Package order in software group policies

November 25th, 2010

We’ve had an interesting, but obscure, problem recently.

We have a group policy that installs Adobe Reader and various extras, principally fonts, that go with it. It turns out that newly built computers to which this policy applies don’t install the fonts any more.

This seems to be a combination of circumstances. When we update Adobe reader, we patch and redeploy. This changes the order in which the different packages are installed. The package edited most recently is installed last. So, that’s the recently patched Adobe Reader itself. Now, most of the extras won’t install if Adobe Reader isn’t present, but that package appears to have installed, even though it installed nothing. So attempting to install a font package succeeds, but installs no fonts. Group policy is satisfied that it has installed the font package, so it doesn’t attempt to do this again. The last package to be installed is Adobe Reader itself, and this installs. If the font packages had failed, then group policy would attempt to install them at the next reboot, by this time Adobe Reader would be installed, and the font package would succeed.

All we have to do now is to wait untilĀ  a user with a newly built computer tries to read a pdf that requires a missing font.

We can fix this by finding a method to alter the order in which packages are installed. One crude, but inelegant, method is to redeploy each of the fonts whenever we update the main reader package. This means that at the next reboot every PC updates Adobe Reader, which it needs to do, and also reinstalls all the fonts packages which is unnecessary.

I’ve said we need to alter the order in which packages are installed, but although we can tell that they are in the wrong order because our policy no longer works, how can we tell what order they are in? GPMC and the editor sort packages into alphabetical order. They also only show packages that are being installed; if you mark a package to be uninstalled it dissapears, but it must still be in the policy otherwise the client wouldn’t know to uninstall it.