talksr Posted September 13, 2018 Posted September 13, 2018 Hi there, Where do I start, getting so fed up with things in general. Nothing seems to be working, everything you try causes problems, what has gone wrong with our server software? Things used to be so much easier with Windows XP. I posted earlier on that I was having issues with certain MSIs not going through to our Windows 10 stations. Someone helpfully pointed out that it could be an asynchronous policy processing error. I followed the url they provided and created a new policy: https://serverfault.com/questions/44257/group-policy-installation-failed-error-1274 I am now finding that certain MSI deployments such as Clicker 6 have not gone through to the clients. If I run gpresult, the policies are not being processed, missed, nothing, not even being listed. As though they were never there. Another example, I have a policy in the correct OU called Disable Quick Access Windows 10. It will disable the Windows 10 Quick Access default on explorer, instead taking you straight to Computer. It is sitting there correct, I have it on various other site servers and it works perfectly, here, not working on a single computer. Every time I gpupdate /force a computer, if I log it in once I have rebooted it and run gpupdate /force again, it tells me The group policy client side extension software installation was unable to apply one or more settings because the changes must be processed before system startup or user logon etc etc, it tells me Ok to restart yes or no. I have just done this?! I just keep going round and round in circles.
synaesthesia Posted September 13, 2018 Posted September 13, 2018 We've had this come up on a few and seemed to be a common issue; this may not fix it for you but it might be worth trying: New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths" -Name "\\*\SYSVOL" -Value "RequireMutualAuthentication=0" -Property "String" New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths" -Name "\\*\NETLOGON" -Value "RequireMutualAuthentication=0" -Property "String" 1
talksr Posted September 13, 2018 Author Posted September 13, 2018 We've had this come up on a few and seemed to be a common issue; this may not fix it for you but it might be worth trying: New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths" -Name "\\*\SYSVOL" -Value "RequireMutualAuthentication=0" -Property "String" New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths" -Name "\\*\NETLOGON" -Value "RequireMutualAuthentication=0" -Property "String" Thank you. Would I add this as a new GPO?
HobGoblin Posted September 13, 2018 Posted September 13, 2018 When I've had this issue in the past I've been able to get software to install by having the following settings deployed to clients: - Computer Configuration > Administrative Templates > System > Logon > Always wait for the network at computer startup and logon - Enabled - Computer Configuration > Administrative Templates > System > Group policy > Specify startup policy processing wait time - 30 seconds (adjust depending on your environment) Only other advice I can think of is to check permissions on the MSI and look at the Group Policy event log group. 1
talksr Posted September 20, 2018 Author Posted September 20, 2018 When I've had this issue in the past I've been able to get software to install by having the following settings deployed to clients: - Computer Configuration > Administrative Templates > System > Logon > Always wait for the network at computer startup and logon - Enabled - Computer Configuration > Administrative Templates > System > Group policy > Specify startup policy processing wait time - 30 seconds (adjust depending on your environment) Only other advice I can think of is to check permissions on the MSI and look at the Group Policy event log group. Thanks for your post. I will add these settings in and see what happens. Would it be best to do these in the default domain policy or make my own one? Also, when you say the Group Policy event log, where would I find this? If I go on our Windows 10 client systems, the event log tabs available are only: Application, Security, System, Setup Forwarded events. No Group Policy is listed.
synaesthesia Posted September 20, 2018 Posted September 20, 2018 Sorry, those were powershell commands but indeed it won't hurt to put them in GPO. Always make a new GPO and avoid editing the default ones. 1
talksr Posted September 20, 2018 Author Posted September 20, 2018 Sorry, those were powershell commands but indeed it won't hurt to put them in GPO. Always make a new GPO and avoid editing the default ones. Ah ok. Thanks for clarifying. How best could I add these to a group policy? Or if not, how would I deploy these settings via Power Shell?
Arthur Posted September 20, 2018 Posted September 20, 2018 How best could I add these to a group policy? Computer Configuration / Administrative Templates / Network / Network Provider / [color="#FF0000"]Hardened UNC Paths[/color] More info: https://blogs.technet.microsoft.com/leesteve/2017/08/09/demystifying-the-unc-hardening-dilemma/ 1
talksr Posted September 20, 2018 Author Posted September 20, 2018 Computer Configuration / Administrative Templates / Network / Network Provider / [color="#FF0000"]Hardened UNC Paths[/color] More info: https://blogs.technet.microsoft.com/leesteve/2017/08/09/demystifying-the-unc-hardening-dilemma/ Ok thank you. I have found it. I enabled it, but it asks which UNC paths I would like to add. I am presented with a Show Contents box which allows me to enter in something in the Value Name field and Value field. What should I be entering in here? As an example, Clicker 6 is an MSI and is not installing but was before Windows 10. Would I just enter in Value Name: Clicker 6 Path and then the path to the msi in the Value: field?
HobGoblin Posted September 20, 2018 Posted September 20, 2018 I would suggest creating a brand new GPO rather than touch any default GPO's, you can find the Group Policy event log here: Event Viewer > Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational Very useful log.
Arthur Posted September 20, 2018 Posted September 20, 2018 I enabled it, but it asks which UNC paths I would like to add. Essentially the same as what @synaesthesia posted, so... [b]Name[/b]: \\*\SYSVOL [b]Value[/b]: RequireMutualAuthentication=0 [b]Name[/b]: \\*\NETLOGON [b]Value[/b]: RequireMutualAuthentication=0 1
talksr Posted September 21, 2018 Author Posted September 21, 2018 Essentially the same as what @synaesthesia posted, so... [b]Name[/b]: \\*\SYSVOL [b]Value[/b]: RequireMutualAuthentication=0 [b]Name[/b]: \\*\NETLOGON [b]Value[/b]: RequireMutualAuthentication=0 Thank you, makes perfect sense. Have just added them on, let's see if this helps.
round2it Posted September 21, 2018 Posted September 21, 2018 did you miss a \ on sysvol? or is a funky windows thing that changes what you entered 1
talksr Posted September 21, 2018 Author Posted September 21, 2018 did you miss a \ on sysvol? or is a funky windows thing that changes what you entered No, a typo on my part, thanks for that eagle eyes!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now