Server 2003 - GPO Experts advice needed!

Knubje · 6 Jan 2009 at 12:14

Hi all,

I am fairly new to using GPMC and am playing about with it to try and roll out an MSI our developers have created - to a specific group of users.

Within my domain I have created a new OU called "DF" (the group of users). Within this OU is a security group of users who are apart of the "DF" team.

I have created a network share \\server\\e$\foldername\ and whacked in my MSI in there. To this folder I have granted Domain Computers group "Read" access.

I have created a new GPO within my new OU, call it TEST. In the scope I have the OU (enforced) and the domain. In the security filtering I have "DF (Domain\DF). And myself.

In the delegation tab I have the "DF" group of users added (domain\DF) and myself (test purposes). Both the group and myself as a user have: Read (From Security Filtering) permissions.

I have then linked the GPO from my OU to the actual Domain policies. Such as the default domain policy, etc.

Now, when I have performed a forced gpupdate and rebooted the damn thing hasn't installed on my machine. When I do a gpresult.exe from prompt, it shows me:

Applied Group Policy Objects
-----------------------------
Default Domain Policy
Default Domain Controllers Policy
Local Group Policy

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
TEST
Filtering: Denied (Security)

Obviously it's a security/permissions issue but I have done everything I can think of and instructed by MS guides with regards to checking and setting it.

(The actual GPO itself is straight forward: Domain-->Computer config-->software settings-->Software Install

This has the name of the package I want installing (MSI) and deployment state is "assigned" and the source is \\server\e$\foldername\msi.msi )

Has anyone got any ideas because this is really starting to grind my gears

Thanks!

Ciphon · 6 Jan 2009 at 12:24

NOC has no access.. passing to Windows

Knubje · 6 Jan 2009 at 13:18

C'mon Burnsy! I know you must have some idea about what it could be?

oddjob62 · 6 Jan 2009 at 14:16

Ok, first thing i've noticed.... this is a computer group policy but you are trying to apply it to a user (yourself)

Knubje · 6 Jan 2009 at 14:42

I have added myself in there as a test. But I also noticed this and changed it to my computer rather than my user. Still no luck.

oddjob62 · 6 Jan 2009 at 15:53

So you've created a GP, created an OU and created a group
You've added the MSI to the "comptuer config" "software installation" as "assign" in the GPO
You've linked the GP to the OU
You've moved your computer into OU
You've added your computer to the group
You've set the security filtering to apply to the group
You've run a gpupdate /force

Yes?

Knubje · 6 Jan 2009 at 16:05

Yep.

Infact I have changed it very slightly now. There already was an OU with COMPUTERS inside which were all the computers I needed to install on.

So I created the GPO as mentioned and linked it to the OU with the correct security filters on it.

It now says from gpresult that the policy has been applied, but nothing in ADD/REMOVE programs and the toolbar is not where I want it to be!

Going to continue testing and if not give up on GPMC and find other software to distribute my software

oddjob62 · 6 Jan 2009 at 17:16

If you're set it to "assign" it should install during startup. Have you tried a couple of reboots (i seem to recall sometime with XP it sometimes takes 2 reboots) Also check your event logs to see if there's any indication of why it's failing (maybe unable to access the MSI)

Knubje · 6 Jan 2009 at 17:43

Yeah I did do mate. Since assigning the GPO to the correct OU I think it's working. I have seen the install messages before XP logon so it's a good sign.

Although I think the MSI given to me from our developers is borked, so I am going back to them with it tomorrow

Thanks for the help!

Nanobot · 6 Jan 2009 at 19:48

First thing that stands out to me is your trying to get staff to access e$ which is an admin share so probably not accessible by staff.

\\server\\e$\foldername\

Did you create a share pointing to the 'foldername' folder or you expecting staff to get to your msi via e$?!

Knubje · 6 Jan 2009 at 20:03

Yeah share is there on folder name and it seems the permissions were correct.

Since looking back my boss pointed out the $ and I corrected that along with what looks to be a slightly dodgy MSI and having the GPO in the correct OU of the required computers.

Looks good for tomorrow!