When the Configuration Manager client (the SCCM client to many admins) won't install, the evidence is usually a number: a ccmsetup exit code, a Windows Installer return value, or an HRESULT in ccm.log or ccmsetup.log. This quick reference lists the codes you'll meet most often during client installation, what each one means according to Microsoft's documentation, the usual cause in a Configuration Manager environment and the first thing to check.
Codes in this quick reference
ccmsetup exit code 0: Successccmsetup.exe exit code (ccmsetup.log)ccmsetup exit code 6: Errorccmsetup.exe exit code (ccmsetup.log)ccmsetup exit code 7: Reboot requiredccmsetup.exe exit code (ccmsetup.log)ccmsetup exit code 8: Setup already runningccmsetup.exe exit code (ccmsetup.log)ccmsetup exit code 9: Prerequisite evaluation failureccmsetup.exe exit code (ccmsetup.log)ccmsetup exit code 10: Setup manifest hash validation failureccmsetup.exe exit code (ccmsetup.log)1601 ERROR_INSTALL_SERVICE_FAILURE: Windows Installer service couldn't be accessedclient.msi.log / ccmsetup.log1603 ERROR_INSTALL_FAILURE: fatal error during installationclient.msi.log / ccmsetup.log
+ 45 more codes in the tables below.
How to read these codes#
Client installation codes show up in three places:
ccm.login the site server'sLogsfolder records client push: connecting to the device, copying ccmsetup and starting it. A failed push request is retried every hour for up to seven days.%WinDir%\ccmsetup\Logs\ccmsetup.logon the device records the download, the prerequisites and the final exit code.client.msi.login the same folder is Windows Installer's own log of the client.msi installation.
Most failures are logged as HRESULTs. 0x8007 followed by four hex digits wraps a Windows error code: convert the last four digits to decimal and look it up. WinHTTP errors are wrapped the same way, and 0x80041xxx codes come from WMI. In PowerShell:
PowerShell
PS> 0x6BA
1722
PS> net helpmsg 1722
The RPC server is unavailable.Remember that some codes mean success: 0, 1641 and 3010. The last two just tell you a restart is pending.
Tip: If an existing client never upgrades and ccmsetup.log shows Client is stamped with /alwaysexcludeupgrade. Stop proceeding., nothing is broken: the client was installed with /AlwaysExcludeUpgrade:TRUE and is excluded from automatic client upgrade on purpose.
ccmsetup.exe return codes#
These are the only exit codes ccmsetup.exe itself documents. The last line of ccmsetup.log shows which one the run ended with.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0 | Success | The client installed | Confirm site assignment and registration in ClientLocation.log and ClientIDManagerStartup.log |
6 | Error | Any failure in download, prerequisites or client.msi | Search ccmsetup.log upwards from the exit line for the first error |
7 | Reboot required | A prerequisite needs a restart | Restart: without /forcereboot, ccmsetup exits and continues after the next manual restart |
8 | Setup already running | Two install methods overlapped (push, Group Policy, script) | Let the running ccmsetup finish before starting another |
9 | Prerequisite evaluation failure | Unsupported OS or a failed prerequisite check | Read the prerequisite lines in ccmsetup.log |
10 | Setup manifest hash validation failure | Downloaded files don't match the site's manifest | Retry from a known-good source, such as the site's Client share with /source: |
Windows Installer codes from client.msi#
ccmsetup.exe runs client.msi, so Windows Installer return values show up in client.msi.log. In that log, the action just above the first Return value 3 is the one that failed.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
1601 | ERROR_INSTALL_SERVICE_FAILURE: the Windows Installer service couldn't be accessed | Windows Installer service disabled or damaged | Check the Windows Installer (msiserver) service |
1603 | ERROR_INSTALL_FAILURE: a fatal error occurred during installation | A custom action failed: WMI problems, remains of an old client, a pending restart | Find Return value 3 in client.msi.log and read the lines above it |
1612 | ERROR_INSTALL_SOURCE_ABSENT: the installation source isn't available | Windows Installer needs the source of an existing client that's gone | Provide a reachable source with /source:, or remove the old client and reinstall |
1618 | ERROR_INSTALL_ALREADY_RUNNING: another installation is in progress | Windows Update, another MSI or a stuck msiexec | Wait for the other install or restart, then retry |
1619 | ERROR_INSTALL_PACKAGE_OPEN_FAILED: the package couldn't be opened | client.msi missing, incomplete or unreadable | Check the files ccmsetup downloaded to C:\Windows\ccmsetup and retry |
