Systems Management

Does the acronym "UAC" ring any bells?

That was out first thought. We have the following settings on a GPO with is linked to an Application Deploy OU. Application adverstisement is for a collection that wmi queries the contents of the OU.

Our idea was:

Move computer to OU and reboot to diable UAC

Adverstisement starts

Move computer back to prod OU


UAC GPO settings are as follows:

User Account Control: Admin Approval Mode for the Built-in Administrator account Disabled
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode Elevate without prompting
User Account Control: Detect application installations and prompt for elevation Disabled
User Account Control: Only elevate executables that are signed and validated Disabled
User Account Control: Only elevate UIAccess applications that are installed in secure locations Disabled
User Account Control: Run all administrators in Admin Approval Mode Disabled

I don't get it with UAC. If the environment is properly locked down, why bother with UAC at all?

the Folks at MyITForum are saying that application installations will run as SYSTEM and UAC will not be an issue.

Aside from the UAC debate, any other thoughts?

You probably have to analyze a client´s logs to get the answer. It could be boundries, or something else in your setup thats causing the problem,

I would look at the Reporting section --> All Advertisements. Drill down to the advertisement you are looking for and keep drilling down until you get to the status and response from the machine. That should give you some indication as to why it wasnt run or why it failed.