Managed software will not install

[smithk2306]

I have a laptop that I've just re-installed Windows XP on with all available updates and SPs.

When I join it to the domain and move it into it's OU it should install Managed Software but it is not installing anything. GPRESULT tells me that the GPO has been applied and even after a GPUPDATE and several reboots, the Managed Software just will not install.

I have tried dis-joining from the domain, checking that the account is deleted from AD, even waited overnight incase there was a replication delay before rejoining the laptop to the domain with a different name, but the managed software just will not install.

Has nybody any ideas what may be causing this, or more importantly, what can do to get it to work?

I've even tried moving the account into the 'wrong' OU to install different managed software in case there was a problem with the GPO or OU itself but even this has had no effect. I've also tried a new OU and a new GPO, but still no Managed Software.

 

Thanks

 

Kevin

[mullet_man]

Check the application log in Event Viewer, might give you a reason as to why its not installing.

[mullet_man]

Is it a laptop or PC?

 

We find laptops don't install managed software due to the laptops not getting an IP before the managed software would start.

[smithk2306]

It's a laptop but it is wired to the network, not wireless. Previously Managed software has always worked OK.

I have cleared the application log and rebooted and curiously it is showing an error " Windows cannot obtain the Domain Controller name for your computer network..... Group Policy processing aborted.

Obviously this is why the GPO is not being applied properly but it now raises the question as to why it is getting this error. My instinct was DNS, but IPCONFIG gives all the results I would expect.

[jcollings]

It's a laptop but it is wired to the network, not wireless. Previously Managed software has always worked OK.

I have cleared the application log and rebooted and curiously it is showing an error " Windows cannot obtain the Domain Controller name for your computer network..... Group Policy processing aborted.

Obviously this is why the GPO is not being applied properly but it now raises the question as to why it is getting this error. My instinct was DNS, but IPCONFIG gives all the results I would expect.

 

Are there any other errors - particularly with regard to ones talking about Enrolment failed. I had this problem once and it was a while back so apologies for vagueness but it turned out to be a network card setting IIRC - eventvwr had the error you describe + talked about auto-enrolment failing.

[smithk2306]

I'm not 100% sure on the synchronous / asynchronus question. I would assume that everything is at default for that as I've never had a reason to change it. Is there a quick, easy way to check? I remember seeing a setting for 'Run synchronously' for something in Group Policy management but I can't remember if this was for scripts or policies and having just had a quick scan through GPM I can't see it.

The suggestion that it may be the network driver kicking in late seems to fit as the last reboot gave a couple of additional errors that it couldn't find the path to Startup scripts. By the time it has got to logon screen you can log on to the domain without a problem and run to the path that the Application log error says it cannot find. Is there any way to conclusively prove this or to change the order that drivers start? I wouldn't want to force the laptop to wait for network before processing GPOs in case I need to log on to it locally.

[Michael]

As an experiment, logon to the machine as an admin, navigate to your distribution share and run an MSI manually to see if it works. If it doesn't, then I would make sure the Windows Installer is OK. As above I would check the event logs for further information.

 

I'd also run ipconfig /all from a command prompt and if necessary, temporarily set a static IP configuration and see if this makes any difference.

[sparkeh]

I'm not 100% sure on the synchronous / asynchronus question. I would assume that everything is at default for that as I've never had a reason to change it. Is there a quick, easy way to check? I remember seeing a setting for 'Run synchronously' for something in Group Policy management but I can't remember if this was for scripts or policies and having just had a quick scan through GPM I can't see it.

 

Some pages you might want to read: Group Policy Processing and Troubleshooting Group Policy Problems

 

By default XP logs users on Asynchronously.

You can change that by setting "Always wait for the network at computer startup" in "Computer Configuration\Administrative Templates\System\Logon" so you know that all GPOs have been applied before the user logs in.

[ChrisH]

I recently had this sort of problem with a new image I made and I do have that GP setting enabled but it still didn't work for me. In the end it was the NIC drivers not starting quick enough and I found some better ones.

[smithk2306]

Thanks all for your suggestions.

 

The msi's are OK and the GPO is OK as I have moved a PC into the same OU and the managed software DID apply.

