I've set up a lab with 3 machines (2 Win7, 1 Win8) with the host being Win2008R2 acting as the DC (ADUC installed etc..).

I've created a software package GPO and linked it to my domain:

enter image description here

Here's the problem I'm having, I cant get the deployment to work. I've created a 'local' network share and allowed for all machines to have access to the location where the .MSI is located:

enter image description here

I've logged into each VM and run gpupdate /force multiple times but Firefox still won't deploy. It has deployed to my host (Win2008R2) after I by chance restarted which strikes me as a little odd.

Any ideas?

enter image description here Thanks

  • No, it's not odd. As the answers have stated, software deployment happens only on boot. You can't invoke it using gpupdate /force. – joeqwerty Oct 20 '12 at 14:50

GPO Software Deployment happens on boot. Running gpupdate /force isn't enough, you have to restart the workstations after.

Also, use a UNC path, not a drive letter, since the machines won't have any active drive mappings at the time of the install. \\server\share\file instead of U:\file, for example.


One thing about GPO deployment that is a bit... annoying from a management perspective is that software will only deploy after a reboot. You'll get one of those a month guaranteed thanks to the patching cycle (assuming WSUS is in use), but that's about it for guarantees.

The fact that it worked for your DC is suggestive that you've got at least the MSI part right. Maybe give the rest a reboot and see if it deploys.


Well, you don't provide quite enough information to answer this fully. However, from your images it appears you have setup a share and restricted permissions to the computer objects. You've also set your GPO to security filter on those computer objects. In your GPO, are you deploying your software in the Computer section, or the User section? If the User section, your policies won't apply because you've restricted access to the share & GPO to just the computers.

When you added the .MSI package to your GPO, did you do so using the path on the local share? The GPO should show the location of the .MSI as in that share.

Seems I forgot one of the more obvious things as well, have you rebooted your clients?

Without more info, that's at least a start.

  • I'm deploying the software on the Computer section and I've restarted the machines almost every time but to no avail. What other info can I give? – obious Oct 20 '12 at 16:23
  • A screenshot of the gpo settings for the Msi might shed more light. – HostBits Oct 20 '12 at 17:37
  • I've updated the question above – obious Oct 20 '12 at 19:47

Your deployment source is the admin share (c$). Unless you are giving the computer accounts admin rights to the server hosting the share, they won't be able to access the share. Create a regular share and grant everyone (or authenticated users) read permissions to the share and update your GPO accordingly to point to the new share.

  • How to I create a regular share? – obious Oct 20 '12 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.