Friday, February 17, 2012

Cannot Deploy Applications via Normal Group Policy Software Installation (GPSI)

I had an issue with a client this week where they could not deploy any application (including our Specops Deploy CSE) via normal Microsoft Windows group policy software installation. This was happening on a Windows 2008 R2 Domain and Windows 7 x86 clients, but I believe it could happen on any mixture of Windows OS and Domains.

Every time group policy ran they get a couple of events in the clients System Log.
Event ID 108 and Event ID 1085 with the following data inside.

Error Code 2147746153
Error Description There is no software installation data object in the Active Directory. 
A manual GPUPDATE would report that a group policy software installation was due but failed, but no further information was given.

Did some googling, not a lot of results, but found that this error might be due to a "corrupt" Default Domain Policy GPO. The physical GPO files are not corrupt and GPOTOOL will not find any errors, but in AD (only viewable with ADSIEDIT.MSC) there will be a GPO that has the Microsoft Application Management CSE GUID ({C6DC5466-785A-11D2-84D0-00C04FB169F7}) specified in it, but that same GPO does not display anything to be installed under the GPO settings in GPMC or GPO Editor.

I checked out their Default Domain Policy, that was fine. I then had to figure out a way of finding if there were any other policies that may had been affected in the same way.

The only way to find out which GPO is causing the issue is to search for the GUID in AD by using LDP. More info on LDP below


Bind to your local DC with Domain Admin credentials

choose a base DN e.g.

CN=policies,CN=system,DC=domain,DC=com
Choose a filter of

(gPCMachineExtensionNames=*{C6DC5466-785A-11D2-84D0-00C04FB169F7}*)

Choose Subtree for your Scope



This will display a list of GUIDs which relate to the GUID of the GPO's that contain Group Policy Software Installations (in the picture above there is just one result being displayed)

Run GPOTOOL and pipe it to a text file to generate a list of GPO GUIDs and also their friendly names. GPOTOOL download below

Check each GPO found by LDP for existing GPSI settings, and make sure they are valid e.g. the share is accessible etc

If you find a GPO that is in list from LDP but does not have any software installation settings displayed in GPMC or GPO editor then this is the corrupt GPO.

NOTE! BE VERY CAREFUL IN ADSIEDIT. You can fatally damage your Active Directory if you delete something you shouldn't! Make sure you have a backup of your DC's and make sure you can recover it. I'd also advise that you make a copy of the contents of gPMachineExtensionNames attribute just in case you delete the wrong bit!


To fix it just open ADSIEDIt, connect to the default naming context.

CN=policies,CN=system,DC=domain,DC=com
right click on the GUID of the corrupt GPO, and select Properties

edit the gPMachineExtensionNames attribute

and remove the Application Management CSE from the long list of GUID's

{C6DC5466-785A-11D2-84D0-00C04FB169F7}


Run GPUPDATE on your client computers and it will run through without error.

Problem Solved.... Carry on with the easy task of installing Specops Deploy!

Thanks for reading, hope it helps someone.

1 comment:

  1. Great article Darren - a customer I was working with just had this same issue and your detailed steps helped us solve it! Heather Pacan

    ReplyDelete