1625 | ERROR_INSTALL_PACKAGE_REJECTED: forbidden by system policy | Windows Installer or application control policy blocks the install | Review Group Policy restrictions for Windows Installer and your app control rules |
1632 | ERROR_INSTALL_TEMP_UNWRITABLE: the Temp folder is full or inaccessible | Low disk space or broken permissions on the Temp folder | Free space on the system drive and check the Temp folder |
1633 | ERROR_INSTALL_PLATFORM_UNSUPPORTED: package not supported on this platform | Unsupported OS or architecture | Compare the device with the supported client OS list for your site version |
1638 | ERROR_PRODUCT_VERSION: another version is already installed | An old or damaged client is still registered | Run ccmsetup.exe /uninstall and reinstall, or reinstall with /forceinstall |
1639 | ERROR_INVALID_COMMAND_LINE: invalid command-line argument | Malformed client.msi property or quoting | Put ccmsetup parameters (/name) before client.msi properties (NAME=value) |
1641 | ERROR_SUCCESS_REBOOT_INITIATED: the installer started a restart (success) | A restart was needed to finish | Let the restart complete, then check the client |
3010 | ERROR_SUCCESS_REBOOT_REQUIRED: success, restart required | Files or prerequisites are pending a restart | Restart the device to complete the install |
The same results as HRESULTs in ccmsetup.log#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x80070643 | 1603 as an HRESULT: fatal error during installation | client.msi failed | Open client.msi.log |
0x80070652 | 1618 as an HRESULT: another installation is in progress | Another MSI was running | Retry after the other install or a restart |
0x80070BC2 | 3010 as an HRESULT: success, restart required | A restart is pending | Restart the device |
0x80070BC9 | 3017 ERROR_FAIL_REBOOT_REQUIRED: the operation failed and a restart is needed to roll back | A failed install left changes to roll back | Restart first, then retry the install |
Client push and connection codes (ccm.log)#
Client push connects from the site server to the device's admin$ share and WMI. ccm.log may show these as decimal Windows errors or as HRESULTs; both forms are listed.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x80070005 (5) | ERROR_ACCESS_DENIED: access is denied | Push account isn't a local administrator on the device | Add the push account to local Administrators by Group Policy |
0x80070035 (53) | ERROR_BAD_NETPATH: the network path was not found | Device offline, stale DNS record or File and Printer Sharing blocked | Resolve-DnsName, then Test-NetConnection to port 445 |
0x80070043 (67) | ERROR_BAD_NET_NAME: the network name cannot be found | The admin$ share isn't available on the device | Check that the administrative shares exist on the device |
0x80070040 (64) | ERROR_NETNAME_DELETED: the network name is no longer available | The connection dropped during the copy (VPN, Wi-Fi, sleep) | Retry when the device has a stable connection |
0x80070056 (86) | ERROR_INVALID_PASSWORD: the network password isn't correct | Push account password changed but not in the site | Update the account in Client Push Installation Properties › Accounts |
0x80070775 (1909) | ERROR_ACCOUNT_LOCKED_OUT: the account is locked out | Push account locked, often by a stale password elsewhere | Unlock it and find where the old password is still used |
0x80070791 (1937) | ERROR_NTLM_BLOCKED: NTLM authentication has been disabled | Kerberos failed and NTLM is blocked on the device or in the domain | Fix Kerberos (FQDN, DNS, trusted forest); push needs it when NTLM fallback is off, the default on new sites since version 2207 |
0x800706BA (1722) | RPC_S_SERVER_UNAVAILABLE: the RPC server is unavailable | WMI/RPC blocked by the device firewall, or the device is off | Allow the WMI inbound firewall rules (RPC on TCP 135 plus dynamic ports) |
0x800706D9 (1753) | EPT_S_NOT_REGISTERED: no more endpoints available from the endpoint mapper | The endpoint mapper answered, but no endpoint is registered for the requested service | Check that the WMI service (Winmgmt) runs on the device, then the firewall rules |
0x800706FD (1789) | ERROR_TRUSTED_RELATIONSHIP_FAILURE: workstation trust with the domain failed | The device's computer account secure channel is broken | Run Test-ComputerSecureChannel on the device; repair or rejoin |
Download and management point connection codes (WinHTTP)#
ccmsetup downloads its files over HTTP or HTTPS from a distribution point or the management point (MP). WinHTTP errors sit in the low 16 bits of the HRESULT, so 0x80072EE7 is WinHTTP error 12007. ccmsetup keeps retrying a failed download until /downloadtimeout expires (1,440 minutes by default).
