Cannot Deploy Applications via Normal Group Policy Software Installation (GPSI)

A client ran into an issue that prevented them from deploying any application (including our Specops Deploy CSE) via normal Microsoft Windows GPSI. This was happening on a Windows 2008 R2 Domain and Windows 7 x86 clients, but I believe it could happen on any mixture of Windows OS and Domains.

Every time group policy ran they got a couple of events in the clients System Log – Event ID 108 and Event ID 1085 with the following data inside:

Error Code 2147746153
Error Description There is no software installation data object in the Active Directory.

A manual GPUPDATE would report that a GPSI was due to be carried out, but failed, and no further information was given.

I searched online, not a lot of results, but found that this error might be due to a “corrupt” Default Domain Policy GPO.

The physical GPO files are not corrupt, and GPOTOOL will not find any errors. But in AD itself, only viewable with ADSIEDIT.MSC, there will be a GPO that has the Microsoft Application Management CSE GUID, {C6DC5466-785A-11D2-84D0-00C04FB169F7}, specified in it.  Yet the same GPO does not display anything for installation under the GPO settings in GPMC or GPO Editor.

I checked out their Default Domain Policy, which was  fine. I had to figure out if there were any other policies that may have been affected in the same way. One way to find out which GPO is causing the issue is to search for the MAM CSE GUID in AD by using Powershell:

get-adobject -filter * -properties gPCMachineExtensionNames,displayname -searchbase "CN=Policies,CN=System,DC=specopsdemo,DC=ad" |  where {$_.gPCMachineExtensionNames -like "*{C6DC5466-785A-11D2-84D0-00C04FB169F7}*"}

Replace the DC=specopsdemo, DC=ad with the distinguished name of your domain.

screenshot to find out which GPO is causing issue for Normal Group Policy Software Installation

This will display a list of GUIDs which relate to the GUID of the GPO’s that contain Group Policy Software Installations (in the picture above there is just one result being displayed).

Run GPOTOOL and pipe it to a text file to generate a list of GPO GUIDs and also their friendly names so that you can find them easier. GPOTOOL download: http://www.microsoft.com/download/en/details.aspx?id=17657

Check each GPO found by LDP for existing GPSI settings, and make sure they are valid e.g. the share is accessible.

If you find a GPO that is in list from LDP, but does not have any software installation settings displayed in GPMC, or GPO editor, then this is the corrupt GPO!

NOTE: BE VERY CAREFUL IN ADSIEDIT! You can fatally damage your Active Directory if you delete something you should not. Make sure you have a backup of your DC’s, and make sure you can recover it. I also advise that you make a copy of the contents of the gPMachineExtensionNames attribute, just in case you delete the wrong bit!

To fix it:

  1. Open MSC
  2. Connect to the default naming context: CN=policies,CN=system,DC=domain,DC=com
  3. Right click on the GUID of the corrupt GPO, and select Properties.
  4. Edit the gPMachineExtensionNames
  5. Remove the Application Management CSE from the long list of GUID’s i.e.{C6DC5466-785A-11D2-84D0-00C04FB169F7}.
  6. Click OK, and close ADSIEDIT.

screenshot of string attribute editor for Normal Group Policy Software Installation

Run GPUPDATE on your client computers and it will run through without error. Problem Solved! Carry on with the easy task of installing Specops Deploy! Thanks for reading, hope it helps someone.

Deploy trial CTA - 1080 px

(Last updated on August 9, 2023)

Tags: , ,

darren james

Written by

Darren James

Darren James is a Senior Product Manager at Specops Software, an Outpost24 company. Darren is a seasoned cybersecurity professional with more than 20 years of experience in the IT industry. He has worked as a consultant across various organizations and sectors, including central and local governments, retail and energy. His areas of specialization include identity and access management, Active Directory, and Azure AD. Darren has been with Specops Software for more than 12 years and brings his expertise to the support and development of world-class password security and authentication solutions. 

Back to Blog

Related Articles

  • [Guest blog] Specops OS Deploy – Windows 10 notes

    If you are a Specops Deploy customer and looking to deploy applications to Windows 10 computers in your environment. I have good News!  Windows 10 works great in Specops OS Deploy 6.0! I’m now on my second Windows 10 Education release from Microsoft, and we’re able to deploy as needed. Few Notes: I created a…

    Read More
  • 4 Steps to Troubleshooting Group Policy

    A customer called recently who was having some pretty basic troubles with Specops Deploy. What struck a chord with me was how important the simple, basic steps are in troubleshooting Group Policy. Sure, there is plenty of complex stuff to work through but if the process always begins with simple, known good steps, the chances…

    Read More