Getting Data In
Highlighted

Universal forwarder Windows installation (x86 and x64) fails when being pushed by GPO; missing next button?

New Member

Testing this out on two separate machines in our environment as we need to get Splunk up and running on all server by this Friday. The installations process just fine when done manually, and uninstall as well without any errors, but when we try to push them via GPO (auto-install or assign via Computer Policy; publish, assign, or auto-install via User Policy), the application either fails to show up completely, or shows up in the Network Applications but fails to install due to the Next button just... not being there (screenshot attached).

I've gone through nearly every single option on the AD side, including recreating the policies wholesale, as well as re-downloading the .MSI files, and checked that this occurs on multiple servers within differing layers of GPO application, including some with nearly zero other policies being applied at all.

Would it be worth a shot at modifying/transforming the MSI or writing a script to have a GPO run the installers silently? Or does this potentially point to a larger issue in my environment between GP and these specific packages? We also have PDQ available to deploy these if necessary, but I wasn't able to find an EXE-version of the installer; just ZIP files.

Windows Server 2008 R2 DCs, 2008 non-R2 and Windows 7 SP1 member servers that we're trying to install the forwarders on. Splunk Enterprise, installed and working, but potentially not fully configured. Thanks in advance!

alt text

0 Karma

Re: Universal forwarder Windows installation (x86 and x64) fails when being pushed by GPO; missing next button?

Explorer

add AGREETOLICENSE=yes /quiet to the end of the command string.
More information about this located here http://docs.splunk.com/Documentation/Forwarder/7.2.0/Forwarder/InstallaWindowsuniversalforwarderfrom...

0 Karma
Highlighted

Re: Universal forwarder Windows installation (x86 and x64) fails when being pushed by GPO; missing next button?

SplunkTrust
SplunkTrust

Hi there,

What command are you using for the insall ?

Should be something like this :

msiexec.exe /i splunkuniversalforwarderx86.msi LOGONUSERNAME="yourUser" LOGON_PASSWORD="yourPassword" AGREETOLICENSE=Yes /quiet

Hope that helps.

Cheers,
David

0 Karma