Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am new to GPO push install. I just configured a group policy to push install a software for machines in the domain. However, it fails with error code 1603.

The following is the log appmgmt on the client.

07-27 17:14:16:775 
Software installation extension has been called for foreground synchronous policy refresh.
The following policies are to be applied, flags are 1.
    SecureAge Distribute (unique identifier {AE19597D-CBD3-42EF-AEE8-09FBBFA13171})
        System volume path = \\dev.sa.com\SysVol\dev.sa.com\Policies\{AE19597D-CBD3-42EF-AEE8-09FBBFA13171}\Machine
        Active Directory path = LDAP://CN=Machine,cn={AE19597D-CBD3-42EF-AEE8-09FBBFA13171},cn=policies,cn=system,DC=dev,DC=sa,DC=com
Set the Active Directory path to LDAP://CN=Class Store,CN=Machine,cn={AE19597D-CBD3-42EF-AEE8-09FBBFA13171},cn=policies,cn=system,DC=dev,DC=sa,DC=com;.
Enumerating applications in the Active Directory for computer CHENBOXPSP3X32 with flags 5.
CSTORE: Retrieving class store path for the system account.
CSTORE: Retrieved 1 class stores for the user or machine.
CSTORE: Attempting to bind to class store 0 with path LDAP://CN=Class Store,CN=Machine,cn={AE19597D-CBD3-42EF-AEE8-09FBBFA13171},cn=policies,cn=system,DC=dev,DC=sa,DC=com.
CSTORE: Bind attempt returned error code 0.
CSTORE: Enumerating packages with search filter (&(objectclass=packageRegistration)(|(|(msiScriptName=*A*)(&(canUpgradeScript=*)(msiScriptName=*P*)))(!(msiScriptName=*)))) and flags ce00000.
CSTORE: Examining retrieved package SecureAge.
The following applications were found in policy SecureAge Distribute.
    Assigned application SecureAge (flags a0004c70).
Found 1 applications in policy SecureAge Distribute.
Enumerating the managed applications which are currently applied to this user.
No managed applications are currently applied to this user.
Found 0 applications locally that are not included in the set of applications from the Active Directory.
Application SecureAge from policy SecureAge Distribute is set for installation because it is assigned to this computer policy.
Assigning application SecureAge from policy SecureAge Distribute.
Calling the Windows Installer to advertise application SecureAge from script C:\WINDOWS\system32\appmgmt\MACHINE\{e7b03277-41c7-41b4-8863-cffe4d61237e}.aas with flags 69.
Windows Installer cannot advertise application SecureAge from script C:\WINDOWS\system32\appmgmt\MACHINE\{e7b03277-41c7-41b4-8863-cffe4d61237e}.aas, error 1603..
The assignment of application SecureAge from policy SecureAge Distribute failed.  The error was : %1603

And

Removing application SecureAge from the software installation database.
Calling Windows Installer to remove application advertisement for application SecureAge from script C:\WINDOWS\system32\appmgmt\MACHINE\{e7b03277-41c7-41b4-8863-cffe4d61237e}.aas.
Windows Installer cannot remove application advertisement for application SecureAge from script C:\WINDOWS\system32\appmgmt\MACHINE\{e7b03277-41c7-41b4-8863-cffe4d61237e}.aas, error 1603.
The removal of the assignment of application SecureAge from policy SecureAge Distribute failed.  The error was : %1603

Policy Logging for Software Management is attempting to log application SecureAge from policy SecureAge Distribute.
Failed to apply changes to software installation settings.  Software changes could not be applied.  A previous log entry with details should exist.  The error was : %1603

And

Software installation extension returning with final error code 1603.
07-27 17:14:25:665 
Software installation extension has been called for foreground synchronous policy refresh.
The following policies are to be applied, flags are 80.
    SecureAge Distribute (unique identifier {AE19597D-CBD3-42EF-AEE8-09FBBFA13171})
        System volume path = \\dev.sa.com\SysVol\dev.sa.com\Policies\{AE19597D-CBD3-42EF-AEE8-09FBBFA13171}\User
        Active Directory path = LDAP://CN=User,cn={AE19597D-CBD3-42EF-AEE8-09FBBFA13171},cn=policies,cn=system,DC=dev,DC=sa,DC=com
Set the Active Directory path to LDAP://CN=Class Store,CN=User,cn={AE19597D-CBD3-42EF-AEE8-09FBBFA13171},cn=policies,cn=system,DC=dev,DC=sa,DC=com;.
Policy has not changed.  Only assigned applications will be advertised.
Enumerating the managed applications which are currently applied to this user.
No managed applications are currently applied to this user.
Found 0 applications locally that are not included in the set of applications from the Active Directory.
Software installation extension returning with final error code 0.

I tried to search things like "Windows Installer cannot advertise application ... from script ...", but get no hint.

Also, there is no log for the msi installation in the %temp% folder.

Edit: The event information in the application event is the following:

Event ID: 101 (error)
The assignment of application SecureAge from policy SecureAge Distribute failed.  The error was : Fatal error during installation. 

Event ID: 103 (error)
The removal of the assignment of application SecureAge from policy SecureAge Distribute failed.  The error was : Fatal error during installation. 

Event ID: 108 (error)
Failed to apply changes to software installation settings.  Software changes could not be applied.  A previous log entry with details should exist.  The error was : Fatal error during installation. 

Event ID: 1085 (error)
The Group Policy client-side extension Software Installation failed to execute. Please look for any errors reported earlier by that extension.

I followed this link to setup the group policy as I cannot post the screenshot since I am new. http://support.microsoft.com/kb/816102

The problem happens for both windows XP and 7 32bit hosts. The hosts run in VMWare.

