Video Screencast Help
Search Video Help Close Back
to help
New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

Is there a property set when installing/uninstalling by Group Policy?

Updated: 23 May 2010 | 12 comments
Locoblade's picture
0 0 Votes
Login to vote

Hi All

Are there any Msiexec properties set only when an MSI is installed by group policy that I can use to control a condition based install, ie "if installed by GPO, then do this, if not, then do this"

The reason is because we have an important security application that is currently deployed only via Group Policy (running 2003 mixed mode domain). To ensure all newly built workstations have this app installed (without relying on GPO which can fail), I need to also install the application on the workstation build image so the app is already installed by default before it even joins the domain.

The problem I have is that when the newly built machine joins the domain and picks up policy, the existing policy for the security app runs, sees the app is already installed but unmanaged, uninstalls the build image install of the app then on next reboot reinstalls it again, which is not ideal and has been known to fail, leaving the machine without any install at all.

Ideally what I'd like to do is configure it so that the build image install becomes managed by GPO without the uninstall/reinstall process but having tried MS's recommendations on doing this (for an unmanaged Office install changing to managed), it doesn't work. The alternative is to modify the transform we use to deploy this app so that I can set a launch condition based on whether the original install was a group policy install or build image install, but I dont know of any specific properties set when an install is triggered by GPO to allow me to do this?

Alternatively, is there a way of simply telling the MSI that if its already installed (whether managed or unmanaged), no not reinstall?

Its not critical that the app becomes managed as we have other ways of uninstalling it if required, but what I do want to do is prevent the GPO install from removing and reinstalling it.

thanks
Chris

discussion Filed Under:

Comments

AngelD's picture
25
Jun
2009
1 Vote +1
Login to vote

I've not heard of any

I've not heard of any property being set regarding deployment solution.
You could try to search (APPSEARCH) for something in the registry regarding the GPO and use the property as a launch condition.

If you're now installing it unmanaged then why having it in the GPO too?

Locoblade's picture
25
Jun
2009
0 Votes 0
Login to vote

[quote]If you're now

[quote]If you're now installing it unmanaged then why having it in the GPO too?[/quote]

The problem is the GPO was deployed as "remove when out of scope" to the existing machines on the domain, and past experience has shown that even if you untick the box to prevent uninstall when out of scope, those machines that already have the policy will ignore this updated management setting, so if the policy is removed, they'll uninstall the app. Obviously not good :)

EdT's picture
25
Jun
2009
1 Vote +1
Login to vote

Group Policy

There is no specific property that I am aware of which reports which application deployment methodology has been used. Group Policy does not actually install an MSI, it just distributes it and then triggers msiexec.exe to perform the actual install.
So your solution appears to be to use a launch condition on your MSI which tests for an existing instance of this application, and only allows install if the existing application is not already present.
However, I don't see how you are going to get around any uninstalls that your GPO is performing. If your GPO process is unreliable, perhaps it should be investigated and fixed.

If your issue has been solved, please use the "Mark as Solution" link on the most relevant thread.

VBScab's picture
25
Jun
2009
0 Votes 0
Login to vote

See my response to your

See my response to your AppDeploy post.

Don't know why 'x' happened? Want to know why 'y' happened? Use ProcMon and it will tell you.
Think about using http://www.google.com before posting.

Locoblade's picture
25
Jun
2009
0 Votes 0
Login to vote

Hi Ed Ive set a launch

Hi Ed

Ive set a launch condition in the transform that checks for an existing install, and Ive managed to configure it so that when attempting to reinstall (running msiexec /i again), it runs, hits the launch condition and aborts but when uninstalling (msiexec /x) it ignores the launch condition and uninstalls cleanly.

What I was expecting GPO to do was to run msiexec /i  to attempt an install, which would fail the launch condition as above and abort, if it did this everything would have worked perfectly. However, it seems that GPO automatically runs msiexec /x so triggers the uninstall.

Regarding our GPO reliability, its quite reliable but with 10,000+ machines to manage there's always the odd machine that has issues picking up policy, and in this case we need to convince an accreditor that there's no loopholes in the system. We know all our existing machines have the app as we've audited them so GPO is really now a "legacy" of the original deployment. What we need to do now is ensure all newly built machines have the app, but by relying on GPO that can't really be done on an ongoing basis unless we manually check every machine introduced, which isn't really practical in our scenario.

cheers
Chris

Locoblade's picture
25
Jun
2009
0 Votes 0
Login to vote

Cheers VBScab, yep just reen

Cheers VBScab, yep just seen your response there which is pretty much what AngelD said above too, so I'll give that a go.

