I'm trying to configure an app that I can associate force run with a
workstation group object that will wait until late at night to run. The
app should be configured to run ONLY IF no one is logged on - I
understand this is possible with MSI installations, and we've had
success doing this before. I create a workstation group and add all the
computers that should get this push into the group. Then I associate the
group with the MSI object with the following settings:

Force Run
Distribution Availability is set to ONLY midnight to 5a
"Distribute in workstation security space if object is workstation
associated" is checked
"Run as secure system user" is checked
File rights have been given to the folder that this is supposed to come from
I've got a 10-minute spread set so 500 computers don't all hit the
server simultaneously

Here's the behavior I'm seeing: the app immediately pushes out to
everyone on the list as soon as I click "ok" and tries to run
immediately. The overwhelming majority of them return MSI errors (1603
with a handful of 1613 thrown in). In an effort to troubleshoot, I
created a simple all that would push MSI logging to those computers
first. The logs show 100% success for that app (despite that it
shouldn't be running at that point) but none of the computers who check
in after having that registry hack run have any MSI logs in the temp
directory of the currently-logged-in user. In about half of the cases
the app will try to push every few minutes and return another 1603.

1603 errors are a pain to troubleshoot, more so if there are no logs to
look at. So here's the question: how do I configure an app to run if no
one's logged in, and how do I make it run only during the timeframe that
I want? I can't get the availability schedule to work for me at all.
This is incredibly frustrating. Any help would be greatly appreciated!