我是GPO推送安装的新手。 我只是configuration了一个组策略来推送域中机器的软件。 但是,它失败,错误代码1603。
以下是客户端上的日志appmgmt。
07-27 17:14:16:775 Software installation extension has been called for foreground synchronous policy refresh. The following policies are to be applied, flags are 1. SecureAge Distribute (unique identifier {AE19597D-CBD3-42EF-AEE8-09FBBFA13171}) System volume path = \\dev.sa.com\SysVol\dev.sa.com\Policies\{AE19597D-CBD3-42EF-AEE8-09FBBFA13171}\Machine Active Directory path = LDAP://CN=Machine,cn={AE19597D-CBD3-42EF-AEE8-09FBBFA13171},cn=policies,cn=system,DC=dev,DC=sa,DC=com Set the Active Directory path to LDAP://CN=Class Store,CN=Machine,cn={AE19597D-CBD3-42EF-AEE8-09FBBFA13171},cn=policies,cn=system,DC=dev,DC=sa,DC=com;. Enumerating applications in the Active Directory for computer CHENBOXPSP3X32 with flags 5. CSTORE: Retrieving class store path for the system account. CSTORE: Retrieved 1 class stores for the user or machine. CSTORE: Attempting to bind to class store 0 with path LDAP://CN=Class Store,CN=Machine,cn={AE19597D-CBD3-42EF-AEE8-09FBBFA13171},cn=policies,cn=system,DC=dev,DC=sa,DC=com. CSTORE: Bind attempt returned error code 0. CSTORE: Enumerating packages with search filter (&(objectclass=packageRegistration)(|(|(msiScriptName=*A*)(&(canUpgradeScript=*)(msiScriptName=*P*)))(!(msiScriptName=*)))) and flags ce00000. CSTORE: Examining retrieved package SecureAge. The following applications were found in policy SecureAge Distribute. Assigned application SecureAge (flags a0004c70). Found 1 applications in policy SecureAge Distribute. Enumerating the managed applications which are currently applied to this user. No managed applications are currently applied to this user. Found 0 applications locally that are not included in the set of applications from the Active Directory. Application SecureAge from policy SecureAge Distribute is set for installation because it is assigned to this computer policy. Assigning application SecureAge from policy SecureAge Distribute. Calling the Windows Installer to advertise application SecureAge from script C:\WINDOWS\system32\appmgmt\MACHINE\{e7b03277-41c7-41b4-8863-cffe4d61237e}.aas with flags 69. Windows Installer cannot advertise application SecureAge from script C:\WINDOWS\system32\appmgmt\MACHINE\{e7b03277-41c7-41b4-8863-cffe4d61237e}.aas, error 1603.. The assignment of application SecureAge from policy SecureAge Distribute failed. The error was : %1603
和
Removing application SecureAge from the software installation database. Calling Windows Installer to remove application advertisement for application SecureAge from script C:\WINDOWS\system32\appmgmt\MACHINE\{e7b03277-41c7-41b4-8863-cffe4d61237e}.aas. Windows Installer cannot remove application advertisement for application SecureAge from script C:\WINDOWS\system32\appmgmt\MACHINE\{e7b03277-41c7-41b4-8863-cffe4d61237e}.aas, error 1603. The removal of the assignment of application SecureAge from policy SecureAge Distribute failed. The error was : %1603 Policy Logging for Software Management is attempting to log application SecureAge from policy SecureAge Distribute. Failed to apply changes to software installation settings. Software changes could not be applied. A previous log entry with details should exist. The error was : %1603
和
Software installation extension returning with final error code 1603. 07-27 17:14:25:665 Software installation extension has been called for foreground synchronous policy refresh. The following policies are to be applied, flags are 80. SecureAge Distribute (unique identifier {AE19597D-CBD3-42EF-AEE8-09FBBFA13171}) System volume path = \\dev.sa.com\SysVol\dev.sa.com\Policies\{AE19597D-CBD3-42EF-AEE8-09FBBFA13171}\User Active Directory path = LDAP://CN=User,cn={AE19597D-CBD3-42EF-AEE8-09FBBFA13171},cn=policies,cn=system,DC=dev,DC=sa,DC=com Set the Active Directory path to LDAP://CN=Class Store,CN=User,cn={AE19597D-CBD3-42EF-AEE8-09FBBFA13171},cn=policies,cn=system,DC=dev,DC=sa,DC=com;. Policy has not changed. Only assigned applications will be advertised. Enumerating the managed applications which are currently applied to this user. No managed applications are currently applied to this user. Found 0 applications locally that are not included in the set of applications from the Active Directory. Software installation extension returning with final error code 0.
