none
Software Installation fails via GPO

    Question

  • GP SERVER:

    Windows Server 2008 R2 Standard 64 Bit

    CLIENT PC's:

    Windows 7 Professional 64 Bit

    DEPLOYMENT INFORMATION:

    General:Deployment type - Assigned
    Deployment source - \\SERVER\FOLDER\MSI.mis
    Uninstall this application when it falls out of the scope of management - Disabled

    Advanced Deployment Options:
    Ignore language when deploying this package - Disabled
    Make this 32-bit x86 application available to Win64 machines - Enabled
    Include OLE class and product information - Enabled
    Permissions:

    Allow

    XXXXXXXX\Domain Admins

    Full control

    No

    Allow

    NT AUTHORITY\Authenticated Users

    Read

    No

    Allow

    NT AUTHORITY\SYSTEM

    Full control

    No

    Allow

    XXXXXXXX\Domain Admins

    Read, Write

    Yes

    Allow

    XXXXXXXX\Enterprise Admins

    Read, Write

    Yes

    Allow

    NT AUTHORITY\ENTERPRISE DOMAIN   CONTROLLERS

    Read

    Yes

    Allow

    NT AUTHORITY\Authenticated Users

    Read

    Yes

    Allow

    NT AUTHORITY\SYSTEM

    Read, Write

    Yes

    Allow

    CREATOR OWNER

    Read, Write

    Yes

    Administrative Templates:

    Startup policy processing time – Enabled 30 seconds

    Always wait for the network at computer startup and logon - Enabled

    Error(s) on test client OC:

    Sourced from Windows Logs > System
    Error 1 - "The install of application XXXXXX from policy XXXXXX install failed. The error was: %%1612"

    Error 2 - "Failed to apply changes to software installation settings. Software changes could not be applied. A previous log entry with details should exist. The error was: %%1612"

    Based on the information above, is anyone able to advise if there is anything I have overlooked?


    Jeet S

    Wednesday, February 4, 2015 12:11 PM

Answers

All replies

  • Hi,

    Got an blog stating the same issue with resolution. check this out : https://alfredsilva.wordpress.com/2011/12/30/gpo-application-deployment-error/

    And also see https://support.microsoft.com/kb/278472


    Regards, Prabhu


    Wednesday, February 4, 2015 12:56 PM
  • That didn't work either. The share was never using C$ to start with.

    Jeet S

    Wednesday, February 4, 2015 1:36 PM
  • Have you tested your install package without group policy?  Verify the package works first before adding in another layer of complexity.  If you have done this, then I'd start by doing a gpresult to make sure the policy was applied to give the package to the user.  If the policy is listed as an applied group policy and the install works without group policy, then you have narrowed it down further.  I'd try a less complex package install to make sure that part is working.  Maybe just one msi file that installs something as a test.  Verify you can get that to work.  If all that is ok, then let me know and we can look at some other stuff.  

    -Brockstar

    Wednesday, February 4, 2015 1:48 PM
  • Hi Brock,

    Many thanks for the pointers. I will try as you suggested and will feedback.


    Jeet S

    Wednesday, February 4, 2015 3:21 PM
  • Have you tested your install package without group policy?  Verify the package works first before adding in another layer of complexity.  If you have done this, then I'd start by doing a gpresult to make sure the policy was applied to give the package to the user.  If the policy is listed as an applied group policy and the install works without group policy, then you have narrowed it down further.  I'd try a less complex package install to make sure that part is working.  Maybe just one msi file that installs something as a test.  Verify you can get that to work.  If all that is ok, then let me know and we can look at some other stuff.  

    -Brockstar

    Ok so it turns out as follows -

    RSOP indicates that the policy is being pushed to the test machine however on getting into the RSOP window I noticed a little yellow triangle with an exclamation mark in it next to Computer Configuration. So I right clicked on Computer Configuration > Properties > Error Information and find the following -

    Component: Software Installation
    Status: Failed
    Details: Software installation failed due to the error listed below. The installation source for the product is not available. Verify that the source exists and that you can access it.

    I navigated via UNC to the source of the install file and tried to run the msi and receive the same error as the one I found in RSOP.

    So the problem appears to be with the msi. I will try the msi on another computer just to be sure.


    Jeet S

    Wednesday, February 4, 2015 3:48 PM
  • UPDATE:

    Ok so I tested running the msi on a different computer. I was logged into the computer as domain admin and the msi ran fine.

    I tried the msi on my machine and received the error - Software installation failed due to the error listed below. The installation source for the product is not available. Verify that the source exists and that you can access it.

    Surely this means it is a permissions issue? The key then is where do I set the permission and to what level/extent?


