I'm looking to install our latest AV suite through a GPO Software Installation policy. (As in the below screenclip.)

enter image description here

Unfortunately my request to use DFS has been denied and I'll need to create a GPO for each site in our environment (each site is its own subnet). The issue I have is that a lot of users travel between sites, so as they move to another site, they will get the new GPO and fall out of scope on the previous GPO.

I can't find any concrete documentation as to whether the GPO software install will re-install an application if it already exists on the current PC. I will be using the option to leave the app when the computer falls out of scope.

From my research I found that the GPO will only apply if the version of the GPO has changed, which is fine, but what about the actual MSI?

I've found two scenarios that people put forward but cant back up:

  1. The GPO calls the Windows Installer service that checks the installed programs list and will install only if the current MSI version is not there.

  2. The GPO install keeps its own APP cache with it's own list of software, and will install the app if it's not in that list, even if it is already installed.

Can anyone confirm the correct information for me?

EDIT: Thanks for the responses guys, I'm aware of other alternative ways to deploy software, however what I'm after is a concrete answer as to whether a GPO deployment will re-install a package if it already exists on the workstation.

  • "our latest AV suite with ADSI through a GPO"? Elaborate please – Mathias R. Jessen Jan 19 '14 at 23:04
  • We are swapping Symantec Enterprise Protection for Tren-Micro OfficeScan. We need to deploy the client (which will also uninstall the SEP client). – mhouston100 Jan 19 '14 at 23:24
  • Active Directory Software Install's, it's mentioned in the Technet documentation for deploying software with GPO's. I'll just remove it, saves any further clarity issues. – mhouston100 Jan 20 '14 at 0:45
  • 1
    @mhouston100 In response to your edit, YES, software installation GPOs can and will reinstall software that's already installed. In your scenario, this is something you'll have to put in some work to prevent, such as the suggestion in Greg's answer. – HopelessN00b Jan 20 '14 at 22:57
  • I just want you to be forewarned: Through version 7, at least, the Trend Micro-generated MSIs are terrible and I've had a significant number of machines end up in a "half-installed" state because of them. I also want to concur w/ HoplelessN00b - The software most assuredly will attempt to reinstall. – Evan Anderson Jan 20 '14 at 23:09

When I've had to do this in the past, I've avoided the Software Install GPO because they're limited and cause as many problems as they solve.

EDIT: In response to your edit, YES, software installation GPOs can and will reinstall software that's already installed. (Which is one of the problems they cause - far from the only one, though.) In your scenario, if you elect to use the Software Installation GPO, this is something you'll have to put in some work to prevent, such as the suggestion in Greg's answer.

When I've had to use GPOs to install software, the way I've done it in the past is to use GPO that kicks off a scripted install which checks to make sure the thing isn't installed already. See example below, for installing PC*Miler26 shudder to a bunch of XP machines.

The screenshot show the startup script GPO pointing at a location on our corporate DFS, (which I've redacted) and the script itself is a bat file, due to the limitations in our environment - with XP machines, and WMI being frequently broken on our clients, that's the only thing that works reliably.

enter image description here

echo off
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\ALK Technologies\PC*Miler 26.0"
if %errorlevel%==1 (goto Install) else (goto End)

REM If errorlevel returns a value of 1, it means the key is not present, thus the program is not installed.  So install it.
\\[Our DFS software share]\PCMiler26\Network\setup.exe /s

REM If errorlevel returns a value other than 1, the key is present, and the program is already installed, or something odd's going on.  No installation.

  • Thanks for the response. We have been using login and GPO scripts for quite a while but I was looking for a different, more managed approach. The problem wouldn't exist if we used DFS but that's off the table. Are you aware of any info or doc's regarding the definite effect of cross GPO installs? – mhouston100 Jan 20 '14 at 21:40
  • @mhouston100 No documentation, sorry. I've just avoided it altogether since it's caused me more problems than it solves. If I can't deploy something via SCCM, I do it as in my post, and skip the headaches that I've always encountered with the Software Installation GPO "feature." – HopelessN00b Jan 20 '14 at 21:48
  • I'm angling so hard to get SCCM but the cost is extremely prohibitive to our company unfortunately. I'll keep looking, I don't think GPO deployment is going to cover it this time... spewing. – mhouston100 Jan 20 '14 at 22:17

If it is a different GPO, it may attempt to reinstall. If it actually completes the reinstall depends on the package. Software Installation GPO's have numerous limitations and are not the most flexible method to deploy applications. You should only use it if you don't have a real deployment solution like BigFix or SCCM.

You can workaround this by creating a filter to specify a Group Policy Preference to look for a tag that would indicate if the application is installed. For example, if the ntrtscan service does not exist.

More info here:


Note the example at the bottom. You would create an item-level targeting filter for a service that does not exist.

  • Good link for the item-level targeting, I think that will be the way that we go tp solve the individual issue. However it still doesn't provide any concrete answers to the question of how the re-install mechanism works and if it will absolutely without a doubt try to install again if the app already exists. – mhouston100 Jan 20 '14 at 2:51

I know this is an little old, but I was looking into something related to this and thought I'd share my experience too.

It depends on how you assign applications. Also GPO Applied applications are mostly bad. In my testing, I've assigned it via computers (2012 R2 Domain to Win7 computer, tested with Kaspersky MSI).

To test, I made a copy of the GPO that deployed the MSI and applied it to the previously linked OU. I ran a gpupdate /force and was not prompted to restart the computer(which means no changes were applied to the computer). To confirm the GPO applied, ran gpresult /R and confirmed Copy_of_GPO was bieng applied. To double check how the GPO was treating the installer, I looked up what the registry said in. "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt\" (thanks to Assigning software through group policy - how does client know if the package is installed or not) The GPO GUID of COPY_of_GPO showed up in GPOs. A single instance of Product ID was under AppMgmt and held the initial GPO GUID as it's source GPO.

Where this goes bad; Say you then un-link either one of the GPOs. Since the GPO that applies the MSI is no longer applied, the MSI is removed. Even if the other GPO assigned it. This hiccup matters because apparently GPOS that are applied are enumerated before their settings are applied(which is why if you assign multiple programs with multiple GPOs they all install at the same time). If GPOs that apply a software are processed and removed, a (losing) race condition is created. The GPO GUID exists but the PKG GUID that it contains doesn't.

This gets even worse with AV which can have issues with windows installs/uninstalls. In fact, Kaspersky even has a standalone uninstaller for removal of their own client. AV doesn't like to go away.

This gets even more compicated with a poorly setup MSI.

TL:DR Don't use Assigned Applications via GPO, especially with AV.

Extra Reading: https://msdn.microsoft.com/en-us/library/cc782152%28v=ws.10%29.aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.