What is wrong with my file permissions for Group Policy software deployment?

Question

I'm trying to deploy Google Chrome Enterprise via Group Policy. Following Google's guide I created a GPO, linked it to an OU, imported the ADX file with the policies (which deploy fine by the way). I created a folder on a file server with the msi installer. The permissions are set so that Domain Computers have read & execute permission. The software installation policy is set under Computer Configuration so it will be deployed on specific computers.

From what I understand if you have the software installation policy set under computer configuration you need the Domain Computers account to have read/execute permission because the software will be installed before a domain user account is logged in. I enabled MSI logging and I get this in the log file:

SOURCEMGMT: Media enabled only if package is safe.

SOURCEMGMT: Looking for sourcelist for product {b5fd80c4-8da4-3815-958f-d6e4afb1c5d0}

SOURCEMGMT: Adding {b5fd80c4-8da4-3815-958f-d6e4afb1c5d0}; to potential sourcelist list (pcode;disk;relpath).

SOURCEMGMT: Now checking product {b5fd80c4-8da4-3815-958f-d6e4afb1c5d0}

SOURCEMGMT: Media is enabled for product.

SOURCEMGMT: Attempting to use LastUsedSource from source list.

SOURCEMGMT: Processing net source list.

SOURCEMGMT: Trying source \[server][share]\IT\Software\GroupPolicyDeploy.

Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2

Note: 1: 2303 2: 5 3: \[server][share]\

Note: 1: 2303 2: 5 3: \[server][share]\

Note: 1: 2303 2: 5 3: \[server][share]\

Note: 1: 1325 2: GroupPolicyDeploy

ConnectToSource: CreatePath/CreateFilePath failed with: -2147483648 1325 -2147483648

ConnectToSource (con't): CreatePath/CreateFilePath failed with: -2147483648 -2147483648

SOURCEMGMT: net source '\[server][share]\IT\Software\GroupPolicyDeploy\' is invalid.

Note: 1: 1706 2: -2147483647 3: GoogleChromeStandaloneEnterprise64.msi

SOURCEMGMT: Processing media source list.

Note: 1: 2203 2: 3: -2147287037

SOURCEMGMT: Source is invalid due to missing/inaccessible package.

Note: 1: 1706 2: -2147483647 3: GoogleChromeStandaloneEnterprise64.msi

SOURCEMGMT: Processing URL source list.

Note: 1: 1402 2: UNKNOWN\URL 3: 2

Note: 1: 1706 2: -2147483647 3: GoogleChromeStandaloneEnterprise64.msi

Note: 1: 1706 2: 3: GoogleChromeStandaloneEnterprise64.msi

SOURCEMGMT: Failed to resolve source

Answer 1

The way you use GPO for MSI deployment worked really great in Windows 2000/XP era. But since then the default OS behaviour changed in such a way that Windows do not wait for a network to be up before allowing user to login. So network is never up when Computer Configuration is processed. This made MSI installation at computer level pretty much useless.

The recommend way is to use GPO to create a task in Task Scheduler and use MSIEXEC.EXE to run MSI installation. You might want to use the following settings:

• Program: %SystemRoot%\System32\msiexec.exe
• Parameters: /quiet /qn /norestart /i "<path to msi file>"
• Trigger: 1-5 minutes after user logon (so enough time have passed for a network to be up)
• Conditions: Any network connection available (makes sure network is up)
• Run as NT AUTHORITY\SYSTEM (so it would have local admin rights)

Note, that if you instead decide to enable synchronous GPO processing, the computer boot up/restart times will increase dramatically.

Answer 2

That would be expected if you have not disabled asynchronous group policy processing.

Always wait for the network at computer startup and logon

This policy setting determines whether Group Policy processing is synchronous (that is, whether computers wait for the network to be fully initialized during computer startup and user logon). By default, on client computers, Group Policy processing is not synchronous; client computers typically do not wait for the network to be fully initialized at startup and logon. Existing users are logged on using cached credentials, which results in shorter logon times. Group Policy is applied in the background after the network becomes available. Note that because this is a background refresh, extensions such as Software Installation and Folder Redirection take two logons to apply changes. To be able to operate safely, these extensions require that no users be logged on. Therefore, they must be processed in the foreground before users are actively using the computer. In addition, changes that are made to the user object, such as adding a roaming profile path, home directory, or user object logon script, may take up to two logons to be detected. If a user with a roaming profile, home directory, or user object logon script logs on to a computer, computers always wait for the network to be initialized before logging the user on. If a user has never logged on to this computer before, computers always wait for the network to be initialized. If you enable this policy setting, computers wait for the network to be fully initialized before users are logged on. Group Policy is applied in the foreground, synchronously.

On servers running Windows Server 2008 or later, this policy setting is ignored during Group Policy processing at computer startup and Group Policy processing will be synchronous (these servers wait for the network to be initialized during computer startup). If the server is configured as follows, this policy setting takes effect during Group Policy processing at user logon:

• The server is configured as a terminal server (that is, the Terminal Server role service is installed and configured on the server); and
• The “Allow asynchronous user Group Policy processing when logging on through Terminal Services” policy setting is enabled.

This policy setting is located under Computer Configuration\Policies\Administrative templates\System\Group Policy. If this configuration is not implemented on the server, this policy setting is ignored. In this case, Group Policy processing at user logon is synchronous (these servers wait for the network to be initialized during user logon). If you disable or do not configure this policy setting and users log on to a client computer or a server running Windows Server 2008 or later and that is configured as described earlier, the computer typically does not wait for the network to be fully initialized. In this case, users are logged on with cached credentials. Group Policy is applied asynchronously in the background.

Notes: -If you want to guarantee the application of Folder Redirection, Software Installation, or roaming user profile settings in just one logon, enable this policy setting to ensure that Windows waits for the network to be available before applying policy. -If Folder Redirection policy will apply during the next logon, security policies will be applied asynchronously during the next update cycle, if network connectivity is available.