Home | Site Map | Cisco How ToNet How To | Wireless |Search | Forums | Services | Donations | Careers | About Us | Contact Us|

Group Policy software installation fails to install on Win 7

Active Directory, Domain, DNS, WINS, DHCP, SBS, New Releases.

Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:13 pm

We have a domain with Windows 2003 R2 and Windows 2008 R2 DCs (PDC is a Windows 2008 R2 machine), and Windows XP and Windows 7 clients.

Using the software installation facilities in Group Policy Objects we have several packages pushed onto the Windows XP and Windows 7 clients. The Windows XP clients apply these packages without problems and at the first reboot/gpupdate; but the Windows 7 clients do not. In the case of the Windows 7 clients it takes multiple reboots (or gpupdate /force /boot) for the packages to apply to the machines (and at any one time no more than three machines can apply the packages (!?); Windows XP machines will update in dozens without problems). When the application of the packages fails, there are several event errors on the client machine:

Log Name: System
Source: Application Management Group Policy
Date: 22/09/2010 14:47:39
Event ID: 101
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: lab03.stats.ox.ac.uk
Description:
The assignment of application 7-Zip 4.65 (x64 edition) (STATS) from policy computer Software (7-Zip x64) Installation GPO (2010) failed. The error was : %%1274

followed by

Log Name: System
Source: Application Management Group Policy
Date: 22/09/2010 14:47:39
Event ID: 103
Task Category: None
Level: Error
Keywords: Classic
User: SYSTEM
Computer: lab03.stats.ox.ac.uk
Description:
The removal of the assignment of application 7-Zip 4.65 (x64 edition) (STATS) from policy computer Software (7-Zip x64) Installation GPO (2010) failed. The error was : %%2

and ending in

Log Name: System
Source: Application Management Group Policy
Date: 22/09/2010 14:47:39
Event ID: 108
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: lab03.stats.ox.ac.uk
Description:
Failed to apply changes to software installation settings. The installation of software deployed through Group Policy for this user has been delayed until the next logon because the changes must be applied before the user logon. The error was : %%1274

and

Log Name: System
Source: Microsoft-Windows-GroupPolicy
Date: 22/09/2010 14:47:39
Event ID: 1112
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: lab03.stats.ox.ac.uk
Description:
The Group Policy Client Side Extension Software Installation was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance.

The "Always wait for the network at computer startup and logon" policy is already applied through another GPO (at least it seems so...).

Using "gpresult /r" shows all the machines detect that the GPOs apply to them.

As an example, one morning I started applying GPOs to 20 machines, and it took 3 hours and 20-30 "gpupdate /force /boot" for 17 of them to apply the packages in question. The remaining 3 took another 15 reboots after that. If this were Windows XP systems it would have taken 1 (maybe 2) reboots for the packages to be applied to all the systems.

Am I doing something wrong or is Windows 7 that flaky applying software installation GPOs? Has anyone else found this behaviour?

Thank you for your help.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:13 pm

I've seen this behavior happen when group policies start before the network stack is fully up. There is a setting that can fix that: Computer Configuration\Policies\Administrative Templates\System\Logon\Always wait for the network at computer startup and logon.



Try to set this for your Windows 7 computers and see if it helps,



If you still have issue, check the Group Policy log under Applications and Services Logs on a Windows 7 system to see if there is more information.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:14 pm

You can use rsop.msc on the client system to make sure that the network setting is being applied (sorry I missed that point in your original post).



The additional events definitely point to a network issue. Is the behavior the same for all of the Windows 7 systems? are there any other network or AD related issues on these systems?



I also found this related post with a recommendation for another setting to try: http://social.technet.microsoft.com/For ... 3463acd9d3.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:15 pm

I have just run rsop.msc on the client system and it definitely shows "Always wait for the network at computer startup and logon" to be applied. Cool; I did not know rsop.msc was so neat!

Yes, all the Windows 7 systems show this problem to some degree (some take a couple of reboots to apply the GPOs, but most take 5+ reboots to do so, and a few 20+). The Windows XP systems do NOT have any problems, but all the Windows 7 ones do. No other AD-related problems that I have found. By the way, could this have something to do with the fact that some of our DCs are 2003 R2 instead of 2008 R2? I have noticed that a one of the systems that took longer to apply the software GPOs seemed to try to bind to one of the 2003 servers rather than the 2008 ones (which is curious, since the 2008 servers should have more bandwidth).

