Software Deployment GPOs failing on 2000 workstations from old security GPO?

[Greg H]

I posted the message listed below a while back. The problem I had was
that software deployed via GPOs would work on XP workstations but not
on Windows 2000 workstations. I was told that before I began working
in this department that the 2000 Domain had a very restrictive
security GPO, which may be while the 2000 workstations still fail to
install software via GPOs. I tested that theory and built 2 test
Windows 2000 workstations. The software GPOs deployed perfectly on the
test PCs with a clean Windows 2000 Pro install. So I believe the
settings from the old domain security GPO are being maintained in the
registry of the affected workstations. Is it possible to reset
security settings on workstations somehow? I do not have a copy of the
old security policy so I do not know what the settings were. I can
compare the 2000 workstations that I built to an older workstation but
I'm not sure what I'm looking for.

Thanks,

Greg



-----------------------
I was working at a company running AD 2003 with all XP PRO
workstations. Now I'm at an organization that has AD 2000 with a lot
of 2000 workstations and some XP workstations.


I setup a group policy to assign the installation of office 2003 to
computers. It installs fine on XP workstations but 2000 workstations
get errors in the application log (Event ID 1000 and 108). The install

does not even appear to start. I have checked here and Microsoft's
site for fixes and clues but nothing so far has helped. At first, it
looked like a permissions issue so I changed the share and NTFS
permissions on the software share so that Domain Computers have access
as well as Authenticated Users, thinking that might help but it has
not. I also added the Everyone Group but that did not help either.


The errors are listed below. If anyone has any ideas on this, I'd
appreciate it. Thanks in advance.


Greg
-------------
Source: Usernv
Type: Error
EventID 1000
User: NT Authority\System
Computer: COMPUTER8
Description:
The Group Policy client-side extension Application Management was
passed flags (1) and returned a failure status code of (5).


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


----------------------------------------


Source Application Management
Type: Error
Event ID: 108
User: NT Authority\System
Computer: COMPUTER8
Description:
Failed to apply changes to software installation settings. The Active
Directory path could not be updated at the client. The error was
Access is denied. .

 

[lforbes]

I posted the message listed below a while back. The problem I
had was
that software deployed via GPOs would work on XP workstations
but not
on Windows 2000 workstations. I was told that before I began
working
in this department that the 2000 Domain had a very restrictive
security GPO, which may be while the 2000 workstations still
fail to
install software via GPOs. I tested that theory and built 2
test
Windows 2000 workstations. The software GPOs deployed
perfectly on the
test PCs with a clean Windows 2000 Pro install. So I believe
the
settings from the old domain security GPO are being maintained
in the
registry of the affected workstations. Is it possible to
reset
security settings on workstations somehow? I do not have a
copy of the
old security policy so I do not know what the settings were.
I can
compare the 2000 workstations that I built to an older
workstation but
I'm not sure what I'm looking for.

Thanks,

Greg



-----------------------
I was working at a company running AD 2003 with all XP PRO
workstations. Now I'm at an organization that has AD 2000
with a lot
of 2000 workstations and some XP workstations.


I setup a group policy to assign the installation of office
2003 to
computers. It installs fine on XP workstations but 2000
workstations
get errors in the application log (Event ID 1000 and 108).
The install

does not even appear to start. I have checked here and
Microsoft's
site for fixes and clues but nothing so far has helped. At
first, it
looked like a permissions issue so I changed the share and
NTFS
permissions on the software share so that Domain Computers
have access
as well as Authenticated Users, thinking that might help but
it has
not. I also added the Everyone Group but that did not help
either.


The errors are listed below. If anyone has any ideas on this,
I'd
appreciate it. Thanks in advance.


Greg
-------------
Source: Usernv
Type: Error
EventID 1000
User: NT AuthoritySystem
Computer: COMPUTER8
Description:
The Group Policy client-side extension Application Management
was
passed flags (1) and returned a failure status code of (5).


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


----------------------------------------


Source Application Management
Type: Error
Event ID: 108
User: NT AuthoritySystem
Computer: COMPUTER8
Description:
Failed to apply changes to software installation settings.
The Active
Directory path could not be updated at the client. The error
was
Access is denied.

Hi,

Have you checked to make sure that SYSTEM=FULL Control is on ALL
folders including C: and C:Winnt on the workstations?

My machines are pretty restricted. I use NTFS to give everyone=Read
except Administrators and SYSTEM=Full Control. My workstations have
no problems installing.

If the XP machines are fine accessing the Domain share and installing,
then it is not the software install, the GP or the Domain setup at
all. The problem lies with the individual workstations.

It is very rare that registry settings would restrict this install,
espeically seeing as Group Policies apply ONLY when the computers are
in the OU that the GP is on. The minute they are moved out they are
unaffected(unless they used to be part of an NT domain which tatooed
the registry).

My guess is that the Permissions on the local workstations are causing
the problem.

Cheers,

Lara