5

I've been trying to deploy the forticlient SSL VPN application (.msi format) into my domain machines, using a GPO. Even though I made a silent previous installation by issuing the command: msiexec /qb /i installer.msi and it worked, which is mentioned as sort of a prerequisite in the following post: Installing MSI via Group Policy in a Fully Unattended Way, the .msi is not getting installed in the machines. The installer is in a shared folder with proper permissions.

Where might I get information on what might be preventing the installation on the domain machines?

Thanks for your help

Update: The clients are Windows 7 Pro 32-bit. The server is Windows Server 2008 R2 Update: Issuing the gpresult /R command shows that the computers are actually receiving the GPO and this is not being filtered.

update 2

I followed along the path indicated by the post: Group Policy installation failed error 1274, however there are two events, one indicating error 1274 and the other one being error %%2. While doing a test reboot on my machine the event the application assignment was made successfully, appeared once but no more and yet the installation was not made. I'm puzzled by this problem.

Community
  • 1
TechCP
  • 61
  • 1
  • 1
  • 6
  • Supply some information on the clients, what operating system are they running? – Mathias R. Jessen Dec 30 '11 at 17:41
  • Thank you. I just forgot it. The clients are Windows 7 Pro 32-bit. The server is Windows Server 2008 R2. – TechCP Dec 30 '11 at 17:46
  • Are you deploying the msi as part of computer or user configuration? – newmanth Dec 30 '11 at 18:01
  • What does the event log say on the client side in regards to the software in question? – xeon Dec 30 '11 at 18:01
  • @newmanth: I'm deploying it using computer configuration. – TechCP Dec 30 '11 at 18:08
  • @xeon: There's one warning generated in the system log: An error has ocurred in the assignment of FortiClient SSLVPN v4.0.2148. The error was %%1274. – TechCP Dec 30 '11 at 18:11
  • Well, it appears that the client is receiving the MSI. Now, I noticed that /qb is in your command line. That allows for a basic UI during install. Since installation occurs at computer start up, maybe a UI is trying to present itself and is unable to? Perhaps you can try running it again using /qn instead? This would ensure no UI is presented. Of course, you have to make sure that the installing application is not expecting any parameters to be provided... – newmanth Dec 30 '11 at 18:21
  • The application can be installed using the /qi switch; the cursor blinked a few times and it then appeared on the start menu. I don't know what else to do. – TechCP Dec 30 '11 at 19:48

1 Answers1

7

Diagnosing 'silent' MSI installation failures can be done like this:

Firstly, check your GPO is applying correctly. Use the Group Policy Management Console to run a report on a target machine, and view this report to check that the GPO that assigns the software installation is applying correctly. If this part isn't working right then there's no point in going any further. Both a fault in the GPO in question or in any other GPO that should be applied before or alongside it can cause a workstation to stop processing GPOs.

With that done, check the event logs on the target machine:

Open Computer management -> event viewer -> Windows Logs - Application

You're looking for errors with a source of MsiInstaller (and any other events that get logged at the same time of course).

Finally, a lot of applications record their own log as part of the installation process. If you can find the local folder that the MSI installation was ran from then there may be a detailed error log inside that (of course, if you can find errors in the windows event viewer then this will hopefully also mention the application logfile and tell you where to find it)

Also check that the following setting is being applied to the target computers via GPO, and if not, set it and then run gpupdate /force from a command line on a target computer, and reboot.

Computer Settings

  -> Administrative Templates
    -> System
      -> Logon
        -> Always wait for the network at computer startup and logon – Enabled
Rob Moir
  • 31,664
  • 6
  • 58
  • 86
  • Thank you. There's only one event logged that is related to this GPO. The error is mentioned above and it doesnt' give any clues so as to identify the problem. The silent installation runned manually went just right. – TechCP Dec 30 '11 at 19:52
  • @TechCP updated my answer with something else for you to try. – Rob Moir Dec 30 '11 at 21:57
  • Thank you, Rob. I created a different GPO to include the configuration you pointed out but unfortunately, it doesn't work either. The mentioned errors continue appearing at the events log. – TechCP Jan 02 '12 at 13:50
  • 1
    @techcp At this point then, I'd test that you could apply a package via MSI that was known to work this way and assuming that works, I'd speak to Fortinet about this and suggest that the problem may well be with their package. There may be a dependency missing from their documentation, or for that matter a OS patch or setting you have that their package doesn't like. It happens... – Rob Moir Jan 02 '12 at 14:32
  • You are right. I've been messing around with this for too long. And other packages seem to work properly when deployed this way. I will seek for help with the vendor. Thanks for your support. – TechCP Jan 02 '12 at 14:49
  • 1
    Thank you guys, I hadn't realized it had worked until a coworker told me last monday. I think it was just needed a little patience. – TechCP Jan 17 '12 at 23:02