The original version of this article was a single-line link to an external resource that no longer exists. This updated version replaces it with a self-contained reference — covering the most common SCCM/ConfigMgr error codes you will encounter in day-to-day OSD, application deployment, client installation, software update, and compliance troubleshooting, along with a PowerShell tool to decode any error code on the fly.

Detail
Last UpdatedMarch 2026
Applies ToSCCM/ConfigMgr Current Branch, Microsoft Intune (co-management)
Log ViewerCMTrace (included with ConfigMgr client)
DifficultyIntermediate

Decode Any Error Code On the Fly

Before diving into the tables, the single most useful tool for ConfigMgr troubleshooting is the error message lookup utility built into Windows. It decodes any Win32, HRESULT, or 0x8xxx code into a human-readable description:

# Decode any error code to a human-readable description
function Get-ErrorDescription {
    param ([string]$ErrorCode)

    # Handle both hex (0x80070005) and decimal formats
    if ($ErrorCode -match "^0x") {
        $decimal = [Convert]::ToInt64($ErrorCode, 16)
    } else {
        $decimal = [long]$ErrorCode
    }

    $win32 = [System.ComponentModel.Win32Exception]::new([int]$decimal)
    [PSCustomObject]@{
        HexCode     = "0x{0:X8}" -f $decimal
        Decimal     = $decimal
        Description = $win32.Message
    }
}

# Examples
Get-ErrorDescription "0x80070005"
Get-ErrorDescription "0x87D00669"
Get-ErrorDescription "-2016411052"

You can also use the built-in certutil tool for a quick command-line lookup without PowerShell:

# Decode error code via certutil (works in cmd.exe and PowerShell)
certutil -error 0x80070005
certutil -error 0x87D00669

Key Log Files Reference

Before looking up error codes, knowing which log to open saves significant time. These are the most important ConfigMgr log files for each scenario:

ScenarioLog FileLocation
Client installationccmsetup.logC:\Windows\ccmsetup\
Application deploymentAppEnforce.log, AppDiscovery.logC:\Windows\CCM\Logs\
Software updatesWUAHandler.log, UpdatesHandler.logC:\Windows\CCM\Logs\
OS Deployment (WinPE)smsts.logX:\Windows\Temp\SMSTSLog\ (WinPE)
OS Deployment (full OS)smsts.logC:\Windows\CCM\Logs\ or C:\_SMSTaskSequence\
Content downloadCAS.log, ContentTransferManager.logC:\Windows\CCM\Logs\
Policy retrievalPolicyAgent.log, PolicyEvaluator.logC:\Windows\CCM\Logs\
InventoryInventoryAgent.logC:\Windows\CCM\Logs\
Distribution pointdistmgr.log, smsdpprov.log%SMS_LOGS% on site server
Client push installationccm.log%SMS_LOGS% on site server

Application Deployment Error Codes

These are the most common codes seen in AppEnforce.log and the ConfigMgr console deployment status view:

Error CodeDescriptionCommon Fix
0x00000000 (0)Success—
0x00000641 (1601)Windows Installer service not accessibleStart/restart MSIServer service; check if another install is running
0x00000642 (1602)User cancelled the installationEnsure deployment is set to hidden / suppress user prompts
0x00000643 (1603)Fatal error during installationCheck application log in AppEnforce.log and the vendor’s MSI log; usually a pre-req or permissions issue
0x00000652 (1618)Another installation is already in progressWait and retry; or kill conflicting msiexec.exe process
0x00000654 (1620)MSI package could not be openedCheck package source path; ensure distribution point has the content
0x00000659 (1625)Installation forbidden by policyCheck Windows Installer policy; may be blocked by AppLocker or GPO
0x00000BC2 (3010)Success — reboot requiredNormal — configure deployment to allow or enforce reboot
0x80004005Unspecified error / access deniedCheck permissions on source content; check if running as correct account
0x80070005Access deniedRun as SYSTEM; check NTFS permissions on install folder and registry keys
0x80070002File not foundContent not on DP; check ContentTransferManager.log and CAS.log
0x80070070Not enough disk spaceFree space on target drive; check OSDDiskIndex variable if in OSD
0x87D00607Application not detected after installDetection method mismatch — verify ProductCode, registry key, or file path used in detection rule
0x87D00669Application in failed stateClear client cache; run repair; check AppEnforce.log for root cause
0x87D01106Content not found on DPRedistribute content to DP; check distmgr.log on site server

