Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to deploy a commercial product through Active Directory and a group policy; about a handful of computers are NOT downloading/installing the software. Anyone have any ideas/suggestions on what could be wrong?

The computers in question are connecting to the network, have the proper group policies applied, and have appropriate access to the shared folder from which the MSI is being deployed. Furthermore, there are no error or warning messages in the application and system logs.

share|improve this question
Have you tried running the installer manually from one of those machines? Did it install? – Zypher Aug 18 '11 at 16:01
@Zypher: Yes, we manually ran the MSI and it was successfully installed. – murphj Aug 18 '11 at 16:51

It's possible that for some reason or another, group policy is either not applying or not refreshing on those machines. You can verify this by running gpresult /H

share|improve this answer

If the GPO is applying and the installation is failing you'll be getting messages in the event log (Application Event Log on Windows XP, the "Group Policy" log on Windows Vista / 7).

Does Resultant Set of Policy (RSoP) show the software being assigned? If it doesn't check out the "Security" tab of the software assignment itself and make sure the computer has rights to "Read" the software assignment (not the "Security" tab of the GPO-- the assignment within the GPO).

If you're sure the GPO is applying and assigning the software to the PC kick up Group Policy logging (to an insanely verbose level) and sift thru the event log by creating a REG_DWOORD value "RunDiagnosticLoggingGlobal" at "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics" and setting it to "1" on one of the affected computers.

I'm perplexed that you're not seeing anything in the Event Log. That makes me think that the assignment isn't being applied (and that it's a GPO application problem). I suppose there's also the chance that your event log is set to "Overwrite events after x days" and is full, too, and you're not seeing new messages but, hopefully, you've checked that.

share|improve this answer

Have you verified that the target computers have the necessary software dependencies installed (Service Packs / .NET framework). I've had remote installations fail for this reason.

I would also try installing another MSI via GPO to isolate if the issue is with the policy or with the MSI you're trying to install.

share|improve this answer
We've manually checked that the computers are up-to-date; plus, they're monitored by a WSUS. As for the MSI itself, it has successfully been downloaded and installed on numerous other machines, so it appears the issue(s) is not with the MSI or GPO. – murphj Aug 18 '11 at 16:53

In my experience, the Component Status section of an RSOP (Resultant Set Of Policy) report is very helpful when dealing with failed software installation policies. In the past, I've seen machines asking for a reboot over and over and I found that I needed to set the "Always wait for the network at computer startup and logon" policy to Enabled to slow down GPO processing enough for software to install.

If you launch the Group Policy Management console (gpmc.msc), there is a section for Group Policy Results. This is similar to running gpresult, but it's a bit more readable.

  1. Right-click the Group Policy Results "folder".
  2. Click the Group Policy Results Wizard option.
  3. Enter the computer name into the wizard where prompted.
  4. Select the username from the Select A Specific User listbox when prompted.
  5. Click Next and Finish as needed.
  6. You will see an entry titled %USER% on %COMPUTER% under the folder. Click on it.
  7. Under the Summary tab, you should be able to see a Computer Configuration Summary and a User Configuration Summary.
  8. Under each summary, you should see
    • General information about the machine
    • Group policy objects that were applied and denied
    • Security group membership at time of GP processing
    • WMI Filters and their results
    • Component Status

Under Component Status, there is a Software Installation entry that should give you more information about what's happening.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.