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x80072EE2 (12002) | ERROR_WINHTTP_TIMEOUT: the request timed out | MP or DP slow, overloaded or filtered | Test-NetConnection to the MP on port 80 or 443 |
0x80072EE7 (12007) | ERROR_WINHTTP_NAME_NOT_RESOLVED: the server name can't be resolved | DNS can't resolve the MP or DP name | Resolve-DnsName for the FQDN shown in the log |
0x80072EFD (12029) | ERROR_WINHTTP_CANNOT_CONNECT: connection to the server failed | Port blocked, IIS down or the wrong port | Test-NetConnection to the port, then check MP health |
0x80072EFE (12030) | ERROR_WINHTTP_CONNECTION_ERROR: connection reset or terminated, or an incompatible SSL protocol | Proxy, inspection device or TLS mismatch | Bypass the proxy for site systems and compare TLS settings |
0x80072F05 (12037) | ERROR_WINHTTP_SECURE_CERT_DATE_INVALID: certificate outside its validity period | Expired site system certificate, or a wrong clock on the device | Check certificate dates and the device's time |
0x80072F06 (12038) | ERROR_WINHTTP_SECURE_CERT_CN_INVALID: certificate name doesn't match | The name in /mp: isn't in the MP certificate's subject or SAN | Use the FQDN that appears in the certificate |
0x80072F0C (12044) | ERROR_WINHTTP_CLIENT_AUTH_CERT_NEEDED: the server requests client authentication | HTTPS-only MP and no valid client authentication certificate | Check the computer certificate; use /UsePKICert with an HTTPS MP |
0x80072F0D (12045) | ERROR_WINHTTP_SECURE_INVALID_CA: chain ends in an untrusted root | Root or intermediate CA missing on the device | Deploy the CA certificates to the device's trusted stores |
0x80072F19 (12057) | ERROR_WINHTTP_SECURE_CERT_REV_FAILED: revocation server offline | The CRL distribution point is unreachable from the device | Fix CRL access; use /NoCRLCheck only as a deliberate exception |
0x80072F8F (12175) | ERROR_WINHTTP_SECURE_FAILURE: errors in the server's SSL certificate | Problem with the MP or DP certificate | Inspect the certificate bound to the site system's HTTPS site in IIS |
WMI codes#
The client lives in WMI, so a damaged repository breaks installs and repairs. Don't delete or reset the WMI repository as a first step: Microsoft warns it can damage the system and installed applications.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x80041001 | WBEM_E_FAILED: call failed | Generic WMI failure, often a damaged repository | winmgmt /verifyrepository |
0x80041003 | WBEM_E_ACCESS_DENIED: no permission for the action | The account lacks WMI or DCOM permissions | Check WMI namespace security; ccmsetup normally runs as Local System |
0x8004100E | WBEM_E_INVALID_NAMESPACE: namespace can't be found | Normal on a first install, before the client's root\ccm namespace exists | Ignore on a first install; on an installed client, repair or reinstall |
0x80041010 | WBEM_E_INVALID_CLASS: class isn't valid | A client class is missing after a partial install or removal | Check WMI health, then reinstall the client |
0x80041013 | WBEM_E_PROVIDER_LOAD_FAILURE: COM can't locate a provider | A WMI provider's registration or DLL is broken | Check WMI health before reinstalling the client |
0x8004103B | WBEM_E_OUT_OF_DISK_SPACE: disk full or 4 GB repository limit reached | Low disk space or an oversized repository | Free disk space and check the repository size |
File, disk and cloud codes#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x80070002 (2) | ERROR_FILE_NOT_FOUND: the file can't be found | A source file or path from the command line doesn't exist | Check /source: paths and the site's Client folder |
0x80070003 (3) | ERROR_PATH_NOT_FOUND: the path can't be found | A folder in the command line or a property value doesn't exist | Check paths such as /source:, CCMINSTALLDIR and SMSCACHEDIR |
0x80070020 (32) | ERROR_SHARING_VIOLATION: file in use by another process | Another process, often a scanner, holds a setup file | Retry, and find which process holds the file |
0x80070070 (112) | ERROR_DISK_FULL: not enough space on the disk | No room for ccmsetup files, the client or its cache | Free space on the system drive |
0x87D0027E | Configuration Manager error that Microsoft calls out for token-based installs through a cloud management gateway (CMG) | /mp combined with /regtoken | Remove /mp from the command line, as Microsoft suggests |
How to verify a fix#
- Rerun the installation and read the end of
ccmsetup.log: a clean run ends withCcmSetup is exiting with return code 0. - Check that the client service runs and the device knows its site and MP:
PowerShell
Get-Service CcmExec Get-CimInstance -Namespace root\ccm -ClassName SMS_Authority | Select-Object Name, CurrentManagingPoint - In the console, the device shows Client: Yes, and soon after it reports as active.
- If the client installed but never gets deployments, move on to Configuration Manager client not receiving policy; for the full install walkthrough, see reading ccmsetup.log and fixing common causes.
References#
- About client installation parameters and properties in Configuration Manager (ccmsetup return codes)
- How to deploy clients to Windows computers in Configuration Manager
- MsiExec.exe and InstMsi.exe error messages
- System Error Codes (0-499)
- System Error Codes (1700-3999)
- Error Messages (Winhttp.h)
- WMI Error Constants
