SCCM 2012 R2 detection method not working

microsoft-officemicrosoft-office-2013microsoft-office-365sccmsccm-2012-r2

I'm creating an SCCM 2012 R2 application for Office 365. The install works fine (exits with code 0), however the application fails on detection. In testing, I'm trying a registry detection (as per this TechNet article and a folder detection (since the registry one doesn't work) with an "OR" relationship; if either are found, it should mark as successful.

After the package installs and "fails" detection, if I look at the filesystem and the registry, both of the two entries used in detection are there. I can see in AppDiscovery.log that it's trying and failing the detection, but it's not showing me exactly what it's testing and what it's getting back from the OS. I'm testing 32-bit Office on 32-bit Windows initially, so 32 vs 64 bit isn't an issue. I'm at a loss as to what to look at next; hopefully someone can put me on track?

Application Detections (with an OR relationship):

Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\O365ProPlusRetail - en-us
Filesystem: C:\Program Files\Microsoft Office 15\root\office15

AppDiscovery.log:

<![LOG[Entering ExecQueryAsync for query "select * from CCM_AppDeliveryType where (AppDeliveryTypeId = "ScopeId_C0FD4C5A-19CA-4D29-AE82-1FC626708B30/DeploymentType_306fa062-57f5-4481-b17a-8e9caeeba49f" AND Revision = 6)"]LOG]!><time="15:15:24.396-600" date="03-08-2016" component="AppDiscovery" context="" type="1" thread="156" file="appprovider.cpp:406">
<![LOG[    Performing detection of app deployment type Install - Microsoft Office 365 ProPlus x86(ScopeId_C0FD4C5A-19CA-4D29-AE82-1FC626708B30/DeploymentType_306fa062-57f5-4481-b17a-8e9caeeba49f, revision 6) for user.]LOG]!><time="15:15:24.399-600" date="03-08-2016" component="AppDiscovery" context="" type="1" thread="156" file="appprovider.cpp:2148">
<![LOG[+++ Application not discovered. [AppDT Id: ScopeId_C0FD4C5A-19CA-4D29-AE82-1FC626708B30/DeploymentType_306fa062-57f5-4481-b17a-8e9caeeba49f, Revision: 6]]LOG]!><time="15:15:24.416-600" date="03-08-2016" component="AppDiscovery" context="" type="1" thread="156" file="localapphandler.cpp:291">
<![LOG[+++ Did not detect app deployment type Install - Microsoft Office 365 ProPlus x86(ScopeId_C0FD4C5A-19CA-4D29-AE82-1FC626708B30/DeploymentType_306fa062-57f5-4481-b17a-8e9caeeba49f, revision 6) for S-1-5-21-977620602-469372654-314601362-40834.]LOG]!><time="15:15:24.416-600" date="03-08-2016" component="AppDiscovery" context="" type="1" thread="156" file="appprovider.cpp:540">

AppEnforce.log:

