Return
-
Title
GPO Agent Install Fails - Testing share permissions -
Description
- During a GPO install of the agent, it may fail.
- First, test by manually installing the agent by copying it from the k1000 client share to the desktop of a test system and run it.
- If it does install successfully, examine the GPO.
- During a GPO install of the agent, it may fail.
-
Cause
When Installing the agent with a GPO, the GPO uses the local system account to install the software. A GPO also uses a network share. In order to access, the share needs permission set for the system service. One simple test is to run PsExec using the system account to test the share.
-
Resolution
Run the msi installer using PsExec to mimic system on the client -
- Download PsExec - http://download.sysinternals.com/files/PSTools.zip
- Copy it to c:\pstools and make sure the local Administrator account is enabled. In Windows 7 the default is for this account to be disabled (Run: net user administrator /active:yes to activate it)
- To open the cmd prompt as the local user you can then run c:\pstools\psexec.exe -accepteula -i -s "%windir%\system32\cmd.exe" -accepteula from a Administrator level command prompt - it MUST be elevated to work. This will open a new cmd window, with the system as the user.
- Next, try to run the install from the network share, with the full path to the install file -
"\\W2k8\gpo\Agent\ampagent-6.2.1020-x86_K16.rich.net.msi " is an example. - The msi should start to run.
- You may get an error accessing the share -
"Access is denied."
You need to provide permissions on the share to allow the system to access it. For example, Authenticated Users with Read permissions would allow the install to run. If more restrictive permissions are used, be sure to test them before deploying the GPO.
Or -
"The account used is a computer account. Use your global user account or local user account to access this server."
This may be seen on network shares on non MS operating systems. The share would need to be set up to allow the access the GPO requires, or the share should be moved to a Windows system/share.