Those articles sound familiar; I will try the "Startup policy processing wait time" set to 5 seconds.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:16 pm

I have tried installing some software using a GPO on 4 Windows 7 machines after applying the "Startup policy processing wait time" set to 5 seconds. I am afraid that it did not work and I still get the following errors in the Group Policy\Operational event log:

Log Name: Microsoft-Windows-GroupPolicy/Operational
Source: Microsoft-Windows-GroupPolicy
Date: 26/09/2010 00:08:24
Event ID: 6323
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: lab05.stats.ox.ac.uk
Description:
Group Policy dependency (Network Location Awareness) did not start. As a result, network related features of Group Policy such as bandwidth estimation and response to network changes will not work.

Log Name: Microsoft-Windows-GroupPolicy/Operational
Source: Microsoft-Windows-GroupPolicy
Date: 26/09/2010 00:08:25
Event ID: 7017
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: lab05.stats.ox.ac.uk
Description:
The system call to get account information completed. The call failed after 609 milliseconds.

Log Name: Microsoft-Windows-GroupPolicy/Operational
Source: Microsoft-Windows-GroupPolicy
Date: 26/09/2010 00:08:25
Event ID: 7017
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: lab05.stats.ox.ac.uk
Description:
The system call to get account information completed. The call failed after 188 milliseconds.

Log Name: Microsoft-Windows-GroupPolicy/Operational
Source: Microsoft-Windows-GroupPolicy
Date: 26/09/2010 00:08:26
Event ID: 7017
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: lab05.stats.ox.ac.uk
Description:
The system call to get account information completed. The call failed after 78 milliseconds.

Log Name: Microsoft-Windows-GroupPolicy/Operational
Source: Microsoft-Windows-GroupPolicy
Date: 26/09/2010 00:08:27
Event ID: 7017
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: lab05.stats.ox.ac.uk
Description:
The system call to get account information completed. The call failed after 16 milliseconds.

Log Name: Microsoft-Windows-GroupPolicy/Operational
Source: Microsoft-Windows-GroupPolicy
Date: 26/09/2010 00:08:27
Event ID: 7320
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: lab05.stats.ox.ac.uk
Description:
Error: Retrieved account information. Error code 0x54B.

Log Name: Microsoft-Windows-GroupPolicy/Operational
Source: Microsoft-Windows-GroupPolicy
Date: 26/09/2010 00:08:27
Event ID: 7000
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: lab05.stats.ox.ac.uk
Description:
Computer boot policy processing failed for STATS\LAB05$ in 3 seconds.

Also I get the follwing errors in the System event log:

Log Name: System
Source: NETLOGON
Date: 26/09/2010 00:08:25
Event ID: 5719
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: lab05.stats.ox.ac.uk
Description:
This computer was not able to set up a secure session with a domain controller in domain STATS due to the following:
There are currently no logon servers available to service the logon request.
This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator.

Log Name: System
Source: Microsoft-Windows-GroupPolicy
Date: 26/09/2010 00:08:27
Event ID: 1129
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: lab05.stats.ox.ac.uk
Description:
The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.

Log Name: System
Source: Application Management Group Policy
Date: 26/09/2010 00:09:32
Event ID: 101
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: lab05.stats.ox.ac.uk
Description:
The assignment of application R 2.12.0 alpha for Windows (x32/x64 on x64) (STATS) from policy computer Software (R Latest) Installation GPO (2010) failed. The error was : %%1274

Log Name: System
Source: Application Management Group Policy
Date: 26/09/2010 00:09:32
Event ID: 103
Task Category: None
Level: Error
Keywords: Classic
User: SYSTEM
Computer: lab05.stats.ox.ac.uk
Description:
The removal of the assignment of application R 2.12.0 alpha for Windows (x32/x64 on x64) (STATS) from policy computer Software (R Latest) Installation GPO (2010) failed. The error was : %%2

Log Name: System
Source: Application Management Group Policy
Date: 26/09/2010 00:09:32
Event ID: 108
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: lab05.stats.ox.ac.uk
Description:
Failed to apply changes to software installation settings. The installation of software deployed through Group Policy for this user has been delayed until the next logon because the changes must be applied before the user logon. The error was : %%1274

Log Name: System
Source: Microsoft-Windows-GroupPolicy
Date: 26/09/2010 00:09:32
Event ID: 1112
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: lab05.stats.ox.ac.uk
Description:
The Group Policy Client Side Extension Software Installation was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance.

If I set up the "Startup policy processing wait time" policy to 15 seconds the software installs on all the 4 Windows 7 machines after one reboot.

There seems to be some kind of networking problem, but I can log in to those systems with a domain account, so the systems must have a way to contact a DC. Anyone have any idea what is going on? Any solutions?

Thank you for your help.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:17 pm

To make sure I understand correct, are you saying that a delay of 15 seconds allowed everything to work?



