0

As a company, we have purchased new anti-virus software and want to install it to all our computers through group policy.

The installer is an .exe and we have been provided with a .bat file to use on startup, however I've noticed that the script does not run (most of the time).

I tried troubleshooting the problem and I have partly amended script to log when it is run, this has helped me find that the issue is not with the script itself but that it is not even being run

@echo off
For /f "tokens=1-3 delims=/ " %%a in ('date /t') do (set mydate=%%c-%%b-%%a)
For /f "tokens=1-2 delims=/:" %%a in ('time /t') do (set mytime=%%a%%b)
ECHO [%mydate%_%mytime%] %USERNAME%  sophos script run>>"\\server11\client_install\Sophos\Client\Logger.txt"

SET MCS_ENDPOINT=Sophos\Management Communications System\Endpoint\McsClient.exe
IF "%PROCESSOR_ARCHITECTURE%" == "x86" GOTO X86_PROG
IF NOT EXIST "%ProgramFiles(x86)%\%MCS_ENDPOINT%" GOTO INSTALL
exit /b 0

:X86_PROG
IF NOT EXIST "%ProgramFiles%\%MCS_ENDPOINT%" GOTO INSTALL
exit /b 0

:INSTALL
ECHO [%mydate%_%mytime%] %USERNAME%  sophos installation>>"\\server11\client_install\Sophos\Client\Logger.txt"
pushd \\server11\client_install\Sophos\Client
SophosSetup.exe --quiet
Popd

There is nothing wrong with the script, everyone has read access to the file and folder. And for testing purposes everyone has write access to Logger.txt

What puzzles me mostly, is that the script is run sometimes. The policy has been linked to 3 organisational units containing a total of 40 computers (some laptops, some desktops). This morning the script has been run by 2 computers, but at least 30 have been started up today.

I'm quite new to servers and group policies so everything that I have mentioned and tried below is new to me.

Things I have tried:

  1. Changing it to run script at logon instead of startup (and linked the policy to the OU storing the users)
  2. Enabled 'Run startup scripts asynchronously'
  3. Storing the batch file in the same folder as the .exe
  4. Storing the batch file in the folder provided by the policy
  5. Checked gpresult (the policy can be seen)
  6. Changed startup to run on 0 minutes after boot
  7. Changed startup to run after 30 minutes after boot

The server is Windows Server 2012 R2 and all computers are running Windows 10 Pro (1803)

Current setup: screenshot of policy

  • Do you have an MSI file to install this antivirus, or just the EXE ? Can you provide us the exact Policy that you are configuring ? (with the full path, like Computer Configuration, Administrative Templates, etc...). Can you give us some details about the items 6 and 7 of your list ? – Swisstone Oct 15 '18 at 16:55
  • No MSI unfortunately. I will amend my question to show a screen shot of the current configuration. I'm now struggling to find where I configured 6 and 7 (I have tried so many different things, and I can only test this once per day). 6 and 7 might have been run X minutes after logon (Comp Config / Admin Templates / System / Group Policy / Configure Logon Script Delay) – smally Oct 16 '18 at 8:41
  • Just for your information and maybe anyone else who sees this if the script is a startup script it runs under the system context and if it is a logon script it runs under the user context (which more than likely does not have the correct rights to install software). – JBaldridge Oct 25 '18 at 21:45
1

By default, workstations do not wait for the network at startup, so the phase where scripts execute is usually past by the time the network initializes.

Group Policy Management Console:

Computer > Administrative Templates > System > Logon
Always wait for the network at computer startup and logon: Enabled

Also, you should copy the installer local and execute from a local folder.

  • I have created a policy to do what you said, and followed similar advice here [link]community.spiceworks.com/topic/… to Specify startup policy processing wait time as 120s. It is still only sometimes being run. The policy is assigned to just over 100 computers, the script was run only 10 times yesterday and 4 times today. – smally Oct 26 '18 at 9:49
  • @smally: time to enable group policy debug logging: blogs.technet.microsoft.com/askds/2015/04/17/… – Greg Askew Oct 26 '18 at 11:54

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.