Software Update Error Codes

Error CodeDescriptionCommon Fix
0x80070BC9 (WU_E_UNKNOWN_ID)Update not foundScan cycle not run; trigger machine policy and update scan
0x80070BC2 (3010)Reboot required to complete updateNormal — schedule reboot in maintenance window
0x80240022Windows Update service not runningStart wuauserv; check WUAHandler.log
0x80240017Update not applicableOS version or architecture mismatch; check update supersedence
0x8024000EDuplicate update foundClean Windows Update cache; run dism /Cleanup-Image /SPSuperseded
0x80244010Too many update requestsWSUS overloaded; check WSUS performance and IIS app pool
0x87D00692Failed to add update sourceWSUS connection issue — check WUAHandler.log; verify WSUS server is reachable
0x87D00708Software update scan not run yetTrigger software updates scan action from client actions
0x87D00213CI version not foundClient policy not yet received; run machine policy retrieval and evaluation

Client Installation Error Codes (ccmsetup)

Error CodeDescriptionCommon Fix
0 / 0x0Success—
7 / 0x7Reboot required before installReboot the device and retry client push
53 / 0x35Network path not found (Admin$ not accessible)Enable File & Printer Sharing; verify DNS; test \\hostname\Admin$ access manually
0x80070005Access denied during client pushCheck client push account has local admin rights on the target
0x80070006Invalid handleWMI corruption — run: winmgmt /salvagerepository on target
0x800700B7Cannot create existing fileOld ccmsetup files stuck on disk — delete C:\Windows\ccmsetup\ and retry
0x80041002WMI not found / object not foundWMI corruption — repair WMI; check WMI health on target device
0x87D00454Client not assigned to any siteCheck site boundary configuration; verify device falls within a site boundary
0x87D0027EClient communication failureCheck firewall rules for ports 80, 443, 8530 between client and management point

OSD Task Sequence Error Codes

Error CodeDescriptionCommon Fix
0x80070002File not found — content missingCheck content on DP; verify package is distributed; check smsts.log for exact path
0x80070070Insufficient disk spaceDisk too small or partition issue — check disk configuration step
0x80004005Unspecified error — often driver issueCheck NIC/storage driver in boot.wim; check smsts.log around the failing step
0x00000001Incorrect function — often a script exit codeCustom script in TS exited with code 1 — check the script logic
0x80070032The request is not supportedOften a BIOS/UEFI mismatch — check SecureBoot and TPM settings
0x80070490Element not foundDriver package missing or WMI query failed in Apply Driver Package step
0x80091007The hash value is not correctContent corruption on DP — redistribute the package; check CAS.log
0x87D01201Task sequence failedGeneric TS failure — always open smsts.log and look for the actual inner error
0x8007232BDNS name does not existWinPE cannot resolve site server DNS — check DNS configuration in WinPE, check NIC driver

0x87D Codes — ConfigMgr-Specific

Error codes in the 0x87D range are ConfigMgr-specific and not Win32 codes. They are defined in the ConfigMgr SDK. Here are the most frequently encountered:

Error CodeDescription
0x87D00213CI version info not found in WMI — policy not yet received
0x87D00215CI not found — deployment assignment not on client
0x87D00440No user is logged on
0x87D00454Not found — site boundary issue or MP not reachable
0x87D00607Application not detected after installation — detection rule mismatch
0x87D00669Failed state for application
0x87D00692Failed to add update source for WU agent
0x87D0070EUnmatched exit code — configure allowed return codes
0x87D01106Content not available on DP or peer cache
0x87D01201Task sequence failed to run
0x87D01202Task sequence not found

Convert Negative Decimal to Hex (Common Console Display)

