How to deploy the Universal Forwarder 6.2.2 to a few hundred Windows 2008 R2 servers via Group Policy?

[rsickler]

I've been tasked with installing the Splunk Universal Forwarder (splunkforwarder-6.2.2-255606-x64-release.msi) to a few hundred Server 2008-R2 machines. Normally, I'd just do this via a GPO (Computer Configuration > Policies > Software Settings > Software Installation > SplunkForwarder) but this one is different. I've spent two days scouring the web, looking for ways to deploy it, but I've come away with nothing but failures!

Sure, I could create a text file full of server names and then have some crazy script that does a for-loop and loops through all of them but, that doesn't scale well... It'll work for now, but what about months or years from now when more or new servers come online? Will anyone remember to adjust the script and run it? I don't particularly like MS' way of using GP to install software via the Software Installation section, but it beats following a more manual process.

Does anyone here know of a currently working deployment method? I even tried my old standby which is to deploy a one-time Scheduled Task to run something like: msiexec.exe /i "splunkforwarder-6.2.2-255606-x64-release.msi" AGREETOLICENSE=Yes /quiet. However, evidently, MS has deployed a patch to keep people from deploying scheduled tasks via GP that contain a domain user and password.

I've tried a startup PowerShell script, but that failed.... I'm currently trying to debug a startup CMD script. I'm running out of time and ideas so any help would be great.

[rsickler · Accepted solution]

Well, you need a bit more than just your deployment tips; it's a combination of yours and mine.

What was needed:

• The MST file, tweaked to accept the EULA.
• In the GPO, under advanced deployment options, ignore the language when deploying.
• In the GPO, under advanced deployment options, include OLE class & product info.

So, thanks for the hot tip on the software deployment tweaks for the GPO. I already had the MST and your tips took me the rest of the way.

[bravon]

Indeed - no problem.

[Gstines]

Hi Bravon,

I know this is an older post... But I'm attempting to do this now. I've made the GPO advanced deployment options that are suggested and also created the MST file with the options we would like configured for the install. Still the policy is not installing on the client I am testing this on. Did you run into any other issues? Or any idea what the issue could be? I confirmed the options I used were correct by opening the install manually with the suggested property values I added. They values had the correct checkboxes and data filled in already. I'm not sure where the hang up is.

[bravon]

Should have answered as an answer and not a comment 😛

We deploy 6.1.4, with the following
"Advanced Deployment Options
Settings", it may be of help: Ignore
language when deploying this package;
Enabled Make this 32-bit X86
application available to Win64
computers; Enabled Include OLE class
and product information; Enabled

[rsickler]

At least with v6.2, you also need an MST file because you need to accept the EULA and you can't make any changes to the command that is used for the install when you install it via GP. Not sure if you ran into that or not...

I used Orca and looked at the Property table where I found the AGREETOLICENSE property and changed it from No to Yes. I manually tested that via the following command and it worked fine but it still failed when I tried to deploy via GP:

splunkforwarder-6.2.2-255606-x64-release.msi TRANSFORMS=splunkforwarder-6.2.2-255606-x64-release.mst /quiet

More info here:
http://blogs.splunk.com/2013/11/12/installing-the-splunk-6-0-universal-forwarder-on-windows/

As for your note about advanced settings, I could not find the option for making the 32-bit package available for 64-bit machines but it saw my package as a 64-bit package and we don't do 32-bit. I found and applied the other options and the combination of my MST and your tweaks seemed to have done the trick, so I'll move on and test a few more deployments.

[bravon]

We use an .mst with Property ->
AGREETOLICENCE=YES
DEPLOYMENT_SERVER = deployserver:8089

Where do you store the .msi and .mst file? It may be unaccessable during logon/permissions etc but work OK when you run it manually as an admin perhaps?

[rsickler]

I always store our MSTs with the MSI...

It looks to be working correctly. I've tested a few other servers and it deploys just fine on a reboot now. Like I said, I had the MST file but I must have been missing those advanced settings you mentioned.

[bravon]

We deploy 6.1.4, with the following
"Advanced Deployment Options Settings", it may be of help:
Ignore language when deploying this package; Enabled
Make this 32-bit X86 application available to Win64 computers; Enabled
Include OLE class and product information; Enabled