Group Policy failing to assign an MSI file

I am trying to get active directory to assign an msi file to all the computers in our domain.

The msi file is an office plug-in produced by Microsoft for removing hidden data from Word documents.

I have linked a GPO assigning the msi file, to an OU containing the computers, added the computers to a security group and given the group read permissions and apply group policy permissions, but it still doesn't work.

I am at a bit of a loss as what to do next, as all the info I have seen just gives simple step by step instructions which I have followed to the letter.

Does anyone have any expericence of successfully rolling out software using this method, or is there any logging software which will tell me why it is failing?

Thanks.

 

See my reply in this thread:
http://www.windowsbbs.com/showthread.php?t=59300

 

Thanks for the reply. I had already read your previous posting but was looking for a way to assign software to a computer rather than a user.

The idea was to install in the background in a way that required no intervention from the user at all. Publishing requires too much from the user, going into add/remove programs etc - some of our users can barely use a telephone!

I had lots of failures and the articles I read were sometimes confusing about security permissions and group policy permissions, but in the end I managed to get it working and thought I would publish a step-by-step process here for anyone else to read. Please feel free to add/delete or make any useful comments.

• I have come to the conclusion that assigning to a Computer will not work so instead assign to a user. Publishing to a user would work but requires user interaction.
• Place MSI file in a network share.
• Make sure the Users that will have the application installed have read access to the share. (if applying to everyone, the Authenticated Users group will do.)
• Their computers will also need the same level of access, (Domain Computers for everyone, or put individual computers into a new security group if only applying to limited users.)
• Create a new policy and link it to the correct OU. (the domain root for everyone in the domain)
• In the User config\Software Settings\Software Installation , create New Package and point to MSI file using UNC path only.
• I have used the Group Policy Management snap-in so some of the following may be a little different
• On the Deployment tab, select "Install this application at logon "
• In the Policy properties, under Scope - Security Filtering, add the users' group and the computer group.
• Go to Delegation - Advanced and make sure both groups have Read and Apply Group Policy access.
• If any OU's have inheritance blocked the policy will need to be linked to them too.

 

You can decide on User vs. Computer. It all depends on the OU used.
You likely can use Transforms to avoid any user interaction.