<![LOG[+++ Starting Install enforcement for App DT "Install - Microsoft Office 365 ProPlus x86" ApplicationDeliveryType - ScopeId_C0FD4C5A-19CA-4D29-AE82-1FC626708B30/DeploymentType_306fa062-57f5-4481-b17a-8e9caeeba49f, Revision - 5, ContentPath - C:\WINDOWS\ccmcache\2, Execution Context - System]LOG]!><time="14:55:26.517-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appprovider.cpp:1702">
<![LOG[    A user is logged on to the system.]LOG]!><time="14:55:26.517-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appprovider.cpp:2083">
<![LOG[    Performing detection of app deployment type Install - Microsoft Office 365 ProPlus x86(ScopeId_C0FD4C5A-19CA-4D29-AE82-1FC626708B30/DeploymentType_306fa062-57f5-4481-b17a-8e9caeeba49f, revision 5) for user.]LOG]!><time="14:55:26.521-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appprovider.cpp:2148">
<![LOG[+++ Application not discovered. [AppDT Id: ScopeId_C0FD4C5A-19CA-4D29-AE82-1FC626708B30/DeploymentType_306fa062-57f5-4481-b17a-8e9caeeba49f, Revision: 5]]LOG]!><time="14:55:26.574-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="localapphandler.cpp:291">
<![LOG[    App enforcement environment: 
    Context: Machine
    Command line: Setup.exe /configure Install.xml
    Allow user interaction: No
    UI mode: 1
    User token: not null
    Session Id: 1
    Content path: C:\WINDOWS\ccmcache\2
    Working directory: ]LOG]!><time="14:55:26.574-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appcontext.cpp:85">
<![LOG[    Prepared working directory: C:\WINDOWS\ccmcache\2]LOG]!><time="14:55:26.580-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appcontext.cpp:189">
<![LOG[    Prepared command line: "C:\WINDOWS\ccmcache\2\setup.exe" /configure Install.xml]LOG]!><time="14:55:26.581-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appcontext.cpp:338">
<![LOG[    Executing Command line: "C:\WINDOWS\ccmcache\2\setup.exe" /configure Install.xml with user context]LOG]!><time="14:55:26.582-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appexcnlib.cpp:205">
<![LOG[    Working directory C:\WINDOWS\ccmcache\2]LOG]!><time="14:55:26.582-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appexcnlib.cpp:219">
<![LOG[    Post install behavior is BasedOnExitCode]LOG]!><time="14:55:26.799-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appcommon.cpp:1094">
<![LOG[    Waiting for process 3624 to finish.  Timeout = 15 minutes.]LOG]!><time="14:55:26.802-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appexcnlib.cpp:2015">
<![LOG[    Process 3624 terminated with exitcode: 0]LOG]!><time="15:00:02.687-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appexcnlib.cpp:2024">
<![LOG[    Looking for exit code 0 in exit codes table...]LOG]!><time="15:00:02.688-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appexcnlib.cpp:508">
<![LOG[    Matched exit code 0 to a Success entry in exit codes table.]LOG]!><time="15:00:02.688-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appexcnlib.cpp:587">
<![LOG[    Performing detection of app deployment type Install - Microsoft Office 365 ProPlus x86(ScopeId_C0FD4C5A-19CA-4D29-AE82-1FC626708B30/DeploymentType_306fa062-57f5-4481-b17a-8e9caeeba49f, revision 5) for user.]LOG]!><time="15:00:02.762-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appprovider.cpp:2148">
<![LOG[+++ Application not discovered. [AppDT Id: ScopeId_C0FD4C5A-19CA-4D29-AE82-1FC626708B30/DeploymentType_306fa062-57f5-4481-b17a-8e9caeeba49f, Revision: 5]]LOG]!><time="15:00:02.955-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="localapphandler.cpp:291">
<![LOG[++++++ App enforcement completed (276 seconds) for App DT "Install - Microsoft Office 365 ProPlus x86" [ScopeId_C0FD4C5A-19CA-4D29-AE82-1FC626708B30/DeploymentType_306fa062-57f5-4481-b17a-8e9caeeba49f], Revision: 5, User SID: S-1-5-21-977620602-469372654-314601362-40834] ++++++]LOG]!><time="15:00:02.961-600" date="03-08-2016" component="AppEnforce" context="" type="1" thread="1904" file="appprovider.cpp:2450">

EDIT: Screenshots of detection rules as requested:

Best Answer

So for the record, a fair bit of reading around seems to show that detection methods are iffy; what works for some doesn't work for others. I've switched this from the registry-based detection to a MSI code-based detection, only to find that this won't work in Office 365 (2016), as it doesn't seem to "install" the ProPlus package, only a few helper packages.

The moral of the story seems to be to try different ways, find which one works for you, and use that. There is no hard and fast rule for the "best" method for everyone.

Also, FWIW, in the filesystem screenshot above, I missed that it was configured to look for a file, but I was supplying it with a folder. Reconfiguring for a folder seems to have worked. I still don't understand why the registry detection didn't work, but I'm past my current hurdle.

