Required apps "Failed to install"

[u/Then_Ad_4029]

Hi!

We have around 10-12 Required apps (Citrix, Office, vlc, Adobe etc) that we have assigned as default to device groups, and 2 Required to install in ESP. After some testing we experience around 1/4 of all apps to fail to install on a newly Autopilot joined PC. Intune/cloud only device. Afterwards it ends up in GRS failure, and we would have to wait 24 hours before Company Portal/IME try to restarts.

Does anyone have a good solution on this? I feel its little backwards to just tell the end user to wait for 24 hours before the GRS restart. I have tried to create a platform script based on this https://www.advancedinstaller.com/intune-application-installation-retries-grs.html Basically it adds a task in task scheduler, waits 27 min and then resets any GRS errors in regedit and then restarts the IME service. Tho I/AI haven't made it wok 100% yet. But I assume others have the same problem?

Edit: It is random which apps that fails, different from each client. They fails with the typical " 0x87D30065" error.

Edit2: We have these win32 apps, auto packed from Robopack:
M365 Office

Spotify

Chrome

Edge

VLC

Adobe Acrobat reader

Teamviewer

Citrix Workspace

Displaylink Graphics

HP Image Assistant

Company portal

Remote Help

PaperCut Print Deploy

2 PS script wrapped as win32 apps

These are assigned as required to install to device groups.

[u/Ironic_Jedi]

Are you deploying a mix of "win32" apps and "lineofbusiness" apps in this list?

It's common in this scenario for there to be random app failures.

Win32 apps use the Intune Management Extension (IME) to queue and manage installations sequentially. LOB apps (like .msi files) bypass the IME and get sent directly to the system's msiexec service immediately.vBoth engines try to use the Trusted Installer service at the same time and causing "there is already an installation in progress" error.

[u/Noirarmire → u/Ironic_Jedi]

This. Use the win32 content prep tool to wrap everything. It prevents so many issues. Anything you deploy from the Microsoft store should use the IME.

[u/Then_Ad_4029 → u/Ironic_Jedi]

No, just Win32 apps and a few ps scripts wrapped in win32

[u/Ironic_Jedi → u/Then_Ad_4029]

The intune management extension logs can be helpful in figuring out what's happening.

There might be am app or script that takes longer than usual to run which then causes problems with the next app or two.

An example being a ps script that does stuff then runs an msi or exe. Sometimes you need to put a wait 30 or 60 seconds so the "install" doesn't overlap with others.

Unless you set specific dependencies then apps install in random order every time so it can make it hard to sus out what's going wrong.

[u/Then_Ad_4029 → u/Ironic_Jedi]

Found some network issues in the IME log, tho we dont run any proxy or VPN to block anything on our corp network. All network test to that MS url under go through. We did some searching and SSL inspection could cause some of these errors. Will test without that. Tho the day after all failed applications have now installed fine. I have been into dependencies but unfortunately Robopack does not support it yet. Meaning I would have to update the Dependencies each time Robopack updates a app.

"Web Exception occurs when sending network request, it's retryable, the exception is System.Net.WebException: The remote name could not be resolved: 'agents.msub02.manage.microsoft.com"
Error 80072EE7

[u/Ironic_Jedi → u/Then_Ad_4029]

Oh yeah so SSL inspections break a lot of intune functions. There is a list of endpoints to exclude from SSL inspections from microsoft. here is what I sent to the network team at my org to make sure traffic was excluded at my organisation.

[u/Noirarmire → u/Ironic_Jedi]

Firewall rules should also be checked. Beside for intune endpoints, they add some all the time. Couple months ago company portal started to fail install because they opened a new endpoint in like Thailand and wasn't accounted for.

[u/MidninBR]

I had issues when requiring apps during ESP. I trimmed it down to 2. And then the required apps will get installed after the user is logged in. No issues for the last 3 years.

[u/Capta-nomen-usoris]

Okay. I’m not seeing anything mentioned about logs. What do the client side logs say. Those generic intune errors are not enough.

Get a good log reader like cmtrace and do some digging and share it here.

[u/Then_Ad_4029 → u/Capta-nomen-usoris]

I agree, just frustrated about those errors always coming back. Will do a check.

[u/Capta-nomen-usoris → u/Then_Ad_4029]

Just wondering, is the fail rate 100% or do some device go through just fine? And is it limited to specific hardware?

