App not being installed by GP

  • Thread starter Thread starter Sheldon
  • Start date Start date
S

Sheldon

I have an .msi file for some software. (macafee virus
scan). I pre-configured the settings using one of their
tools. There is a policy set up to push out the software.

A look at the debug file shows that the GP is being
applied. It will appear in Add/Remove programs but does
not launch nor show up on the Start Menu. It should auto
start the background scanner when the install is complete.
No luck.

The appmgt file has this line: Mcafee Virusscan Enterprice
from policy viruscan install with state 509 and assign
count 1. I cannot find any reference to these ID's. What
the heck am I missing?

Thanks,

Sheldon
 
The policy applies against the computer config. It is
applied to the OU where the computer account resides. The
domain computers group is also listed with read and apply
group policy rights.

Any and all ideas are gratefully acknowledged!

Sheldon
 
Dose Authenticated Users group also have at least Read and Apply Group
Policy at the Security permissions for the GP Object. I think I have did the
same as you. removed the Authenticated Users group and added a Group set of
computers. I don't think that's a possible solution.
--
Regards,

Christoffer Andersson
No email replies please - reply in the newsgroup

http://www.itsystem.se/employers.asp?ID=1
 
That group does have rights. It does appear that the
policy is making it to the machine and seems to be there
as evidenced by the listing in the Add/Remove programs
page. It just doesn't seem to want to launch.

Thanks, Chris.

Sheldon
 
I have the same problem, but for users - still can't figure out why!! If
y'all have any other insights, i'd appreciate to hear them.

The scenario is as following: I have a Windows 2003 Server network with a
few Windows XP workstations. I went ahead and set up AD, DNS and DHCP,
created OUs, Groups and Users for the AD, and defined a few GPOs to regulate
some look-and-feel (IE title bar, homepage, background, etc), and activated
Folder Redirection. None of the users in the groups to which I've applied
these GPOs are power users. I was able to log on to the workstations and
see that the policies applied successfully.

I then went on to see whether software deployment works just as easy, and
assigned the AdminPack to a group of test users, also not local or domain
power users/admins. I wanted to assign the software to be installed at
logon. When logging on, I do see information that the package is installing
("Installing Windows 2003 Administration Pack"), but when the logon
completes, the package is no where to be found installed. I tried going
into Control Panel - Add/Remove Programs and adding it from there (where it
is listed), but then I get the error that I do not have administrator rights
and therefore cannot install this package. "Log on as administrator and
then try again."

I read and re-read every article and every chapter of books about GPO
deployment for Win2k and Win2k3 and no where is there a specification that
users have to have administrator rights on the workstations to be able to
have software deployed via GPOs. Furthermore, that's what I thought was the
great thing about GPO software deployment - that you don't have to be an
administrator locally, and thus your users (a) won't have the right to
install and mess up the systems with other software and (b) all the ads and
stuff that otherwise installs automatically when people surf with local
admin rights will now no longer stand a chance. Anyway, I have spent the
last 2 weeks trying to find an answer and couldn't find one, and I would be
GRATEFUL if you could send me some feedback/advise.

Thank you so much,

Mike
 
The problem you're experiencing with the Windows 2003 Server adminpak.msi
package is that it has a LaunchCondition that specifically enforces AdminUser.
You can use a tool like Orca available in the Windows Installer SDK <
http://www.microsoft.com/msdownload/platformsdk/sdkupdate/ > to view an
installation package. If you navigate to the LaunchCondition table within Orca,
you'll see the following LaunchCondition:

Condition: AdminUser OR REMOVE="ALL"
Description: You do not have sufficient privileges to complete this
installation. Log on as an administrator and try again.

For a non-admin user to install the package when approved by an admin, the
condition would have to replace AdminUser with Privileged. The benefits of GPO
software are as you state, but some packages are still authored to enforce admin
requirements for installation. If you consider the installation package for
Office 2003, you'll find that the LaunchCondition looks like this:

Condition: Privileged OR ACTION~="ADMIN"
Description: In order to install [ProductNameBase], you must either be an
administrator or have [ProductNameBase] approved by an administrator. Contact
your administrator for more information.

Notice that Privileged basically says that you must either be admin or have had
the product pre-blessed by an admin. (You can find more information on the
Privileged property at <
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/msi/setup/privileged_property.asp
. The Office 2003 package takes into account deployment to non-admin users.
Click to expand...

Hope this helps,
- Carolyn Napier
Microsoft Windows Installer Team


--
This posting is provided "AS IS" with no warranties, and confers no rights.
Please do not send email directly to this alias. This alias is for newsgroup
purposes only.
MSI FAQ:
<http://www.microsoft.com/windows2000/community/centers/management/msi_faq.mspx>
 
Back
Top