The UF installation guide doesn't address GPO, but still should be helpful. See https://docs.splunk.com/Documentation/Forwarder/8.1.3/Forwarder/InstallaWindowsuniversalforwarderrem...
I tried following the instructions linked but have failed to upgrade successfully.
I am upgrading from 9.0.4 to 9.0.5 using a (startup) script with one line:
MSIEXEC.exe /i splunkforwarder.msi AGREETOLICENSE="yes" DEPLOYMENT_SERVER="servername:port" SPLUNKUSERNAME="admin" SPLUNKPASSWORD="password" /QUIET
However, nothing happens when I reboot the server and it stays at 9.0.4. Running the command in an elevated CMD it doesn't appear to do anything either. If however I remove the /QUIET it then runs through the installation (interactively) without any issues and upgrades to 9.0.5.
Please can you advise if I'm missing something to allow it to run non-interactively using the /QUIET flag?
There's a note in latest version of the Forwarder Manual that may help https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/InstallaWindowsuniversalforwarderfr....
If you have enabled Windows auto run, Splunk installation might be failed when the auto run script is failed. As a workaround, you can use cmd /D msiexec.exe /i to install Splunk.
For anyone else doing this, I have created a script which, when run as a startup script in a GPO, appears to work for us:
Computer Configuration -> Policies -> Windows Settings -> Scripts -> Startup
REM Get the folder from which it was called SET var=%~dp0 ECHO "%var%splunkforwarder.msi" REM Install the MSI MSIEXEC.exe /i "%var%splunkforwarder.msi" AGREETOLICENSE="yes" DEPLOYMENT_SERVER="server:port" SPLUNKUSERNAME="username" SPLUNKPASSWORD="password" /QN
If you run this script with the latest splunkforwarder.msi in the same directory it should install or update as appropriate.