The ConfigMgr console often displays error codes as large negative decimal numbers (e.g. -2016411052). Convert these to hex to look them up:

# Convert negative decimal error code to hex
function ConvertTo-HexError {
    param ([long]$DecimalCode)
    "0x{0:X8}" -f ([uint32]$DecimalCode)
}

# Example — console shows -2016411052
ConvertTo-HexError -2016411052
# Returns: 0x87D00694

# Decode it
certutil -error 0x87D00694

# All-in-one function
function Resolve-ConfigMgrError {
    param ([string]$ErrorCode)

    if ($ErrorCode -match "^-") {
        # Negative decimal — convert to hex first
        $hex = "0x{0:X8}" -f ([uint32][long]$ErrorCode)
    } elseif ($ErrorCode -match "^0x") {
        $hex = $ErrorCode
    } else {
        $hex = "0x{0:X}" -f [long]$ErrorCode
    }

    $decimal = [Convert]::ToInt64($hex, 16)
    $description = ([System.ComponentModel.Win32Exception][int]$decimal).Message

    [PSCustomObject]@{
        Input       = $ErrorCode
        HexCode     = $hex
        Decimal     = $decimal
        Description = $description
    }
}

# Usage
Resolve-ConfigMgrError "-2016411052"
Resolve-ConfigMgrError "0x80070005"
Resolve-ConfigMgrError "1603"

MSI Exit Codes

MSI exit codes appear frequently in AppEnforce.log when deploying MSI-based applications via ConfigMgr or Intune:

Exit CodeDescriptionNotes
0SuccessInstallation completed successfully
1601Windows Installer service unavailableMSIServer service not running or inaccessible
1602User cancelledUI shown to user who clicked Cancel
1603Fatal error during installationMost common — check %TEMP%\MSI*.log for details
1605App not installed — repair/remove failedProductCode not found in ARP
1618Another installation in progressWait for msiexec.exe to finish or kill conflicting process
1619MSI package could not be openedFile not found or corrupt — check source path
1622Error opening installation log fileLog path invalid or no write permission
1625Installation forbidden by policyAppLocker, SRP, or Windows Installer policy blocking
1633Unsupported platformArchitecture mismatch — x86 MSI on ARM, etc.
1638Newer version already installedUse REINSTALLMODE=amus or target upgrade properly
3010Success — reboot requiredNormal — configure deployment to allow reboot

Useful Tools for Error Code Troubleshooting

  • CMTrace — the essential log viewer for all ConfigMgr logs. Highlights errors in red, warnings in yellow, and lets you merge multiple logs. Installed automatically with the ConfigMgr client at C:\Windows\CCM\CMTrace.exe
  • certutil -error <code> — quick command-line error code lookup, no additional tools needed
  • Microsoft Error Lookup Tool (err.exe) — a free download from Microsoft that decodes Win32, HRESULT, NTSTATUS, and custom error codes in one place
  • ConfigMgr Support Center — a GUI tool included with ConfigMgr that collects logs, views client health, and decodes policies from a central interface. Available in the ConfigMgr console tools folder
  • Process Monitor (Sysinternals) — for deep-diving into failed application installs where the error code alone is not sufficient; shows exactly which file or registry access is being denied

Summary

SCCM/ConfigMgr error codes span Win32, HRESULT, MSI, and ConfigMgr-specific 0x87D namespaces — knowing which namespace a code comes from often points immediately to the right log and fix. Keep the Resolve-ConfigMgrError PowerShell function handy for decoding codes you encounter in the console, and always cross-reference with the log files rather than relying on the code description alone.

  • Use certutil -error <code> or Get-ErrorDescription to decode any error code immediately
  • Convert negative decimal console codes to hex with ConvertTo-HexError before looking them up
  • 0x87D codes are ConfigMgr-specific — not in Win32 documentation
  • MSI exit code 1603 is a catch-all — always check the vendor MSI log in %TEMP% for the real cause
  • smsts.log is the single most important OSD troubleshooting file — always open it first for any task sequence failure