topic Re: Win MSI deploy via GPO fails in Deployment Strategy

Win MSI deploy via GPO fails

thurmanMerman — Wed, 27 Oct 2021 18:42:46 GMT

Hi,

update: I ran the exe version which extracted the msi into a temp directory. i copied the file to the local desktop and tried to run it… same error as below, it appears the msi doesn’t run on its own

just kicking the tires on the DUO product and so far so good with RD WEB/RDP and win login.
i’m trying to deploy the windows login msi via GPO and have created the required mst and launch gpo.

regardless of user logging in the install keeps failing with:

Duo Authentication for windows login x64 requires local administrative rights to install. Please run this installed from an elevated prompt.

even if i “run as” and local admin account the same error occurs.

event log ERROR:
The install of application Duo Authentication for Windows Logon x64 (2) from policy DUO Win 2FA Install failed. The error was : %%1612

the file is in a shared location for deployment and accessible on the network.

as well i copied the file to the actual local workstation, and it still fails when running with and admin account !!!
i ran the executable and it installs fine, but i’m looking to deploy to many workstations possibly…

what’s the secret ?

Thanks,
Thurman

Re: Win MSI deploy via GPO fails

DuoKristina — Wed, 27 Oct 2021 20:51:35 GMT

Hi @thurmanMerman ,

Were you trying to create the GPO by using an msi extracted from the exe installer, or did you use the MSI contained in the downloadable Duo for Windows Logon MSI, Policy, and documentation zip file as instructed here?

If you did not use the MSIs from the zip file, please try again, this time using the MSIs from that zip file.

Re: Win MSI deploy via GPO fails

thurmanMerman — Thu, 28 Oct 2021 19:30:04 GMT

Hi,

thanks for the reply. yes I followed those exact instructions using the supplied MSI file.

I rechecked permissions on the shared folder and domain users/auth users have access to it as well.

Re: Win MSI deploy via GPO fails

DuoKristina — Thu, 28 Oct 2021 21:01:10 GMT

OK, just double-checking as using the wrong MSI by mistake is an extremely common reason customers contact support.

I believe MSI error 1612 means the installation source was not available. Is your software share readable by Domain Computers?

Re: Win MSI deploy via GPO fails

thurmanMerman — Mon, 08 Nov 2021 17:50:06 GMT

Ok, so it’s working now…

not sure what changed, but my gpo duo installer script is working perfectly now.

i think when I was playing around with I, i may have un-installed it incorrectly the first time… i went into the registry and removed the DUO installer key, which is what I missed the first time around…

I tried on another workstation and the agent installed without any intervention…

thanks for the help!
Thurman