Chris

Tenacious Geo's picture
25
Jun
2009
0 Votes 0
Login to vote

What came to my mind was just

What came to my mind was just a vbscript to check to see if the registry key for the MSI is in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

And, if it's not, run the install.

'check to see if reg value exists
'vbscript

Const HKEY_LOCAL_MACHINE = &H80000002

strComputer = "."
Set objRegistry = GetObject("winmgmts:\\" & _
strComputer & "\root\default:StdRegProv")

strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion"
strValueName = "DevicePath"
objRegistry.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue

If IsNull(strValue) Then
Wscript.Echo "The registry key does not exist."
Else
Wscript.Echo "The registry key exists."
End If

-Geo

VBScab's picture
25
Jun
2009
0 Votes 0
Login to vote

George,

That doesn't differentiate between a managed (i.e. by GPO) or an unmanaged install: that data gets written in both scenarios.

Don't know why 'x' happened? Want to know why 'y' happened? Use ProcMon and it will tell you.
Think about using http://www.google.com before posting.

Tenacious Geo's picture
25
Jun
2009
1 Vote +1
Login to vote

Agreed. I was just touching

Agreed. I was just touching on this part of his original post though:

"Alternatively, is there a way of simply telling the MSI that if its already installed (whether managed or unmanaged), no not reinstall?

Its not critical that the app becomes managed as we have other ways of uninstalling it if required, but what I do want to do is prevent the GPO install from removing and reinstalling it. "

-Geo

VBScab's picture
25
Jun
2009
1 Vote +1
Login to vote

Ah...gotcha. I can go back to

Ah...gotcha. I can go back to my nap now :)

Don't know why 'x' happened? Want to know why 'y' happened? Use ProcMon and it will tell you.
Think about using http://www.google.com before posting.

Locoblade's picture
26
Jun
2009
0 Votes 0
Login to vote

Thanks all :)

Thanks all, I can stop it from uninstalling via GPO quite easily by making a system search to look for a file/reg entry belonging to the app, then setting a launch condition based on the property this sets, the trick is to do this but still allow a clean uninstall if its actually required. If you just look for the app and don't allow install if it exists, you either don't fix the problem because this doesnt apply when removing  (so GPO can remove it), or you allow this launch condition to apply when removing which means you can never cleanly uninstall the app manually either

I thought Id mention what Ive ended up doing in case it helps others in the future. I've set up a couple of system searches, one looks for the group policy info as suggested above (in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt\{xxxx xxxx xxxx} )and sets a property "GPOINSTALLED" if found, the other looks for the app itself and sets a property "FOUNDAPP". A launch condition is then set based on FOUNDAPP so if the FOUNDAPP property exists, it prevents the uninstall/reinstall. This stops the uninstall when GPO tries to apply, but to allow intentional uninstalls in different circumstances ive put in these lines after AppSearch but before LaunchConditions

IF REMOVE~="ALL" and GPOINSTALLED
SET Property FOUNDAPP=    
(i.e. blank)

This re-sets the FOUNDAPP property to null before it runs the launch conditions if deployed originally by GPO (ie not on the build image), allowing the app to uninstall if that policy dictates (which shouldnt happen in theory but worth putting in as a safeguard)

IF REMOVE~="ALL" and MANUALREMOVE
SET Property FOUNDAPP=      
(i.e. blank)

This re-sets the FOUNDAPP property to null if the MANUALREMOVE property exists, so when running an uninstall from GPO when it wasn't deployed by GPO, the MANUALREMOVE property wont exist so it can't uninstall. If I need to uninstall the app though, I can do an msiexec /x myapp.msi MANUALREMOVE=YES to set the manual remove property, thus re-setting the FOUNDAPP property to null and allowing the removal.

EdT's picture
26
Jun
2009
0 Votes 0
Login to vote

Are you installing per-machine or per-user?

Are you setting ALLUSERS=1 in the property table? 
I've found it more reliable in corporate environment to stick with Per-machine deployments, especially where there are roaming users.

If your issue has been solved, please use the "Mark as Solution" link on the most relevant thread.