Deploying .msi application through GPO doesn’t work

deploymentgroup-policymsi

I've been trying to deploy the forticlient SSL VPN application (.msi format) into my domain machines, using a GPO. Even though I made a silent previous installation by issuing the command: msiexec /qb /i installer.msi and it worked, which is mentioned as sort of a prerequisite in the following post: Installing MSI via Group Policy in a Fully Unattended Way, the .msi is not getting installed in the machines. The installer is in a shared folder with proper permissions.

Where might I get information on what might be preventing the installation on the domain machines?

Thanks for your help

Update:
The clients are Windows 7 Pro 32-bit. The server is Windows Server 2008 R2
Update:
Issuing the gpresult /R command shows that the computers are actually receiving the GPO and this is not being filtered.

update 2

I followed along the path indicated by the post: Group Policy installation failed error 1274, however there are two events, one indicating error 1274 and the other one being error %%2. While doing a test reboot on my machine the event the application assignment was made successfully, appeared once but no more and yet the installation was not made. I'm puzzled by this problem.

Best Answer

Diagnosing 'silent' MSI installation failures can be done like this:

Firstly, check your GPO is applying correctly. Use the Group Policy Management Console to run a report on a target machine, and view this report to check that the GPO that assigns the software installation is applying correctly. If this part isn't working right then there's no point in going any further. Both a fault in the GPO in question or in any other GPO that should be applied before or alongside it can cause a workstation to stop processing GPOs.

With that done, check the event logs on the target machine:

Open Computer management -> event viewer -> Windows Logs - Application

You're looking for errors with a source of MsiInstaller (and any other events that get logged at the same time of course).

Finally, a lot of applications record their own log as part of the installation process. If you can find the local folder that the MSI installation was ran from then there may be a detailed error log inside that (of course, if you can find errors in the windows event viewer then this will hopefully also mention the application logfile and tell you where to find it)

Also check that the following setting is being applied to the target computers via GPO, and if not, set it and then run gpupdate /force from a command line on a target computer, and reboot.

Computer Settings

  -> Administrative Templates
    -> System
      -> Logon
        -> Always wait for the network at computer startup and logon – Enabled
Related Topic