Group Policy Software Installation (GPSI) is an effective (and free) way to manage software deployment. After years of use, I have found these five common issues. Let’s walk through the top five issues and the solutions to a fix them! We will figure out why group policy software installation not working!
Problem 1: Does the GPO apply?
If the software isn’t installing on the computer, the first place to start is at the scope tab of your GPO. Basically, if the GPO can’t apply to the computer (or user) – the application won’t install. You can ensure the GPO is applying by running a GPResult on that computer and ensuring that the GPO applied and that the application appears under Software Installation.
If the software doesn’t appear, take a look at The Top 10 Ways to Troubleshoot Group Policy. One special note about software deployment. If you deploy the software to the user side (assigned or published), the GPO must be linked to an OU containing users (or you have to enable loopback).
Also remember that GPSI applies in the foreground. Installation can only happen on a reboot or logon (and only if the GPO was downloaded beforehand). In a default environment, it is easiest just to reboot twice. If you want to turn this into a single reboot, you can enable “Always Wait on the Network at Computer Startup or Logon”. Be aware that this will slow down startups/logons.
Problem 2: Does the software install quietly?
For an MSI to deploy through GPSI, it must be able to install silently. To test this, you only need MSIEXEC! To test quietly, here is your syntax:
msiexec /I “PATHTOYOURMSI” /QB /T “PATHTOMST”
and here is a practical example:
After the installation progress bar has completed (and MSIEXEC.exe has terminated in the Task Manager), you should be able to launch your application through any created shortcuts. If the application errors out during install, you most likely need to specify additional options in your MST file. An example of this would be Adobe Photoshop Elements. If you do not include the serial number in the install, it can’t be deployed through GPSI.
Problem 3: Where is the MSI?
As a best practice, do not store your MSIs in Sysvol. While it may look like a great way to create redundancy, it is going to be a management nightmare. Instead, set up a dedicated file server (or better yet – use DFS!) and organize your MSI structure. For our environment, we organize the MSIs by manufacturer – then product – then version. This vertical hierarchy allows us to easily find (or update) any piece of software.
The second point to consider is how you load the MSI into Group Policy. Whenever possible, use a DFS Namespace (first choice) or a UNC path (second choice) over an IP. IPs can change (though you should be using a reservation).
Problem 4: Can X access the MSI?
So even though your software is compatible, your users/computers that need to install this software might not be able to reach it. Take a look at the share and file/folder permissions where the MSI is located. If you are deploying to a computer, that computer needs Read/Execute. The same thing applies to a user. In our environment, we actually grant authenticated users read/execute to the share and root folder. This ensures that every deployed MSI always have the correct permissions.
Problem 5: Where are the logs?
If you’ve made it this far, you likely have an installation issue. This can be caused by a misconfigured machine, an old piece of software breaking the upgrade, or a missing component. Lucky for us, GPSI does a decent job logging these kind of issues. Open up event viewer on the troublesome machine and selection the system log. Filter the log to show any issues by Application Management Group Policy (the source) and to only show Warnings and Errors.
As you can see from the error above, GPSI couldn’t install this software until another logon has occurred. If you receive any strange MSI errors – just do a quick search on Experts-Exchange or AppDeploy for that error (ex: 1204) plus MSI. Because these error codes are consistent across nearly all MSIs, you don’t really need to search for your specific product.