我试图search像“Windows安装程序不能广告应用程序…从脚本…”,但没有任何提示。
另外,%temp%文件夹中没有安装msi的日志。
编辑:应用程序事件中的事件信息如下:
Event ID: 101 (error) The assignment of application SecureAge from policy SecureAge Distribute failed. The error was : Fatal error during installation. Event ID: 103 (error) The removal of the assignment of application SecureAge from policy SecureAge Distribute failed. The error was : Fatal error during installation. Event ID: 108 (error) Failed to apply changes to software installation settings. Software changes could not be applied. A previous log entry with details should exist. The error was : Fatal error during installation. Event ID: 1085 (error) The Group Policy client-side extension Software Installation failed to execute. Please look for any errors reported earlier by that extension.
我跟着这个链接来设置组策略,因为我是新手,所以无法发布截图。 http://support.microsoft.com/kb/816102
这个问题发生在Windows XP和7 32位主机上。 主机在VMWare中运行。
编辑2:我试图使用启动脚本来安装软件包,它适用于Windows 7客户端。 在Windows 7客户端的启动阶段,popup的“交互式服务检测”窗口显示已安装的软件想显示一些消息。 除此之外,安装工作正常,在安装过程中不需要input。 请注意,手动安装msi会显示安装后需要重新启动的消息。
启动脚本如下:
Set WshShell = CreateObject("WScript.Shell") Set objFso = CreateObject("Scripting.FileSystemObject") If Not objFso.FileExists("C:\Program Files\SecureAge\bin\SecureAge.exe") Then WshShell.Run "\\192.168.0.145\DPoint\SecureAge.msi" End If
注意:启动脚本安装只能在Windows 7中使用,但不能在Windows XP中使用。
编辑3:组策略的屏幕截图:

任何人都可以请帮我解决这个问题。
感谢致敬
1603致命错误通常是由以下两种情况之一引起的:执行安装的帐户无法写入所需的位置,或者安装包已损坏。 既然你已经排除了#2的安装,我会认为它是#1。
当您使用基于计算机的软件安装GPO时,您所做的是将该软件安装为SYSTEM帐户。 某些软件安装程序行为exception,需要将数据写入安装用户的configuration文件。 SYSTEM帐户没有像其他用户帐户一样的传统configuration文件,这给出了所需目录不存在的错觉。 这可以解释为什么login脚本或手动安装工作 – 既不作为系统运行。
我会检查你的软件供应商,并确保这个软件可以按你尝试的方式进行部署,因为所有的迹象表明软件安装程序本身是罪魁祸首。
请尝试以下操作:
请检查您正在主持此msi的共享有以下共享和NTFS安全权限:组“域计算机”具有读取权限。

仔细检查脚本中MSI文件的path是否使用UNCpath。 EG \\dataserver1\msis\msi_installer.msi rather than e:\msis\msi_installer.msi
检查包是否与通过GPO安装兼容。 为了使它兼容,它需要能够在没有用户交互的情况下进行安装,为了testing这个日志到没有安装它的计算机上,将msi文件复制到本地的某个地方,比如C:\根目录并input“msiexec / i C:\ path_to_msi.msi / quiet”。 如果安装正确,则兼容,否则将需要重新打包