Cannot Deploy Applications via Normal Group Policy Software Installation (GPSI)

A client ran into an issue that prevented them from deploying any application (including our Specops Deploy CSE) via normal Microsoft Windows GPSI. This was happening on a Windows 2008 R2 Domain and Windows 7 x86 clients, but I believe it could happen on any mixture of Windows OS and Domains.

Every time group policy ran they got a couple of events in the clients System Log – Event ID 108 and Event ID 1085 with the following data inside:

Error Code 2147746153
Error Description There is no software installation data object in the Active Directory.

A manual GPUPDATE would report that a GPSI was due to be carried out, but failed, and no further information was given.

I searched online, not a lot of results, but found that this error might be due to a “corrupt” Default Domain Policy GPO.

The physical GPO files are not corrupt, and GPOTOOL will not find any errors. But in AD itself, only viewable with ADSIEDIT.MSC, there will be a GPO that has the Microsoft Application Management CSE GUID, {C6DC5466-785A-11D2-84D0-00C04FB169F7}, specified in it.  Yet the same GPO does not display anything for installation under the GPO settings in GPMC or GPO Editor.

I checked out their Default Domain Policy, which was  fine. I had to figure out if there were any other policies that may have been affected in the same way. One way to find out which GPO is causing the issue is to search for the MAM CSE GUID in AD by using Powershell:

get-adobject -filter * -properties gPCMachineExtensionNames,displayname -searchbase "CN=Policies,CN=System,DC=specopsdemo,DC=ad" |  where {$_.gPCMachineExtensionNames -like "*{C6DC5466-785A-11D2-84D0-00C04FB169F7}*"}

Replace the DC=specopsdemo, DC=ad with the distinguished name of your domain.

This will display a list of GUIDs which relate to the GUID of the GPO’s that contain Group Policy Software Installations (in the picture above there is just one result being displayed).

Run GPOTOOL and pipe it to a text file to generate a list of GPO GUIDs and also their friendly names so that you can find them easier. GPOTOOL download: http://www.microsoft.com/download/en/details.aspx?id=17657

Check each GPO found by LDP for existing GPSI settings, and make sure they are valid e.g. the share is accessible.

If you find a GPO that is in list from LDP, but does not have any software installation settings displayed in GPMC, or GPO editor, then this is the corrupt GPO!

NOTE: BE VERY CAREFUL IN ADSIEDIT! You can fatally damage your Active Directory if you delete something you should not. Make sure you have a backup of your DC’s, and make sure you can recover it. I also advise that you make a copy of the contents of the gPMachineExtensionNames attribute, just in case you delete the wrong bit!

To fix it:

1. Open MSC
2. Connect to the default naming context: CN=policies,CN=system,DC=domain,DC=com
3. Right click on the GUID of the corrupt GPO, and select Properties.
4. Edit the gPMachineExtensionNames
5. Remove the Application Management CSE from the long list of GUID’s i.e.{C6DC5466-785A-11D2-84D0-00C04FB169F7}.
6. Click OK, and close ADSIEDIT.

Run GPUPDATE on your client computers and it will run through without error. Problem Solved! Carry on with the easy task of installing Specops Deploy! Thanks for reading, hope it helps someone.