Empirical Results

I wrote some PowerShell that, when run as a detection script, dumps the environment variables that the detection script sees to a log file. That script is at the end of this answer.

I then cause this script to be run by the SCCM client by deploying a Deployment Type with different "Installation Behavior" and "Logon requirement" parameters. The results are in the table below:

Test InstallationBehavior LogonRequirement                   DeployedTo LoggedOnUser ScriptRunAs
---- -------------------- ----------------                   ---------- ------------ -----------     
1.1a Install for user     Only when a user is logged on      un2        un2          un2        
1.1b Install for user     Only when a user is logged on      cn1        un2          un2        
1.1c Install for user     Only when a user is logged on      cn1        un1          un1        
1.2a Install for system   Only when a user is logged on      un2        un2          un2        
1.2b Install for system   Only when a user is logged on      cn1        un2          cn1        
1.2c Install for system   Only when a user is logged on      cn1        un1          cn1        
1.3a Install for system   Whether or not a user is logged on un2        un2          un2        
1.3b Install for system   Whether or not a user is logged on cn1        un2          cn1        
1.3c Install for system   Whether or not a user is logged on cn1        un1          cn1

unX are usernames
cnX are computer names

Analysis

The above results are surprising because the context that a detection script runs in seems to depend in part upon whether the Application was deployed to a user or a system. This was enough of a surprise that I ran the tests a second time. The results were consistent.

We can tentatively draw the following hypotheses from the table above:

When an Application is deployed to a user, a PowerShell detection script for that Application is run as that user.
When an Application is deployed to a system and the Deployment Type is installed for the system, a PowerShell detection script for that Application is run as the system.
When an Application is deployed to a system and the Deployment Type is installed for the user, a PowerShell detection script for that Application is run as the logged-in user.

The above three hypotheses are supported by the test results. There may well be some other variables that weren't tested where these hypotheses do not hold. They are, at least, a good set of initial assumptions when using PowerShell detection scripts.

Mismatched Contexts (Beware!)

Jason Sandys documented a similar test of the rules for installation context. If you read that post carefully, you might notice that the rules for installation context and detection script context are not quite the same. Here are the offending rules:

When an Application's installation behavior is set to "Install as System" the installer is run as system [regardless of deployment to user].

When an Application is deployed to a user, a PowerShell detection script for that Application is run as that user [regardless of whether installation behavior is set to "Install as System"].

This means that an Application that has installation behavior “Install as system” and is deployed to a user collection will use the system context for installation, but the user context for detection.

Someone writing detection scripts for Applications where installation behavior is "Install as System" should be careful to avoid relying on any part of the environment that changes between the system and user contexts. Otherwise, detection of an Application deployed to a system collection may succeed while detection of the exact same Application deployed to a user collection fails.

Script

function Write-EnvToLog
{
    $appName = 'script-detect-test'

    $logFolderPath = "c:\$appName-$([System.Environment]::UserName)"

    if ( -not (Test-Path $logFolderPath -PathType Container) )
    {
        New-Item -Path $logFolderPath -ItemType Directory | Out-Null
    }

    if ( -not (Test-Path $logFolderPath -PathType Container ) )
    {
        return
    }

    $logFileName = "$appName`__$((Get-Date).ToString("yyyy-MM-dd__HH-mm-ss")).txt"

    $fp = "$logFolderPath\$logFileName"

    Get-ChildItem Env: | Out-File $fp | Out-Null

    return $true
}

try
{
    if ( Write-EnvToLog ) { "Detected!" }
    [System.Environment]::Exit(0)
}
catch
{
    [System.Environment]::Exit(0)
}

Best Answer

Related Solutions

Windows Updates not working via SCCM 2012 R2

Powershell – In what context do SCCM Powershell detection scripts run in

Empirical Results

Analysis

Mismatched Contexts (Beware!)

Script

Related Topic