I am trying to deploy an MSI via GPO, without success. It is an Outlook plugin, and the MSI works (from that location) if I install it manually.

I have set it up to be assigned as follows:

enter image description here

When I do a gpupdate /force and then follow up with a gpresult it shows that the GPO has applied successfully. However there's no add-in installed (and nothing in add/remove programs).

Also if I check the event logs, it shows the GPO as having installed.

  • Is this in a user configuration or a computer configuration? If it is in the user configuration, does the user have rights (administrative) to install software on their PC? If it's in the computer policy, have you granted domain computers read access to the share where the MSI is located?
    – MDMarra
    Mar 25 '14 at 15:45
  • It's in the user section. The user does not have permission to install, but this msi is set to only modify HKCU so shouldn't need elevation. (If I run the MSI manually it doesn't prompt for elevation.)
    – Ben
    Mar 25 '14 at 15:48
  • And you can install the MSI with zero interaction/prompts manually? i.e. a simply msiexec file.msi /qb will correctly install it - that is essentially what the GPO is doing? And the users in question can read the MSI on the share?
    – MDMarra
    Mar 25 '14 at 15:57
  • Exactly that - I've been installing with msiexec /i file.msi /quiet and it works fine
    – Ben
    Mar 25 '14 at 17:05

It's my suspicion that either

  1. Something in this plugin is angering Outlook, or, more likely
  2. Something is causing this installation to roll back. (Antivirus? Something else that polices Outlook configuration?)

I'm assuming, since it's an Outlook plugin, that it has to run as the user.

I would experiment with a login script that checks for the installed plugin, and, if it's not there, runs a msiexec /i file.msi /quiet to see what happens. Yes, I know that's what the GPO is doing. As a test, you could run it as a login script with logging (msiexec /i Example.msi /Lime c:\temp\logfile.txt) so you'd have a record of any errors. That should at least help you debug.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.