What does Windows error code 1643 (ERROR_PATCH_PACKAGE_REJECTED) mean?

 
Previous Next
ERROR_PATCH_TARGET_NOT_FOUND ERROR_INSTALL_TRANSFORM_REJECTED

ERROR_PATCH_PACKAGE_REJECTED

Software restriction policy blocks the Windows Installer patch.

ERROR_PATCH_PACKAGE_REJECTED is Win32 error 1643 (0x66B). The .msp may be structurally valid and applicable to the product, yet policy prevents Windows Installer from using it. The decision can depend on path, signature, zone, hash, publisher, application-control rules, and the context in which the patch is evaluated. Copying the patch or rerunning elevated does not necessarily change the effective policy.

Reasons policy rejects a patch

  • the file path or network location is assigned a disallowed restriction level
  • publisher or signature rules do not trust the patch signer or chain
  • the downloaded file carries origin information that changes policy evaluation
  • application control permits the base MSI but not the separate MSP or transform
  • the machine or user receives a different policy than the deployment author expected

Evidence for administrators

Record patch code, target ProductCode, file path and hash, digital-signature details, source zone, caller and install context, effective policy source, relevant AppLocker or software-restriction events, and verbose MSI log. Preserve the rejected file unchanged for hash comparison. Do not broadly disable application control merely to see whether installation succeeds.

Diagnostic path

Verify signature and chain independently, then inspect the effective policy for the actual user or service account and path. Compare a local trusted distribution location with the original source only under controlled conditions. Check whether the patch, transform, and any bootstrapper are each evaluated separately.

Confirm that the patch is intended for the installed product after policy analysis, because an applicable-policy fix should not be used to force an unrelated MSP. In managed environments, use policy-result tooling and correlate the decision with the rule identifier rather than guessing from elevation state.

Resolution

Distribute a correctly signed patch from an approved location or update the narrowly scoped organizational rule after security review. Re-download the vendor package if integrity is uncertain. Package authors should sign patches consistently, preserve timestamping and chain validity, and test through the same deployment channel used by customers.

Difference from unsupported patch format

ERROR_PATCH_PACKAGE_UNSUPPORTED concerns the installer engine’s ability to process the patch. Error 1643 is a policy rejection. Upgrading Windows Installer will not override a deliberate software-restriction decision.

Example

A signed MSI is allowed by publisher policy, but its MSP update is downloaded to a user-writable directory and lacks the expected publisher chain. Installation returns 1643. Publishing the properly signed patch through the approved software repository satisfies policy without weakening controls.

References

Looking for a different code? Search another status or error code.