ALLUSERS property is not 1

[justmark]

I'm trying to figure out how to install the latest version of Defender via
GPO (published). When I try to install, I'm presented with this error:

1:ALLUSERS property is not 1 - this MSM cannot be used for a per-user or
fallback-to-per-user install.

If I configure the GPO with user or without user interaction, I still get
this. I've been Googling all day without much luck.

If I just run the .msi, it installs without any trouble on my machine (on
which I'm Administrator too so I don't think this is a permissions issue).

Any suggestions?

Thanks!
Mark

 

[Bill Sanderson]

This has been discussed in these groups before, but I am not certain we
reached a useful conclusion. Have you done a search?

I see you mention Google--but try the search on the web or NNTP versions of
these forums--probably this group. I'll look back at this later as time
permits--perhaps this evening, and see if I can dredge anything up.

 

[Bill Sanderson]

Found it--from July 28th, this group:
---
(from anonymous poster JC)
---
I just had this problem. In GP where it asks for the location of the
WindowsDefender.msi, instead of just locating the file, put in a FQDM
(Example: \\server\updates\windowsdefender.msi) in the space where you would
normally just put in c:\updates\windowsdefender.msi.
this worked for me.

 

[Engel]

HHello Mark,

See if this help
http://support.microsoft.com/kb/927367
- -- ---


ANGER
Two things a man should never be angry at; what he can help, and what he
cannot help.

 

[justmark]

Hi Engel,
I read that KB article, but it's mostly about registry keys for
administrative control - was that the number you meant to type?

Thanks,
Mark

 

[justmark]

Hi Bill,
I went and tried this and it didn't help :-(

On a whim, I also tried creating a new GPO and assigned this rather than
publishing it and it errored out and the service wouldn't start (which I
remember reading elsewhere was a problem with assigned installations).

The weird thing is that the more I read about the ALLUSERS, it seems to
point to problems with users not having administrative rights to install
Defender, but in my case, I'm the administrator and I gave myself full admin
rights to my own workstation, so I think there's something more subtle
happening. I'll be darned if I can figure out what though...

Mark

 

[Bill Sanderson]

In one of the two previous threads on this issue, I had thought that this
message might be different if no previous install of Windows Defender had
been done on a given machine. I think I'd suggested using the Installer
Cleanup tool to wipe traces of the installer entries from the registry.

Is this a scenario you can test? (i.e. best--a machine which has never seen
Windows Defender, and second best--use the Installer Cleanup tool to remove
Windows Defender and its definitions, and retry the install)

I don't think that idea got any traction because the post I gave you
previously seemed to be authoritative, or, at least, the thread didn't
continue.

Another place where you might find experience with this kind of issue would
be in one of the Server-related groups, or one related to Group Policy
related issues.

 

[justmark]

Hi Bill,

I just had an admin-rights user try it on her workstation and the same thing
happened. Her workstation was recently rebuilt and has never seen Defender.

I'm starting to think that this may not be possible, but I'll still try
posting somewhere in the forums you'd mentioned.

Thanks!
Mark

 

[turbojake1]

Another option is to try installing from the .exe instead of using the msi. It is likely that prerequisites are needed before the installation and these are not included in the msi.