]: Failed to grab execution mutex. System error 258.
    MSI (c) (64:6C) [20:43:51:282]: Cloaking enabled.
    MSI (c) (64:6C) [20:43:51:282]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (64:6C) [20:43:51:284]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (c) (64:6C) [20:43:51:285]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (64:6C) [20:43:51:285]: MainEngineThread is returning 1618

    Wednesday, August 26, 2015 4:54 PM
  • Can you post your batch file?
    Wednesday, August 26, 2015 6:17 PM
  • sounds to me like a permissions problem. when you run it manually you are logged in so it probably requires the users profile to be active to install it or something like that. Also when you test it manually are you logged in as an administrator? Have you tried logging in as a standard domain user and then running the msi? Also in group policy there is a setting for wait for network and group policy processing..

    also: have you got any delay set for processing group policy objects on the computers local policy.. I once was scratching my head wondering why my working printer script was not working via GPO but then I noticed after 15 minutes it suddenly executed and the printers appeared. Turned out to be some Windows 8.1 group policy delay setting which I hastily disabled.

    Thursday, August 27, 2015 12:43 AM
  • It's a pretty simple batch file:

    REM Websense Cloud Endpoint 8.0.2076

    :: Test if Websense is already installed
    IF EXIST "%PROGRAMFILES%\Websense\Websense Endpoint\WEPDiag.exe" GOTO _end

    msiexec /package "\\networkshare\Websense Cloud 8.0.2076\Websense Endpoint.msi" /passive /L*V C:\Windows\Temp\websenseinstall.log WSCONTEXT=our_unique_websense_code

    Thursday, August 27, 2015 2:13 AM
  • I don't think it's permissions related because some computers can download it fine and some can't, but they all have access to the share in question. I also have been able to successfully run the batch file from a user's account. I will check for the delay setting, thanks.
    Thursday, August 27, 2015 2:15 AM
  • Ok, do you have any other GPOs configured (as computer startup scripts or MSI deployment) which are installing software?

    The batch file looks fine. I had a quick look at the WebSense documentation which states to call the main .exe and pass it the MSIEXEC parameters. You could also try this.

    WebsenseTRITONAP-ENDPOINT-x64.exe /v"/qn WSCONTEXT=xxxx"


    • Edited by zxxzxx Thursday, August 27, 2015 8:52 AM
    Thursday, August 27, 2015 8:37 AM
  • at startup the script runs as system, try and run the script using psexec as system and see if this consistently installs
    Thursday, August 27, 2015 8:43 AM
  • We have other GPOs configured, but they aren't trying to install something simultaneously because they've already been installed long ago. I used this documentation to install because it's the cloud version instead of the on-prem with appliances and such.

    On a different note, I tried changing the msi file to read only. That resolved the 1618 and mutex error, however, I am now getting a 1619 error (which is something along the lines of not being able to open the msi). This only happens when I reboot multiple computers simultaneously. If I reboot one at a time, it will install just fine. Unfortunately, I have a boatload to do and it's not feasible. 

    Thursday, August 27, 2015 12:46 PM
  • Can you verify what the NTFS permissions are? Has Authenticated Users been added which is what domain computers use to authenticate?If so try and add Domain Computers to see if it makes any difference.

    Wednesday, September 2, 2015 11:18 AM