After going through a few things following suggestions made here I'm looking towards the problem being the Realtek NIC drivers not applying soon enough. I'm going to try putting an older image onto an identical laptop to check the version of the NIC driver and see if that still applies managed software. If it does I'll be looking for an older version of the driver to install on the new image. With Realtec NICs, i've always been happy in the past to use the Windows drivers, and to update them with MS Update as they became available. Unfortunately, there's not the option on this to 'Rollback' within Device Manager on this.

[chilbs]

I think it will still be worth applying the reg fix which makes the computer wait for the network longer before it starts trying to process policys. This is a known issue not only with wireless but also some brands of wired network card (mostly gigabit).

 

Chilbs

[smithk2306]

Thanks Chilbs, but with a laptop, would this not force it to wait, and wait, and eventually time out before you would be able to log on to the local machine when you are NOT connected to a network intentionally?

[plexer]

Is the ms firewall enabled?

 

Ben

[sted]

Thanks Chilbs, but with a laptop, would this not force it to wait, and wait, and eventually time out before you would be able to log on to the local machine when you are NOT connected to a network intentionally?

 

it dosent add that much wait time just enough for things to load properly

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"GpNetworkStartTimeoutPolicyValue"=dword:0000003c

[ozzy]

try using use a local machine gpo of, Local Computer policy>Computer Configuration>Addministrative Templates>System>Logon>Always wait for the network at start up and logon. that might just work:)

[smithk2306]

Default Domain policy disables Windows Firewall (we are behind Cisco PIX and MS ISA at LA level plus ISA in the local LAN). The System/Logon/Wait for network is also enabled in Default Domain Policy.

This only seems to delay the presentation of the CRTL+ALT+DEL screen. Ideally what I need is for the network to be initialised before the system attempts to run ANY system Group Policies but with this being a laptop, I don't want it to be sat waiting for a network connection when it is intended to be running without one.

 

Just to clarify the issue. When Windows boots you see a series of splash screens, 'Preparing Network Connections', 'Applying Computer settings' etc, one of these should be 'Applying Software Installation Settings...' which then changes to 'Installing Managed Software.....

[GoldenWonder]

The last time I had a software policy that failed to apply was due to permissions. The install source needs to allow read access to Domain Computers (or whatever group the PC/laptop is in) and I'd missed that out when creating the share.

[smithk2306]

Thanks to everyone who suggested things to look for. I have now resolved this (I think/hope) by installing an older NIC driver.

To help anyone who may be searching for this in the future, Windows update had installed Realtek Driver 5.719.325.2009, I have now installed Driver Version 5.505.1004.2002 and everything now seems to be working perfectly. The problem was that the network driver was not initialising quickly enough to be able to contact the DC and process Group Policies.

[ozzy]

Default Domain policy disables Windows Firewall (we are behind Cisco PIX and MS ISA at LA level plus ISA in the local LAN). The System/Logon/Wait for network is also enabled in Default Domain Policy.

This only seems to delay the presentation of the CRTL+ALT+DEL screen. Ideally what I need is for the network to be initialised before the system attempts to run ANY system Group Policies

 

The wait for network policy needs to be a local machine policy not domain policy for this fix to work, if the laptop is not picking up your managed software instalation, or part of it, it's most likley won't be picking the default domain policy, give it a try it's only one machine and take 2mins to set up. it sorted all my problems that I had with gpo software instalation, as for boot time to log on screen thats only a few seconds more and I doubt anyone would even see a change:)

 

good luck:) we all need a bit of it sometimes, Bloody Windows:rolleyes:

Edited November 25, 2009 by ozzy

[dumb0]

had this same problem on a batch of computrers in the ict suite, the problem i found was fixed by installing service pack 3 - might not fix ur issue but worth a try if you havent installed sp3 yet on the lappy. i had the same message in event log regarding domain controller.

 

oops can see its fixed now! i must install my graphics driver on this machine the page jumps too quickly!!!

Edited November 26, 2009 by dumb0
im abit dumb

[sted]

ive also had an issue before where certain network cards (read intel 1000 somethigns in dell gx something) wouldnt deploy msi's via a hp switch unless the switch had fireware updated or cards were set to 10mb (might of been 100mb 1/2 duplex)