Windows Server 2003 : Troubleshooting Software Deployed with Group Policy - Software Deployment Troubleshooting Scenarios

Tools to Troubleshoot Group Policy

As an administrator, you will likely have the task of finding solutions to problems with software deployed with Group Policy. If problems occur, you might need to perform some tests to verify that your Group Policy configuration is working properly, and diagnose and solve problems. Windows Server 2003 operating systems provide the following Group Policy troubleshooting tools to assist you in verifying your configuration and in diagnosing and solving problems:

• Resultant Set Of Policy Wizard

• Gpresult.exe

• Gpupdate.exe

• Event Viewer

• Log files

Advanced Diagnostic Information

You can use the advanced diagnostic information provided in the Advanced Deployment Options dialog box to troubleshoot software deployed with Group Policy. The Advanced Deployment Options dialog box, lists the following:

• Product Code A globally unique identifier (GUID) that identifies the application and its version.

• Deployment Count Displays the number of times the package has been redeployed.

• Script Name Displays the full path to the application assignment script (.aas file). An application assignment script contains instructions associated with the assignment or publication of a package and is generated for every published or assigned application in a GPO and stored in that domain’s GPO.

To view advanced diagnostic information, complete the following steps:

1.	Open the GPO console for the deployed application. In the Computer Configuration or User Configuration node, open Software Settings.
2.	Click the Software Installation node.
3.	In the details pane, right-click the package for which you want to view advanced diagnostic information and then click Properties.
4.	Click the Deployment tab, and then click Advanced.

Software Deployment Troubleshooting Scenarios

Table 1 describes some troubleshooting scenarios related to software deployed with Group Policy.

Table 1. Software Deployment Troubleshooting Scenarios

Problem: Published applications do not appear for the user in Add Or Remove Programs in Control Panel.
Cause	Solution
The client is running Terminal Services on the desktop.	Use Addiag.exe to see whether Terminal Services is running on the user’s desktop. Software deployed with Group Policy is not supported for Terminal Services clients. (Addiag.exe is a part of the Windows Support Tools on the Windows Server 2003 CD.)
Group Policy is not applied to this user.	Run Gpresult.exe for the user to ensure that the GPO is applied to the user.
The user has not logged on since the GPO was created.	Have the user log off and log back on. Ensure that the user is authenticated by the domain controller.
The GPO did not run.	Run Gpresult.exe to verify that the GPO runs.
The user cannot access Active Directory.	Check to see whether the user can access Active Directory.
The user cannot access the SDP.	Use Ping.exe to test connectivity. Check the user’s permissions on the SDP.
Problem: When a user activates a document with the extension used in a published application, the application does not install.
Cause	Solution
Auto-install is not set.	Ensure that Auto-Install This Application By File Extension Activation is checked in the Deployment tab in the Properties dialog box for the package.
Additional causes and solutions are listed in the “Published applications do not appear for the user in Add Or Remove Programs in Control Panel” problem.
Problem: When a user activates a document with the extension used in a published application, an unexpected application automatically installs.
Cause	Solution
The precedence of filename extensions has not been set properly.	Check to see that the File Extensions tab in the Software Installation Properties dialog box has the correct application precedence set.
Problem: An application assigned to a computer does not install.
Cause	Solution
The computer has not been restarted since the application was assigned and the GPO has not been applied.	Restart the computer.
The GPO does not apply to the computer.	Check the GPO console to make sure the GPO manages the computer.
Group Policy did not run.	Run Gpresult.exe for the computer to ensure that the GPO is applied to the computer.
The computer is not able to access Active Directory.	Use Ping.exe to test connectivity to the domain controller.
The computer is not able to access the SDP.	Use Ping.exe to test connectivity to the SDP.
Problem: A user who has never installed a managed application selects the application to install. The installation begins, and one of many error messages appears.
Cause	Solution
There are problems with the Windows Installer package.	Install the package on another computer, and make sure the package can be opened.
The user does not have the appropriate permissions to read the Windows Installer package from the SDP or to install the application to the installation target folder as defined in the package.	Verify that the user has Read permission on the SDP and Write access to the installation target directory.
Problem: A previously installed, assigned application is unexpectedly removed.
Cause	Solution
The Uninstall The Applications When They Fall Out Of The Scope Of Management check box in the Advanced tab of the Software Installation Properties dialog box is selected and the scope of management has changed.	Check to see whether the GPO containing the managed application still applies to the user or computer.
The software is managed by a GPO linked to a site or OU, and the computer moved to a new site or OU.	Check to see whether the computer has moved to a new site or OU.
Problem: The user receives an error message such as “The feature you are trying to install cannot be found in the source directory.”
Cause	Solution
There are network or permissions problems.	Make sure the network is working correctly. Ensure that the user has Read and Apply Group Policy permissions for the GPO. Ensure that the folder containing the application on the SDP is shared. Ensure that the user has Read permission for the SDP. Ensure that the user has Read permission for the folder containing the application on the SDP.
Problem: After removal of an application, the shortcuts for the application still appear on the user’s desktop.
Cause	Solution
The user has created shortcuts and the Windows Installer service has no knowledge of them.	The user must remove the shortcuts manually.
Automatic upgrade of the application has left shortcuts for the application being upgraded.	Check to see whether there is a new version of the application, and if so, delete the shortcuts.
Problem: The user attempts to install a published or assigned application and receives an error message such as “Another installation is already in progress.”
Cause	Solution
The Windows Installer service is already running another installation.	The user should wait for the installation to complete and try again later.
Problem: The user opens an already installed application, and the Windows Installer service starts.
Cause	Solution
An application is undergoing automatic repair.	In both cases, the user must wait for the installation to complete.
A feature is being added.
Problem: The administrator receives error messages such as “Active Directory will not allow the package to be deployed” or “Cannot prepare package for deployment.”
Cause	Solution
The Windows Installer service cannot communicate with the computer on which the SDP is located.	Use Ping.exe to test connectivity with the SDP.
The package is corrupted.	Install the package on another computer, and make sure the package can be opened.

Real World: Troubleshooting Application Management Issues If you are facing a difficult software distribution issue, and you’ve verified that the software deployment options are correct, you might want to enable Application Management debugging. To do this, you must go to the system experiencing the problem and log on as an administrator. You then enable Application Management debugging by editing the registry as described in the following steps: Click Start, click Run, type Regedit, and then press ENTER. In the Registry Editor, expand the following path: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion. Right-click the CurrentVersion key, point to New, and then click Key. Type Diagnostics as the new key name, and then press ENTER. Right-click the Diagnostics key, point to New, and then click DWORD Value. Type AppMgmtDebugLevel as the name of the new value, and then press ENTER. Double-click the AppMgmtDebugLevel value. In the Edit DWORD Value dialog box, type 4b in the Value Data box and then click OK. Close the Registry Editor. Once you restart the computer (for applications assigned to the computer) or have logged on the user (for applications assigned or published to the user), you should be able to find the AppMgmt.log file in the %systemroot%\debug\usermode folder. Read the entries in this file to gain insight into the problems that are occurring with the application installation. If you don’t see this log file, it could be that the application deployment policy is not even reaching the local client system. This could be the case if the policy is disabled or possibly being filtered through inheritance blocking or security filtering. After you complete your debugging, be sure to remove the AppMgmtDebugLevel key so that you don’t waste system resources logging information that you don’t require.