Installation

Forwarder install failing using MST through group policy

Gstines
Engager

Hello all,

I'm running into an issue with installing the universal forwarder on my clients through group policy. I've attempted multiple ways with no success. Now, I've decided to use Orca to create a MST with our desired property values and push this through software installation in group policy.

I've read about the 2 advanced options, "Ignore the language when deploying and include OLE class & product info" and have made sure to have those checked under the advanced deployment options for the MSI. I run a gpupdate on the client and it says there is an install from group policy that requires a restart to install. I type y or yes and allow the restart, but when I log back in... NOTHING.

Something is hanging up and I'm not sure what? Any help would be greatly appreciated.

Labels (1)
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...