Edit 2: I tried to use startup script to install the package, it works for Windows 7 client. During the startup phase in Windows 7 client, a pop-up of Interactive Services Detection window shows the installed software wants to show some message. Other than that, the installation works fine, no input is required during the installation process. Note that manual installation of the msi shows a message that restart is required after the installation.

The startup script is the following:

Set WshShell = CreateObject("WScript.Shell")
Set objFso = CreateObject("Scripting.FileSystemObject")
If Not objFso.FileExists("C:\Program Files\SecureAge\bin\SecureAge.exe") Then
    WshShell.Run "\\192.168.0.145\DPoint\SecureAge.msi"
End If 

Note: the startup script installation only works in Windows 7, but not in Windows XP.

Edit 3: the screenshot of the group policy:

enter image description here

Can anyone please help me with the issue.

Thanks and regards

share|improve this question
    
Hi Chen, do you get any group policy errors on the client too? Please list all Event IDs etc first in a list, then the errors below, I find your post quite hard on the eyes! What package are you trying to push, and to what client OS? –  Alex Berry Jul 27 '12 at 9:44
    
Thanks Alex. I am trying to push our own msi installer to Windows XP and 7 machine. The local installation of the msi works fine. The event ids and the errors are added to the questions. –  Chen Bo Jul 27 '12 at 9:51
    
Ok.. Could you please provide screen shots of the settings in group policy so they can be verified, either that or list all the steps you went through. Add all this info in to your original question, including the detail concerning Windows XP and Windows 7, so that others can see this readily. –  Alex Berry Jul 27 '12 at 9:53
    
Could you also specify whether all your clients are 32 bit, 64 bit or mixed, and whether the issue affects all clients or just one version. –  Alex Berry Jul 27 '12 at 9:56
1  
Yeah, that GPO screenshot or info is kind of important. Type it out, or failing that, screenshot it and post a link to it on some image hosting site. A user with more privileges can edit it into your post. It might also be helpful to try installing this via a GPO, with a startup script to narrow down where the problem is. Maybe the .msi is damaged or something. –  HopelessN00b Jul 28 '12 at 16:51

2 Answers 2

up vote 2 down vote accepted

1603 fatal errors usually are caused by one of two things: the account doing the installation can't write where it needs to, or the installation package is corrupted. Since you've ruled out #2 by doing an install with it, I'll assume it's #1.

When you use a computer-based software installation GPO, what you're doing is installing the software as the SYSTEM account. Some software installers misbehave and require that data be written to the installing user's profile. The SYSTEM account doesn't have a traditional profile like other user accounts do, which gives the illusion that required directories do not exist. This could explain why a logon script or manual install works - neither run as SYSTEM.

I'd check with your software vendor and make sure that this software can be deployed the way that you are trying, since all signs point to the software installer itself being the culprit.

share|improve this answer
    
MDMarra, thanks for the help. However, it works in Windows 7 when the startup script installs the msi package which also use SYSTEM account. (But it does not work in XP) Please see Edit 2 in the question. –  Chen Bo Jul 31 '12 at 2:50
    
Ah, I missed that. Maybe the GPO is corrupt? Have you tried deleting it and creating a new one? –  MDMarra Jul 31 '12 at 10:48
    
I created a new one, but still does not work. The same error message. –  Chen Bo Aug 1 '12 at 3:27
    
Does the msi install in XP if run manually? –  Alex Berry Aug 1 '12 at 11:14
    
Yes, it installs in XP manually. The problem of startup script with XP is it pops up RUNAS window which requires user input to install. If the correct RUNAS is selected (say System), it also installs correctly with startup script. But because of this user input, I consider it not work in XP since user can cancel the install. –  Chen Bo Aug 2 '12 at 6:40

Please try the following:

  1. Please check that the share in which you are hosting this msi has the following share and NTFS security permissions: Group "Domain Computers" has read rights.

    Permissions Entry Window

  2. Double check is that the path to the MSI file in the script uses a UNC path. E.G. \\dataserver1\msis\msi_installer.msi rather than e:\msis\msi_installer.msi

  3. Check that the package is compatible with installing via GPO. In order for it to be compatible it needs to be able to install with no user interaction, to test this log on to a computer where it is not installed, copy the msi file to somewhere local such as the root of the C:\ drive and type "msiexec /i C:\path_to_msi.msi /quiet". If it installs correctly it is compatible, if not it will need to be repackaged

share|improve this answer
    
Yes, everyone has read and execute rights. But, it did not work. –  Chen Bo Jul 30 '12 at 7:52
2  
There's absolutely no reason to give Everyone access to the share. The minimum required is "Domain Computers - Read" for GPO computer installation and "Authenticated Users - Read" for user-based software deployment. Giving the Everyone group permission to anything is usually always not recommended. Not to mention that you didn't specify anything about the underlying NTFS permissions, which are the ones that actually matter. –  MDMarra Jul 30 '12 at 12:47
1  
Comments aren't required to downvote. And I downvoted because, although your answer may point the OP in the right direction, it is potentially dangerous. It's like telling someone to chmod -R 777 a directory to make something work. You just don't do it. –  MDMarra Jul 30 '12 at 12:56
2  
Also, your edit is still incorrect. It's safe to assume that this is computer-based GPO deployment, which would generate access denied with the current ACLs. Luckily for me, I don't have to do anything that you're demanding. :) There's a reason that voting is anonymous. If you have a problem you can post it on Meta Server Fault or discuss it in Server Fault Chat –  MDMarra Jul 30 '12 at 13:00
2  
Apparently you have a reading comprehension problem. Read through my comment again and you'll see that I say the minimum required ACE for computer-based deployment is "Domain Computers - Read". Like I said, feel free to join Server Fault Chat if you'd like to discuss it further. –  MDMarra Jul 30 '12 at 13:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.