Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I am having some trouble with my software GPO's and can't seem to find any answers using Google. I successfully deployed software using my policy but when I delete another, the uninstallation of the software does not take place. What I did:

  • Deployed software using a GPO, used gpupdate /force on the workstation to update, reboot, and install the software
  • Deleted another software installation by: Right-Click > All Tasks > Remove > 'Immediately uninstall the software from users and computers'

From there, I did another gpupdate /force to try and get the GPO to refresh and uninstall the software on the workstation. This did not work. I then forced replication between my domain controllers and ran another gpupdate /force on the workstation and this did not uninstall the software. There are not error logs or indications that the uninstall is being triggered when I go into the event viewer, and I know for a fact that the policy is working in other aspects.

So my questions is: Where do I look next to find the answer as to why GPO software deployments are working but un-installations are not, based off of what I have already tried?

Thank you in advance.

UPDATE: After using gpresult /z, there is no indication of a pending un-installation or removal of software. Under the section entitled "Software Installations", the software I am trying to uninstall is not listed. There is no other indication that the software I am trying to uninstall even exists. I also turned on RSoP logging and did (yet another) gpupdate /force to yield no blatant results. There is no indication that an uninstall event was even triggered, let alone incapability or failure.

Although I am sure I marked it to uninstall in case of two events (the falling out of the scope of management, as well as the removal of the entry), I am beginning to think the entry just never triggered something that should have been triggered.

UPDATE #2: After troubleshooting this (frustrating) application assignment, I have chalked it up as a fluke. I have tested with other software to make sure that the uninstall of other application assignments is actually working, so I am assuming it is something related to the package directly. There is the possibility that my problem resides in something related to what @joeqwerty linked in a comment below but because I can't go back in time, I don't think I will be able to prove it. I will probably be running a script via another GPO to guarantee the un-installation of left over package installs. For now, Evan Anderson is getting the answer because of the debugging information I was able to put to good use.

UPDATE #3: After Evan's edit in his answer, I did some more digging. When I deleted the application assignment from my GPO, I actually deleted 2 entries. One was for a previous version and one was for the most updated version (ie: program v1.0 and program v1.1, which updated program v1.0). I checked into the packageFlag for both of these, and one of them indicated that I in fact did not check "uninstall immediatley" (this is v1.0). The most recent update package (v1.1) was set to uninstall and had the following flag: -1610350320. I could not find a description for this flag using any of the resources I typically use, but I am assuming this indicates to uninstall the package immediately (vs -1610612464, which Evan indicated means to leave the package alone). Thank you very much Evan for showing me this resource, I did not know it existed! You were right also, "chalking it up as a fluke" does not sit well with me and I could not stop thinking about what happened.

Thank you to everyone that helped contribute so far!

share|improve this question
To clear up one question I have: Did the package correctly disappear from the list of packages in the GPO when you chose to uninstall it? – Evan Anderson Nov 13 '12 at 21:31
@EvanAnderson Yes, the application assignment (package) did disappear from the GPO. After rebooting from a gpupdate, it disappeared from the gpresults also. That is why this entire thing is odd to me, because I am positive that I deliberately checked the radio button to have it uninstall; it just never did. I also know I had checked the box (in the properties of the application assignment) to uninstall in the case of leaving the GPO scope. This alone should have triggered the application to uninstall on client machines. – burmat Nov 13 '12 at 21:38
I dropped on an edit to give you, perhaps, a bit more insight. – Evan Anderson Nov 13 '12 at 22:05
@EvanAnderson great, I will take a look tomorrow and let you know what I find. – burmat Nov 14 '12 at 3:17
@EvanAnderson I updated my answer again (#3). – burmat Nov 14 '12 at 15:27

3 Answers

up vote 1 down vote accepted

The next place to look is Resultant Set of Policy (or a gpresult /z) on one of the client computers to which this forced uninstallation is supposed to be taking effect. Depending on the Windows version on the clients (Windows Vista or newer versus Windows XP) you should be seeing some "Application Managements" in either the "System" or "Application" event logs (respectively). It's odd that you wouldn't be seeing any event log messages related to "Application Management".

Edit:

I strongly suspect you mistakenly chose "Allow users to continue to use the software, but prevent new installations" instead of "Immediately uninstall the software from users and computers".

To tell for sure you'll need to get the value of the "packageFlags" attribute from the "packageRegistration" object in the "Packages" sub-container of the "Class Store" sub-container of the "Machine" sub-container of the GPO where the package was assigned.

Looking at the description of the packageFlags attribute and comparing it to known packages in an AD on my side I can tell you that the packageFlags value for "Immediately uninstall the software from users and computers" is "-1610612592". The packageFlags value for a package that was set to "Allow users to continue to use the software, but prevent new installations" is "-1610612464".

Examining that might tell you exactly what happened. If you're anything like me you won't sleep well until you know the root cause of an issue.

share|improve this answer
There are logs in 'Application Management' but they only reference the successful application of other software policies. I am sifting through my RSoP logs now and will report back. I forgot about gpresult /z though, thank you for the refresher on that one! – burmat Nov 13 '12 at 19:31
I updated my question with a little more information you reference in this answer – burmat Nov 13 '12 at 20:39
TIL: /z shows you everything – MDMarra Nov 13 '12 at 20:49
up vote 1 down vote

Are you leaving the installation files in the location from which were originally installed? If they've been deleted or moved, the removal will fail.

Have you checked event logs for Application Management events? These will hold the clue to the problem.

For info, if the installation still fails, and you still have the .msi file available (location not important), you can force an uninstall by creating a computer start up script that executes the following:

msiexec /q /x \\path\to\installation.msi

The share containing the installation source has to be readable by 'everyone' (or more specifically the group 'Domain Computers')

share|improve this answer
The files still reside in their original location. There is no event in any of the 3 logs I've checked referencing software removal, errors, or warnings. I have seen how to uninstall MSI's in that manner and it will be my last resort, but may be necessary. Thank you for your answer – burmat Nov 13 '12 at 20:38
up vote 1 down vote

Do you mean without restarting the computer? The documentation states that the uninstallation occurs during a restart (machine scope) or logon (user scope):

Remove a managed application
http://technet.microsoft.com/en-us/library/cc758851%28v=ws.10%29.aspx

"...To specify that the application is removed the next time a user logs on or restarts the computer, click Immediately uninstall the software from users and computers."

share|improve this answer
I stating in my OG question that I have used rebooting in combination with gpupdate /force. I understand that typically software related GPO attributes don't apply until reboot. – burmat Nov 13 '12 at 20:09
1  
Perhaps this is the case: support.microsoft.com/kb/816102 - see the section labeled "Published Packages Are Displayed on a Client Computer After You Use a Group Policy to Remove Them". – joeqwerty Nov 13 '12 at 20:46
@joeqwerty Interesting.. I cannot verify the program was initially started after the installation of the software because it is in fact a test machine. What I can say, is that the software was started after the attempted uninstall (after the deleting of the software entry via the GPO). The program still functions and is installed as if nothing has happened. The section is slightly vague to me, but shows a different aspect I did not consider.. – burmat Nov 13 '12 at 21:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.