GPO installation of software fails from UNC share using FQDN of windows domain

Question

Hi,

I spent almost all day on this one so thought I'd share!

IMPACT: GPO install of MSI software fails. Event log: “The install of application XXXX from policy YYYY failed. The error was : %%1612”

Running gpresult /h output.html showed the following:

Software Installation Failed 578 Millisecond(s) 23/12/2022 11:11:32 AM View Log
Software Installation failed due to the error listed below.

The installation source for this product is not available. Verify that the source exists and that you can access it.

Additional information may have been logged. Review the Policy Events tab in the console or the application event log for events between 23/12/2022 11:11:32 AM and 23/12/2022 11:11:32 AM.

CAUSE: Intranet site is identified as Internet site - Windows Client | Microsoft Learn

"This behavior may occur if an FQDN or IP address contains periods. If an FQDN or IP address contains a period, Internet Explorer identifies the Web site or share as in the Internet zone.

"you may be prompted or prevented from opening files on an intranet Web site or Universal Naming Convention (UNC) share in programs that use the Internet Explorer Security Manager to determine whether a file is located in a trusted security zone.

This happened to me despite UNC path being the FQDN of the windows domain!

RESOLUTION: change GPO UNC path to use \hostname not \FQDN eg. \host not \host.mydomain.local

I really hope this saves you some time if you are getting this error!

Regards,

Richard.

Answer 1

https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/intranet-site-identified-as-an-internet-site

Answer 2

test run the MSI file using \hostname.yourdomain.local\path\test.msi you will get the following warning popup:
"we can't verify who created this file. Are you sure you want to run this file? This file is in a location outside your local network. Files from locations you don't recognize can harm your PC. Only run this file if you trust the location"

If you run the same file as \hostname\path\test.msi and you dont get the error - then this is the problem!

You can also test GPO running as SYSTEM using psexec eg...
psexec -i -s cmd.exe
pushd \hostname.yourdomain.local\path
test.msi