I'd say you have a network problem accessing your DCs. Note that logging in with a domain account isn't a good indicator if the account has been used on the machine since the credentials are cached. use dcdiag on the client systems to verify connectivity to a domain controller and check for other DNS or AD related events. Note that this can also happen if your sites configuration is not correct and the clients are trying to use a DC from another site across a slow link.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:17 pm

Nearly; 15 seconds made 17 out of 20 apply on the first reboot. 20 seconds' delay made all 20 apply a software GPO at the first reboot.

As they eventually all manage to apply the GPOs it would seem the problem is accessing the DCs at startup. Is there a way to find to which DC a client is using?

All my DCs are on the same server room, though they are connected to different switches.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:17 pm

Since the errors don't indicate a DC name, the issue is probably still at the stage of looking for a DC. Is it possible that it takes that long to get a DHCP address or that the DNS server specified on the client takes that long to answer? There might be events in the system log if any of these are timing out.



You can try running diagnostic commands (dcdiag, ipconfig, etc) into a log file using a startup script, try commands like:



dcdiag /s:dcname > c:\dcdiag.log

ipconfig /all >c:\ipconfig.log
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:18 pm

But if the problem is with the DHCP/DNS, why do the Windows XP systems have no problems? It is the Windows 7 and Windows 2008 systems that are new to the network, and it seems they are the ones having/causing problems; the old systems (XP/2003) seem to be happy.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:18 pm

I don't have a direct answer to this, but the netlogon 5719 event you are seeing is unrelated to GPOs and indicates a DC communication issue. Perhaps there is something in the configuration of the network, XP or 7 machines that causes this problem to appear with Windows 7.



I would eliminate factors by shortcutting the startup process - you can assign a static address to eliminate DHCP.



Is there anything else in common to only the Windows 7 systems? changes from default configuration, subnet placement, switch or room placement, etc.

Also, are there other errors in the system event log related to AD access, DNS or time?
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:18 pm

>Is there a way to find to which DC a client is using?

You can run nltest /dsgetdc:domainname or set logon.

Please upload GPRESULT /H GPReport.html and Gpsvc.log file to SkyDrive for further research.

userenvlog for Windows Vista/2008/Win7
http://blogs.technet.com/b/mempson/arch ... -win7.aspx

Group Policy Slow Link Detection Using Windows Vista and Server 2008
http://support.microsoft.com/kb/2008977

Brent Hu,
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:19 pm

>>Is there a way to find to which DC a client is using?
>You can run nltest /dsgetdc:domainname or set logon.

Is it normal for those commands to show different results on the same machine at the same time?

C:\Windows\system32>set logon
LOGONSERVER=\\BLUEWYRM

C:\Windows\system32>nltest /dsgetdc:stats.ox.ac.uk
DC: \\stats-win-svr1.stats.ox.ac.uk
Address: \\163.1.210.4
Dom Name: stats.ox.ac.uk
Forest Name: stats.ox.ac.uk
Dc Site Name: Default-First-Site-Name
Our Site Name: Default-First-Site-Name
Flags: GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE
The command completed successfully
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:19 pm

The “set logon” command retrieves the current logon DC; while the “nltest /dsgetdc:<>” command is used to exercise the locator to find the domain controller for the domain. As the network environment might be different when a user logs on and when you run the nltest command, it is possible that you may get two different DCs in multiple DC environment.

I would be glad to help you troubleshoot the issue if you could upload the information I mentioned.

Brent Hu,
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:19 pm

For the test, do you want the "Startup policy processing wait time" policy set to 20 seconds (which makes the GPOs to apply successfully and may not show many errors), or left unset so as to reproduce the initial condition?

Why would the clients always use the Win2003R2 DCs instead of the newer Win2008R2 DCs for applying software GPOs; this has me really worried as I will have to switch the Win2003R2 DCs one of these days...
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Re: Group Policy software installation fails to install on Win 7

Postby guest » Wed May 16, 2012 4:20 pm

Sorry for the delay in answering, but it was the beginning of term here last week.

The "Startup policy processing wait time"=20secs DOES solve the problem with the software GPOs on Windows 7.

I have now built a new system (I am afraid that the original ones are now in use and I cannot just go around rebooting when the students are using them) in a similar way to the old ones, but cannot reproduce the problem with or without the "Startup policy processing wait time"=20secs policy. I still get a few Event ID 7000, 7017 and 7320 errors in the logs, but the software gets installed anyway. One difference between the old and the new systems is that I used the WDS automatic-domain-join to build the first ones, and I am now manually domain-joining for this last one. Could that have caused these problems? Users can log in to both new and old machines, so AD thinks they are part of the domain, but...

Thank you for your help.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 10191
Joined: Mon Nov 27, 2006 1:10 pm

Next

Return to Windows

Your Ad Here

Who is online

Users browsing this forum: No registered users and 6 guests