GPO Software Deployment not working

deploymentgroup-policy

I am trying to deploy an MSI via GPO, without success. It is an Outlook plugin, and the MSI works (from that location) if I install it manually.

I have set it up to be assigned as follows:

enter image description here

When I do a gpupdate /force and then follow up with a gpresult it shows that the GPO has applied successfully. However there's no add-in installed (and nothing in add/remove programs).

Also if I check the event logs, it shows the GPO as having installed.

Best Answer

It's my suspicion that either

Something in this plugin is angering Outlook, or, more likely
Something is causing this installation to roll back. (Antivirus? Something else that polices Outlook configuration?)

I'm assuming, since it's an Outlook plugin, that it has to run as the user.

I would experiment with a login script that checks for the installed plugin, and, if it's not there, runs a msiexec /i file.msi /quiet to see what happens. Yes, I know that's what the GPO is doing. As a test, you could run it as a login script with logging (msiexec /i Example.msi /Lime c:\temp\logfile.txt) so you'd have a record of any errors. That should at least help you debug.

Related Solutions

Windows – Published software not displayed in Add/Remove Programs

The GPResult output shows that the target computer account (i.e. the COMPUTERNAME$ Active Directory account for the machine you're using) doesn't have permission to the software deployment GPO you created.

The target account(s) (i.e. computer accounts, in your case) need both Read and Apply Group Policy permissions, in the Security settings for the GPO you've created. (At the bottom of the Security tab in the Group Policy Management console)

Note also that if the installation isn't silent (i.e. displays UI) and you've not created a silent installation MST for it, it'll hang the computer when it boots (while waiting for invisible user input), for 15/30 minutes.

Note that as of MS16-072, you need computer accounts to be able to read (only Read, not apply) group policy in order to be able to apply User policy. https://blogs.technet.microsoft.com/askds/2016/06/22/deploying-group-policy-security-update-ms16-072-kb3163622/

Deploying .msi application through GPO doesn’t work

Diagnosing 'silent' MSI installation failures can be done like this:

Firstly, check your GPO is applying correctly. Use the Group Policy Management Console to run a report on a target machine, and view this report to check that the GPO that assigns the software installation is applying correctly. If this part isn't working right then there's no point in going any further. Both a fault in the GPO in question or in any other GPO that should be applied before or alongside it can cause a workstation to stop processing GPOs.

With that done, check the event logs on the target machine:

Open Computer management -> event viewer -> Windows Logs - Application

You're looking for errors with a source of MsiInstaller (and any other events that get logged at the same time of course).

Finally, a lot of applications record their own log as part of the installation process. If you can find the local folder that the MSI installation was ran from then there may be a detailed error log inside that (of course, if you can find errors in the windows event viewer then this will hopefully also mention the application logfile and tell you where to find it)

Also check that the following setting is being applied to the target computers via GPO, and if not, set it and then run gpupdate /force from a command line on a target computer, and reboot.

Computer Settings

  -> Administrative Templates
    -> System
      -> Logon
        -> Always wait for the network at computer startup and logon – Enabled

Best Answer

Related Solutions

Windows – Published software not displayed in Add/Remove Programs

Deploying .msi application through GPO doesn’t work

Related Topic