Deploy Wapt via GPO

[mika]

Hello,

after testing by manually installing WaptAgent on the workstations, I now want to move to wider deployment.
I was thinking of using the Group Policy Objects (GPOs) on my Windows Server 2008 and going through User Configuration >> Policies >> Software Settings >> Software Installation. However, I can't select an .exe file using this method (I thought I remembered that it was possible - my mistake).

Reading about "wapt tray" and "wapt deploy" here and there, I confess I'm a bit confused when I search for these keywords. What would you advise me to do?

[sfonteneau]

Hello,

you shouldn't create a user GPO, as your users don't normally have shutdown rights.

I can't give you a more complete procedure than the one described in the documentation...

https://www.wapt.fr/fr/doc/Installation ... waptdeploy

Simon

[mika]

Thank you

, however, the page is no longer up to date; indeed, the link provided for the checksum is no longer valid (I am using version 1.3.12.12).

[sfonteneau]

Yes, the documentation is currently being updated.

But the exact arguments are given on the Wapt server web interface.

[mika]

I'm contacting you again because my GPO is still not working, and I'd like to make sure the WAPT part is correct.
I followed the instructions, placing waptdeploy.exe in the right location. I added the hash/checksum by copying and pasting, so there shouldn't be any errors there.
I'm using a startup script, and the OU linked to my GPO only contains the computers on which I want to deploy the software.
My security filtering is set to Authenticated Users.
I've tried stopping and restarting the machines, rebooting them, and running gpupdate /force, but nothing seems to work.
Just to clarify, the machines I want to target are all running Windows 10.

If anyone has any ideas, I'd appreciate it. Either I'm missing something, or it's my Active Directory and the GPO that are malfunctioning (although other GPOs are working).

[sfonteneau]

Have you done a:

Code: Select all

 GPRESULT /H c:\waptdeploy.html 

To verify that the GPO applies?

[mika]

The GPO is working correctly; I added a system sleep setting, and it worked.
I tried to launch wapt deploy via the command prompt.
The error he's showing me is the following:

WAPT version:
WAPT required version: 1.3.12.10
trying http://wapt.mairie.mdm/wapt/Packages
Wapt agent local path: C:\Users\stagiairesi3\deploy\\waptagent.exe
Cleanup...
An unhandled exception occurred at $0043BD02:
EHTTPException: Unable to download: http://127.0.0.1:8088/update.json?notif ... ify_user=0 HTTP Status: 0
$0043BD02
$00401EB5
$00404966

I checked the firewall, and the ports are open.

[mika]

I'm taking inspiration from this thread: viewtopic.php?f=13&t=644&start=10
which I hadn't seen before

, and I'm trying again.

[sfonteneau]

I managed to reproduce exactly the same mistake as you:

Code: Select all

WAPT version: 
WAPT required version: 1.3.12.13
trying https://wapt.tranquilit.local/wapt/Packages
Wapt agent local path: C:\waptagent.exe
Cleanup...
An unhandled exception occurred at $0043BD02:
EHTTPException: Unable to download: http://127.0.0.1:8088/update.json?notif ... ify_user=0 HTTP Status: 0
$0043BD02
$00401EB5
$00404966

When you run your tests, waptdeploy fails to perform a rights elevation.

Did you launch your command prompt with administrator privileges?

cmd --> right-click --> run as administrator. You can now try again.


This problem does not occur with the GPO because the GPO is executed under the system account.

Indeed, for your problem, refer to the forum link you found.

[mika]

Edit: I tried both solutions, same result. I think adding `waptsetupurl` is a safety measure; at least we're sure the script will go where we want it to.


It worked—everything's working!
As mentioned in another thread, I added the following parameters:
`--hash= --waptsetupurl="http://ip_of_my_wapt_server/wapt/waptagent.exe"

then I had to enable the following setting (on the same GPO):
Computer Configuration > Policies > Administrative Templates > System > Logon > Always wait for network connection when starting the computer and logging on

- this doesn't delay startup too much for those who might be wondering. -


And now everything works as expected.