Software Installation via Computer GPO broken

From: Christopher Smith (ChristopherSmith_at_discussions.microsoft.com)
Date: 10/07/04 

Date: Wed, 6 Oct 2004 19:57:01 -0700

I'm trying to install Outlook 2003 on some computers via a GPO, but the
functionality appears to be broken.

Firstly, I'm trying to do this via the "Computer Settings" part of the GPO,
not the "User Settings" part. Additionally, the servers are all Windows
2003, the clients all Windows XP w/SP2.

Initially, I created a test GPO with the relevant pacakge defined in the
"Software installation" section. I applied the GPO to the "Computers"
container that had the (freshly installed) test machine in it. The first
round of problems were these events being logged:

Source: Application Management
Category: None
Type:
Event ID: 301
User: SYSTEM
Computer: COMPUTER
Description:
The assignment of application [MSI Name] from policy [GPO Name] succeeded.

Source: Application Management
Category: None
Type:
Event ID: 102
User: SYSTEM
Computer: COMPUTER
Description:
The install of application [MSI Name] from policy [GPO Name] failed. The
error was : The installation source for this product is not available.
Verify that the source exists and that you can access it.

Source: Application Management
Category: None
Type:
Event ID: 303
User: SYSTEM
Computer: COMPUTER
Description:
The removal of the assignment of application [MSI Name] from policy [GPO
Name] succeeded.

Source: Application Management
Category: None
Type:
Event ID: 108
User: SYSTEM
Computer: COMPUTER
Description:
Failed to apply changes to software installation settings. Software changes
could not be applied. A previous log entry with details should exist. The
error was : The installation source for this product is not available.
Verify that the source exists and that you can access it.

Source: Application Management
Category: None
Type:
Event ID: 1085
User: SYSTEM
Computer: COMPUTER
Description:
The Group Policy client-side extension Software Installation failed to
execute. Please look for any errors reported earlier by that extension.

All seem to be fairly common, however, the only suggested solution I"ve
found that actually comes close to fixing the problem is the one outlined
here (I can only assume everyone else who has bumped into this gave up):

http://groups.google.com/groups?hl=en&lr=&c2coff=1&frame=right&th=cc28a275b9ef343&seekm=5da601c3774e%2452edb390%24a501280a%40phx.gbl#link1

Succinctly, the following settings must be applied to the fileserver
involved, otherwise the computer is unable to access the source files share:

Computer Configuration->Windows Settings->Security Settings->Local
Policies->Security Options

Network Access: Do not allow anonymous enumeration of SAM accounts
 -> Enabled

Network Access: Do not allow anonymous enumeration of SAM accounts and shares
 -> Disabled

Network Access: Shares that can be accessed anonymously
 -> Must contain the share name with the administrative install points (plus
any others you may wish to define). Note: not the entire UNC path, just the
share name.

Now, by doing all of the above, I have had some success. The computers can
connect to the share ok (I can "net use" the share as the Local System
account) but they cannot access anything on it (trying to "dir DRIVE:" gives
"Access denied"). I've also discovered that if I leave the computer account
in the default "Computers" container, they can both map the share and access
the contents without any problem, however, as soon as I move the computer
into a customer OU (to actually apply the GPO) they can no longer access the
share contents. Both share and file permissions are set to "Full Control"
for "Everyone".

Anyone have any ideas ? I can't be the only person who wants to do this...

Relevant Pages

  • Software Installation via Computer GPO broken
    ... I followed the direction from the link and was able to gpo ... >Source: Application Management ... The installation source for this product is ... >account) but they cannot access anything on it (trying ...
    (microsoft.public.windows.group_policy)
  • Re: XP: Inconsistent behavior from unattend.txt created via Setup Manager
    ... filter as a condition for that GPO - windows 2000 doesn't process WMI ... installation from going over and over...and over. ... exactly the same in the CustomAction -> RunSetupImmediate and RunSetup ... I knew that I had to edit the .msi file to reference the unattend.txt ...
    (microsoft.public.windowsxp.setup_deployment)
  • Re: Office 2007 Professional Plus - Group policy - Error
    ... This the link for the information that led me to believe GPO was a good ... requiring the enterprise license in order to use GPO. ... For the 2007 Office system a basic oNIP (Office network Installation Point) is a CD image. ... I am attempting to setup my Group policy installation package for my Office ...
    (microsoft.public.office.setup)
  • Re: Installing patchs and apps automatically
    ... Deploying software via GPO is a wonderful way to do things. ... The big picture on how to do this is to have an Administrative Installation ... You would use this is you were going to use a .mst file (aka ...
    (microsoft.public.win2000.active_directory)
  • Re: Suggstions on PDA Security Software
    ... The only problem is the deployment cost, ... software and it has a good central management, ... The installation process is much more difficult than the other ... Try Webroot's Spy Sweeper Enterprisefor 30 days for FREE with no ...
    (Security-Basics)