Windows 10 - Software GPO Issues

[foofighterjim]

Afternoon All

 

Hopefully someone has an easy answer that me and my team haven't been able to find. We are having issues deploying software via GPO on our newer hardware, it is like it is booting too quickly. We have been reading up about how shutdown in Windows 8 & 10 hibernates the kernel and that a restart should fully shut it down. We have also run gpupdate /force and it acknowledges their are GPOs to be applied on startup, but then skips straight past them on restart. The strange thing is if we are persistent the computer will eventually process them but some computers are on upwards of 40 restarts with all the different things we have tried on them.

 

In the Group Policy event log there is a 4016 entry with "Starting Software Installation Extension Processing. List of applicable Group Policy objects: (Changes were detected.)"

 

Then there are a series of winlogon events where it is creating and closing sessions. Finally it ends with a 7016 error "Completed Software Installation Extension Processing in 10156 milliseconds."

 

On our older (slower) hardware the majority took the software immediately with the remaining ones needing a few restarts. So that shows that there is nothing wrong with the setup of the GPOs themselves. We just really need to know how to get this newer hardware to play ball.

 

Edit: we are running 1803 Education if that helps.

[tosh74]

Computer Configuration\Administrative Templates\System\Logon\Always wait for the network at computer startup and logon

Computer Configuration\Policies\Administrative Templates\System\Group Policy\Startup Policy Processing Wait Time (default is 30)

[JHLEHS]

+1 on @tosh74. We had this issue and change the startup policy time to 60. But I found that ironically this didn't work, so I found we didn't to deploy the reg key instead of GPO and this worked for us. We had a similar issue with our laptops where they booted up without getting a network connect so GPO's wouldn't apply.

 

Hope this helps.

[foofighterjim]

Thanks for the replies both, I think we tried the reg key manually on a couple of computers. I have done a test GPO for 120 and will see if it does the trick.

[jmak]

The hybrid shutdown/fast boot feature can mess up policy deployment too. Explanation here:

https://www.petri.com/how-to-disable-windows-10-fast-startup-and-why-you-might-want-to

 

Potential solution here: http://www.edugeek.net/forums/windows-10/171184-disable-fast-startup-power-management-option-via-gpo.html

[rosslaing]

You could try disabling Group Policy caching. Seems to be a recommendation these days from some vendors now that SSD's are more the norm.

 

Computer Configuration\Policies\Administrative Templates\System\Group Policy

 

The actual setting is called 'Configure Group Policy Caching' and it should be set to Disabled.Once the GPO hits the clients, any background caching will stop.

[Oaktech]

We had the same issue, even with the first solution set up. Only disabling fast-start brought everything back in line again!

[foofighterjim]

It is a strange one and I'm still not sure we have got to the bottom of it.

 

The machines I was working on all installed the software with an increased wait time of 120 seconds this morning. What I didn't know at the time was that another member of my team had assigned another software GPO install this morning. So I don't know if the wait time fixed them or if it was the change in the GPO "list".

 

Conversely we have another slightly slower computer that was a fresh build on Friday, it is still refusing to process the GPOs for the installs (says installing but skips straight past them) but has installed the new software from this morning! We have checked the registry of this computer and it has taken the GPO setting for the increased wait time could this indicate the Group Policy caching issue @rosslaing mentioned?

 

@Oaktech We tried changing the registry to disable the fast boot (admittedly before changing the wait time) and it didn't make a difference.

 

Windows 10

Edited September 24, 2018 by foofighterjim

[sted]

i have also found theres a gpo (and i cant remember it exactly hardened unc paths i needed to add sysvol and netlogon to iirc (sorry i cant remember where it is but that has sometimes stopped software deploying for me in the past on windows 10)

[foofighterjim]

Just a final update about this one and what we have done and plan to do if anyone else cares to know.

 

The increased wait time of 120 from the default of 30 does seem to have resolved the issue despite my initial issues. As others have mentioned though with hybrid shutdown the software GPOs do not process after a shutdown only after a restart. As we and our staff are quite enjoying the benefits of decreased boot times that hybrid shutdown provides we have decided to leave this in place for now. We have the knowledge that a restart will install the software so we plan to deploy the software GPO and either schedule restarts or deploy a separate GPO to turn off hybrid shutdown via the reg key and then set it back once the deployment is complete.

 

I have considered doing this but haven't had time to look at it properly or test it yet: https://www.experts-exchange.com/articles/25279/Overcoming-software-deployment-pitfalls-on-modern-Windows.html

[Oaktech]

I have considered doing this but haven't had time to look at it properly or test it yet: https://www.experts-exchange.com/articles/25279/Overcoming-software-deployment-pitfalls-on-modern-Windows.html

 

That's swish, but as everything that matters here is turned on via WOL about an hour before anyone gets here, mainly so nobody ever sees windows updates, it's an unnecessary complication in my environment... I just turn off fast start.