I'm trying to figure out how to install the latest version of Defender via
GPO (published). When I try to install, I'm presented with this error:

1:ALLUSERS property is not 1 - this MSM cannot be used for a per-user or
fallback-to-per-user install.

If I configure the GPO with user or without user interaction, I still get
this. I've been Googling all day without much luck.

If I just run the .msi, it installs without any trouble on my machine (on
which I'm Administrator too so I don't think this is a permissions issue).

Any suggestions?

Thanks!
Mark

This has been discussed in these groups before, but I am not certain we
reached a useful conclusion. Have you done a search?

I see you mention Google--but try the search on the web or NNTP versions of
these forums--probably this group. I'll look back at this later as time
permits--perhaps this evening, and see if I can dredge anything up.

"justmark" <(E-Mail Removed)> wrote in message
news:687B899D-B7D8-4E2E-BA3D-(E-Mail Removed)...
> I'm trying to figure out how to install the latest version of Defender via
> GPO (published). When I try to install, I'm presented with this error:
>
> 1:ALLUSERS property is not 1 - this MSM cannot be used for a per-user or
> fallback-to-per-user install.
>
> If I configure the GPO with user or without user interaction, I still get
> this. I've been Googling all day without much luck.
>
> If I just run the .msi, it installs without any trouble on my machine (on
> which I'm Administrator too so I don't think this is a permissions issue).
>
> Any suggestions?
>
> Thanks!
> Mark

Found it--from July 28th, this group:
---
(from anonymous poster JC)
---
I just had this problem. In GP where it asks for the location of the
WindowsDefender.msi, instead of just locating the file, put in a FQDM
(Example: \\server\updates\windowsdefender.msi) in the space where you would
normally just put in c:\updates\windowsdefender.msi.
this worked for me.

HHello Mark,

See if this help
http://support.microsoft.com/kb/927367
- -- ---


ANGER
Two things a man should never be angry at; what he can help, and what he
cannot help.


"justmark" wrote:

> I'm trying to figure out how to install the latest version of Defender via
> GPO (published). When I try to install, I'm presented with this error:
>
> 1:ALLUSERS property is not 1 - this MSM cannot be used for a per-user or
> fallback-to-per-user install.
>
> If I configure the GPO with user or without user interaction, I still get
> this. I've been Googling all day without much luck.
>
> If I just run the .msi, it installs without any trouble on my machine (on
> which I'm Administrator too so I don't think this is a permissions issue).
>
> Any suggestions?
>
> Thanks!
> Mark

Hi Engel,
I read that KB article, but it's mostly about registry keys for
administrative control - was that the number you meant to type?

Thanks,
Mark




"Engel" wrote:

> HHello Mark,
>
> See if this help
> http://support.microsoft.com/kb/927367

Hi Bill,
I went and tried this and it didn't help :-(

On a whim, I also tried creating a new GPO and assigned this rather than
publishing it and it errored out and the service wouldn't start (which I
remember reading elsewhere was a problem with assigned installations).

The weird thing is that the more I read about the ALLUSERS, it seems to
point to problems with users not having administrative rights to install
Defender, but in my case, I'm the administrator and I gave myself full admin
rights to my own workstation, so I think there's something more subtle
happening. I'll be darned if I can figure out what though...

Mark

"Bill Sanderson" wrote:

> Found it--from July 28th, this group:
> ---
> (from anonymous poster JC)
> ---
> I just had this problem. In GP where it asks for the location of the
> WindowsDefender.msi, instead of just locating the file, put in a FQDM
> (Example: \\server\updates\windowsdefender.msi) in the space where you would
> normally just put in c:\updates\windowsdefender.msi.
> this worked for me.
>
>

In one of the two previous threads on this issue, I had thought that this
message might be different if no previous install of Windows Defender had
been done on a given machine. I think I'd suggested using the Installer
Cleanup tool to wipe traces of the installer entries from the registry.

Is this a scenario you can test? (i.e. best--a machine which has never seen
Windows Defender, and second best--use the Installer Cleanup tool to remove
Windows Defender and its definitions, and retry the install)

I don't think that idea got any traction because the post I gave you
previously seemed to be authoritative, or, at least, the thread didn't
continue.

Another place where you might find experience with this kind of issue would
be in one of the Server-related groups, or one related to Group Policy
related issues.
"justmark" <(E-Mail Removed)> wrote in message
news:3ADBBE31-30A2-4F74-8183-(E-Mail Removed)...
> Hi Bill,
> I went and tried this and it didn't help :-(
>
> On a whim, I also tried creating a new GPO and assigned this rather than
> publishing it and it errored out and the service wouldn't start (which I
> remember reading elsewhere was a problem with assigned installations).
>
> The weird thing is that the more I read about the ALLUSERS, it seems to
> point to problems with users not having administrative rights to install
> Defender, but in my case, I'm the administrator and I gave myself full
> admin
> rights to my own workstation, so I think there's something more subtle
> happening. I'll be darned if I can figure out what though...
>
> Mark
>
> "Bill Sanderson" wrote:
>
>> Found it--from July 28th, this group:
>> ---
>> (from anonymous poster JC)
>> ---
>> I just had this problem. In GP where it asks for the location of the
>> WindowsDefender.msi, instead of just locating the file, put in a FQDM
>> (Example: \\server\updates\windowsdefender.msi) in the space where you
>> would
>> normally just put in c:\updates\windowsdefender.msi.
>> this worked for me.
>>
>>

Hi Bill,

I just had an admin-rights user try it on her workstation and the same thing
happened. Her workstation was recently rebuilt and has never seen Defender.

I'm starting to think that this may not be possible, but I'll still try
posting somewhere in the forums you'd mentioned.

Thanks!
Mark


"Bill Sanderson" wrote:

> In one of the two previous threads on this issue, I had thought that this
> message might be different if no previous install of Windows Defender had
> been done on a given machine. I think I'd suggested using the Installer
> Cleanup tool to wipe traces of the installer entries from the registry.
>
> Is this a scenario you can test? (i.e. best--a machine which has never seen
> Windows Defender, and second best--use the Installer Cleanup tool to remove
> Windows Defender and its definitions, and retry the install)
>
> I don't think that idea got any traction because the post I gave you
> previously seemed to be authoritative, or, at least, the thread didn't
> continue.
>
> Another place where you might find experience with this kind of issue would
> be in one of the Server-related groups, or one related to Group Policy
> related issues.
> "justmark" <(E-Mail Removed)> wrote in message
> news:3ADBBE31-30A2-4F74-8183-(E-Mail Removed)...

[turbojake1]

Another option is to try installing from the .exe instead of using the msi. It is likely that prerequisites are needed before the installation and these are not included in the msi.