Answered by:
both GPO not applying in my test OU

-
Hi, I'm not sure what's lacking in my setup but in the past years I've deal with GP, this is the first time I'm having issues.
Issue 1: to replace the local administrator password to a different. The office was setup by a previous IT staff which didn't make any turnovers so we had to deal with it. We have approx. 100 pc but I don't want to rename the password one by one for each pc. So I thought of creating a GPO since they're all domain computers. Here's my setup:
AD: Server 2012 R2
Clients: Win 7 SP1
Computer Configuration > Control Panel Settings > Local Users and Computers
Create a local user. In Action set it to Update > for the User name set it to Administrator (built-in) > then set a new password.
Tried to play around with the settings since update didn't work, tried replace.
Issue 2: to distribute a .msi software as soon as they login. Since we don't have System Center Config Manager, I place it in a GPO and here's my setup.
User Configuration > Policies > Software Settings > Software Installation. Tried Publish and Assign, Basic and Maximum. Make sure that shared folder where .msi file is located has a full access for domain users.
Problem is, it doesn't install as soon as a user login.
Thanks
Jeff
Question
Answers
-
When I set it to Assigned, install software at logon, and clicked either on Basic or Maximum, it just hangs on the welcome screen, it doesn't proceed with the installation.
Regards,
Jeff
Hi Jeff,
I agree with Martin that you could use AppMgmt Debug Logging to troubleshoot. Please have a try.
Alternatively, Windows Installer handles its installations through Msiexec.exe. The logging options offered by this tool allow you to create different types of logs, depending on the information you need about the installation. You could check which step is wrong by using these logs. Please take a look and have a try following:
How do I create an installation log?
http://www.advancedinstaller.com/user-guide/qa-log.html#automated-loggingAlso, I would suggest you refer to the following article to see if it helps:
Best Way to Recover from Hanging Group Policy Deployed Software
https://www.404techsupport.com/2010/02/best-way-to-recover-from-hanging-group-policy-deployed-software/
Please Note: Since the web sites are not hosted by Microsoft, the links may change without notice. Microsoft does not guarantee the accuracy of this information.Regards,
Wendy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.
- Edited by Wendy JiangMicrosoft contingent staff, Moderator Monday, June 20, 2016 6:10 AM
- Proposed as answer by Wendy JiangMicrosoft contingent staff, Moderator Thursday, June 23, 2016 8:13 AM
- Marked as answer by Wendy JiangMicrosoft contingent staff, Moderator Tuesday, June 28, 2016 8:54 AM
All replies
-
Hi,
Re 1: This functionality is no longer being offered by GPP because of the security implications. Here's why and how to deal with it: https://blogs.technet.microsoft.com/askpfeplat/2014/05/18/how-to-automate-changing-the-local-administrator-password/ . If you still want to set the same password for all workstations, you can use this guidance: http://windowsitpro.com/powershell/resetting-local-administrator-password-computers
Re 2: Pull an RSoP and see if it tried to apply the policy at all and if it did, what errors have occurred in the process, If the install was tried but has not succeeded, you coud try cranking up MSI logging (voicewarmupx, see https://support.microsoft.com/kb/223300 ) and seeing where the problem is.
Evgenij Smirnov
msg services ag, Berlin -> http://www.msg-services.de
my personal blog (mostly German) -> http://it-pro-berlin.de
Windows Server User Group, Berlin -> http://www.winsvr-berlin.de
Mark Minasi Technical Forum, reloaded -> http://newforum.minasi.comIn theory, there is no difference between theory and practice. In practice, there is.
-
...or implement LAPS: https://support.microsoft.com/kb/3062591> Re 2: Pull an RSoP and see if it tried to apply the policy at all and if> it did, what errors have occurred in the process, If the install was> tried but has not succeeded, you coud try cranking up MSI logging> (voicewarmupx, see https://support.microsoft.com/kb/223300 ) and seeing> where the problem is.And if the installer does not kick in at all, enable AppMgmt Debug
-
actually Re 2: it did work for the GP but here are some follow up issues.
1. When I set it as Published. Problem: users doesn't have local admin rights. They don't have access to control panel.
2. When I set it to Assigned, install software at logon, and clicked either on Basic or Maximum, it just hangs on the welcome screen, it doesn't proceed with the installation.
Regards,
Jeff
-
I tried to change it to Computer Configuration, so that no matter whom login, it will still apply. When I used Computer Configuration, you don't have an option to choose among Publish and Assign, just Assign and Basic and Maximum, just Maximum.
Thanks
Jeff
- Edited by jeco Thursday, June 16, 2016 9:01 AM
-
When I set it to Assigned, install software at logon, and clicked either on Basic or Maximum, it just hangs on the welcome screen, it doesn't proceed with the installation.
Regards,
Jeff
Hi Jeff,
I agree with Martin that you could use AppMgmt Debug Logging to troubleshoot. Please have a try.
Alternatively, Windows Installer handles its installations through Msiexec.exe. The logging options offered by this tool allow you to create different types of logs, depending on the information you need about the installation. You could check which step is wrong by using these logs. Please take a look and have a try following:
How do I create an installation log?
http://www.advancedinstaller.com/user-guide/qa-log.html#automated-loggingAlso, I would suggest you refer to the following article to see if it helps:
Best Way to Recover from Hanging Group Policy Deployed Software
https://www.404techsupport.com/2010/02/best-way-to-recover-from-hanging-group-policy-deployed-software/
Please Note: Since the web sites are not hosted by Microsoft, the links may change without notice. Microsoft does not guarantee the accuracy of this information.Regards,
Wendy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.
- Edited by Wendy JiangMicrosoft contingent staff, Moderator Monday, June 20, 2016 6:10 AM
- Proposed as answer by Wendy JiangMicrosoft contingent staff, Moderator Thursday, June 23, 2016 8:13 AM
- Marked as answer by Wendy JiangMicrosoft contingent staff, Moderator Tuesday, June 28, 2016 8:54 AM