    Jeet S

    Wednesday, February 4, 2015 4:29 PM
  • > Surely this means it is a permissions issue? The key then is where do I
    > set the permission and to what level/extent?**
     
    Grab Sysinternals "psexec", run "psexec /s cmd" in an elevated prompt
    and try to access your installation server and share from this prompt.
     

    Martin

    Mal ein GUTES Buch über GPOs lesen?

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))
    Wednesday, February 4, 2015 5:20 PM
  • Hi Martin,

    You're going to have to elaborate on that mate. Why would I run psexec and what will that allow me to do? And where is Sysinternals?

    Apologies for the novice questions but I am trying to understand the problem as well as understand the solutions I am being given.

    UPDATE: Ok so I have PsExec and I ran it via an elevated command prompt. I used the net use command to setup a share to the source of the msi package.

    Whilst in the elevated command prompt I navigated to the share via the letter I assigned to it (X:) and tried to run the msi. I receive an error - Access Denied.

    • Edited by CLAWWS MCTS Wednesday, February 4, 2015 5:40 PM Update to post
    Wednesday, February 4, 2015 5:31 PM
  • I don't know that your test is actually recreating what the computers would be doing.  I think what he is telling you to do is to connect via psexec to the computer account for the computer that would be running the install.  What account is being used to push the package?  In previous versions of AD, I think the PC itself would need to have read access to the share.  If you are applying a software install to the computer in GPO, it does the install from the context of the computer.  If you add "domain computers" to the shared folder's permissions, that should give you what you need to install via the GPO.  This is at least how it was in older versions.  Try this and let me know.  It sounds like your user account doesn't have the right permissions either if you cannot run it from that mapped drive.  Not sure why that would be.  I'd give myself permissions to that MSI also if you haven't already.

    -Brockstar

    Wednesday, February 4, 2015 8:41 PM
  • > UPDATE: Ok so I have PsExec and I ran it via an elevated command prompt.
    > I used the net use command to setup a share to the source of the msi
    > package.
     
    the "psexec -s cmd" opens a command prompt that runs in context of local
    system. network access in this prompt uses the computer account, so
    that's a good way to check for ACL related problems on remote shares :)
     
    > error - *Access Denied*.
     
    Then examine the ACLs in NTFS and on share level. If you use ABE, check
    NTFS ACLs across the full path.
     

    Martin

    Mal ein GUTES Buch über GPOs lesen?

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))
    Thursday, February 5, 2015 9:52 AM
  • Apologies for the radio silence on this guys. Boss has got me working on something else today. I will revisit this (hopefully today). Many thanks for your help and patience thus far.

    Jeet S

    Thursday, February 5, 2015 12:48 PM
  • Good Morning,

    So despite numerous variations and permission settings we are still experiencing problems with this. So this is what has been done so far –

    The msi file has been moved to another location on the network which we know works for other msi files –

    This did not work although when we check event viewer, gpresult and RSOP the policy is being applied but the software installation is failing.

    Added domain users to local admins. The share folder containing the source msi has Everyone setup for read and execute permission –

    This made no difference

    Tried running the msi file logged in as administrator and also tried running the msi whilst logged in as myself –

    The msi runs fine for administrator but will not run when logged in as myself and gives the following error: Software installation failed due to the error listed below. The installation source for the product is not available. Verify that the source exists and that you can access it.

    The msi contains an upgrade to our antivirus software. I setup two machines one with the old antivirus software installed on it and the other without any antivirus software on it. Logged in as domains users on each machine and did a gpupdate /force /boot -

    After logging back in I ran RSOP and found that on the machine which had no antivirus on it to begin with there was an error for software installation stating – Fatal error during software installation. For the machine that had antivirus already installed on it there was no such error and the software installation states that the installation was successful and yet the new A/V software is still not installed.

    This morning I got in early to try and do some more work on this but my boss was already here and advised that even a login script will not work so he has installed it manually on one of the machines and it appears to have worked fine. Not really sure where to go from here.


    Jeet S

    Monday, February 9, 2015 12:03 PM
  • > /*The installation source for the product is not available. Verify that
    > the source exists and that you can access it.*/
     
    Whatever you have configured in NTFS and share permissions for the
    folder where the MSI is located - double and triple check...
     

    Martin

    Mal ein GUTES Buch über GPOs lesen?

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))
    Monday, February 9, 2015 1:33 PM
  • Ok so it turns out this may not be a permissions issue. In fact we believe this may be an issue with the previous AV software refusing to uninstall. Effectively what should be happening is that the new AV software should install over the top of the old one and then uninstall the old one. We tried removing the old AV off of a few machines yesterday evening and were prompted for a password. Conveniently the passwords that we have noted down - none of them worked!

    Watch this space for further updates.


    Jeet S

    Friday, March 13, 2015 8:46 AM