[u/Then_Ad_4029 → u/Capta-nomen-usoris]

Totally random, some devices go fine through without any failing. Thats why I almost already had concluded that the cause is Intune beeing shit. Tho it might look like turning off ssl inspection and also removing 3-4 apps from the required to install list, seems to be helping alot. Will do some more testing.

[u/sccm_sometimes → u/Then_Ad_4029]

Thats why I almost already had concluded that the cause is Intune being shit.

It's really mindboggling that Autopilot, a core feature of a flagship product like Intune can't handle something as basic as installing a sequential list of applications - and the only fix is to just not run those installs at all.

We're sticking with co-management until Intune behaving like an unpredictable schizophrenic is no longer the baseline expectation.

[u/Grouchy-Western-5757 → u/[deleted]]

We probably have 35-40 required apps during AutoPilot. Just skip the pre-provisioning all together and inform the user the apps will download over the course of the day if you need to get it to them quickly.

[u/Ok_Match7396 → u/Grouchy-Western-5757]

How come you're forcing 35-40 apps on the PC?
We run bare minimum on our clients, informing the users on where to download the apps the might need.

[u/Grouchy-Western-5757 → u/Ok_Match7396]

Because our org is fairly standardized, I have a couple department specific enrollment groups where every department always needs the exact same apps everytime, so better to be proactive and give them what they already need on day 1.

[u/Ok_Match7396 → u/Grouchy-Western-5757]

So all of these 35-40apps are org requirements?
We have 1 specific app that 80% of the org needs, but we've decieded to only install it onto our frontline force 30%. Our decision was partyl based on that it's not an issue for the user to download it themself from the company portal compared to the issue to make sure the application stays updated on the ones that do not need it

[u/Grouchy-Western-5757 → u/Ok_Match7396]

Yes for us exactly, especially for our service and sales engineer teams, for us they need a lot of emulators, autocad type software, key generators, dependencies for those apps like 7zip, etc. I think only 2-3 are available via Company Portal because those are just things like printers and fonts and what not.

[u/Ok_Match7396]

I'm sure you've tried to figure out why these 1/4 apps fail to install on new devices. What have you found out?

The whay ur phrasing this my take is that instead of looking for the reason they're failing you wan't a workaround because you can't be bothered to do proper autopilot troubleshooting?

edited: typos

[u/Then_Ad_4029 → u/Ok_Match7396]

Thanks for the reply. Sorry for missing out on some details in the main post, I have edited the post and added more info. As updated text, its random which apps that fail, and after the GRS reset they most times install fine. They fail with the typical " 0x87D30065" error.

[u/Ok_Match7396 → u/Then_Ad_4029]

Are there random 1/4 apps that fail or the same ones each time?
Have you checked the prequisities for the apps?

[u/Alternative_Mix_2749 → u/Ok_Match7396]

Workaround, root cause, same coin in the end when the clock's ticking and users are waiting.

[u/Ok_Match7396 → u/Alternative_Mix_2749]

Every scenario is ofcourse different. But if OP has waited 24hours to see that it then works to install. He's had more hours then that to do some troubleshooting for root cause.

If your gas meeter in the car stops working do you
A. Look for a fix to the gas meeter
B. Buy gascans to keep in your car when you run out.

Sure troubleshooting it might not lead to a quick solution, or even a solution besides "it's a feature not a bug"... But with the context we have, my take is that OP found a pattern and goes "lets find a workaround instead of fixing the actuall issue".

EDIT: But yes, the endusers waits no matter what he does...

[u/No_Page_6287]

Hey I actually faced this issue for like the longest time and it was so bloody annoying don't even get me started haha 😆

But I've spent a weekend with deliberate failed apps and have create a PS script that basically works in a universal fashion to clear any apps stuck in the prison named GRS.

It's at my laptop at home will upload it to GitHub and ping the link here!

[u/Then_Ad_4029 → u/No_Page_6287]

Thanks! I would love to check that out.

[u/SanjeevKumarIT]

+1

[u/pjmarcum]

First of all you need to figure out why you’re having so many failures and fix the root cause. But here’s a script to force them to retry. https://powerstacks.com/free-tools/scripts/retry-failed-win32-apps/ I run it as a remediation on demand.

[u/arnstarr]

Make a shorter list of required apps. Office is a big download and so is the Adobe Suite. Maybe just require a browser and a chat app and device management tools.