Software deployment over GPO

[Pvt.Dancer]

Ok so I have done software deployment in the past and everything has gone smoothly but this time Im trying to deploy an upgrade and the error I'm receiving back from my test machine it

"Software installation failed due to the error listed below: The system cannot find the file specified."

Now I'm not finding much online about this that pertains to my current situation and I have checked the file path and not only can I access the path from my test machine but I can install from there as well.

Thanks in advance for the help.

 

[Janus67]

So is it having trouble reaching the deployment server?

 

[insanemonkey]

It sounds like it might be a permissions issue. When you are manually installing it are you doing so with the same user account you are using when you test the GPO deployment?

 

[Aspect404]

I might be able to help if I knew more about the environment (Server OS > File Share type (sep srvr?) > Test OS).

Based on the above, I would second insanemonkey's comments. Create and execute a simple batch file to execute with elevated privileges.

In Notepad:
runas /user:domain\user program.exe
(e.g. runas /user:OCF\aspect404 update.exe)

Save as: updateprogram.bat

Run on Machine. You will get prompted for password (typed characters not shown) but it should then run the executable under domain admin privileges (assuming you have those rights).

Now, if you want to deploy large scale, I would (and do) create a dummy Domain Admin account (marvel character name) and script the password into the batch file (Example). Then, you can disable that Domain Admin when not in use and enable only when using the account in batch files to update software packages.

 

[Pvt.Dancer]

@Janus: I can reach the server fine from the test machine if i go to the file pat \\server\folder\

@Insane monkey: Yes same user account that I'm attempting to apply the GPO under. The first thing I looked at was the permissions after it didn't work but they are all correct to an average user.

@Aspect404: Server is running Server 08 R2 latest windows updates and the test PC is a Windows 7 machine latest updates. I will look at adding domain admin to my test account and making sure that UAC is off and see if this will resolve the issue. I don't believe this setup requires admin or a prompt to pass UAC but I need to narrow this down a bit.

Thanks for all the help and Ideas guys

 

[Aspect404]

Do you have the user & computer accounts in an OU (e.g. Block policies OU) that allows standard users to install/update software? Remember that in Domain Services least privilege comes into play.

What is the executable trying to do?
If it is attempting to update an internal (corporate) software package, it may be trying to make calls to other resources, where additional security controls come into play.
The runas script may help here if so...

This entire scenario depends largely on the extension/code you're trying to execute:
If this is something you made, (i.e. another script/batch file), remember that if you run it from a file share, it may try to execute against the server. So, if update.ext has something like:
%USERPROFILE%/Application Data/local/updatethis.exe
in a line, then (depending on context) it may try to run that against the file server, even though invoked on a client machine. Since %USERPROFILE% defines an invalid path, you get the file not found error.

Also related to type of update method would be the calls the updater is trying to make locally (host). Perhaps the test host does not have a required installation file locally and the updater package is trying to update that file.

 

[Pvt.Dancer]

the extension is a .msi file. This software package is nothing more than an install that will update the currently installed version of the software to the latest version which will resolve some issues that this program has interfacing with outlook.

As of right now there are no block policy GPO's in place as when my company took over the IT needs of this client they had 0 GPO's in place everything created has been created by me and are some of the most basic needed GPO's (Maping drives & printers mostly) even when the link is enforced there is no change in error.

Also this software package doesn't need to call on any resources the software will just update versions and can install to clients that don't currently have the software installed. for updating there is no user input needed. Server, user, password, ETC is all taken from the previous version of the software.

Thanks again for the help

 

[Aspect404]

Well then...

I'm not entirely sure what could be causing the missing resource error. Perhaps the .msi is unpacking on server?? That shouldn't happen, but you could try to change the batch file to copy the install into a newly created local dir, execute, and then remove after install....

Sorry I couldn't be of more help

 

[Pvt.Dancer]

don't be sorry you got my brain thinking in a different direction which is what I needed. no matter how many times I do things like this there always seems to be an issue that comes up that stumps me for a bit and all I need are some other thoughts to get me going again.

so thanks!

 

[Janus67]

have you tried hosting the file locally and still setting up a GPO for testing? This way it may be able to help determine where the access/rights issue is coming from.

Also, is there anything in the event viewer?

It may also be having trouble updating a current piece of software if it is something is is a service and always running.

 

[Pvt.Dancer]

I'm actually working on just using a script to do the install instead even though I shouldn't have to I just want to get this update done lol. on my first test of the script running it manually myself it worked flawlessly so now I'm setting up a new GPO to run the script.

its copying the files locally doing the silent install then deletes the copied files.

I'm tired of messing with it I will have a chance to work more on this kind of issue later with other software packages and figure it out then.

Wish I had the time to do it now :\

 

[gangaskan]

have you checked the event log on it? you should receive an error processing the group policy.


also, when you pushed out the update, did you add it as an upgrade package? or just a standalone?

 

[Pvt.Dancer]

I checked all the events and ran gpresult. and I'm running it as a standalone as there is not GPO for the previous software, the upgrade can run right over the top of the previous software.

 

[Aspect404]

rsop.msc (Resultant Set Of Policy) is a little easier to read IMHO. Although GPresult will tell you which policies are causing the restrictions.

 

[Pvt.Dancer]

when its saved as a .html its extremely easy to read to me and is categorized nicely and even throws a yellow ! on the one that is having the issue in this case.