Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
0x80004005 is a generic failure code, not a diagnosis. To fix a failed Configuration Manager (MECM) task sequence, identify the deployment phase, open the matching smsts.log, and find the first specific error above the final HRESULT. The remedy may involve rebuilding boot media with the correct certificate chain, preventing an unmanaged restart, repairing an application or package step, removing a conflicting SetupComplete.cmd, or correcting an MDT script or image reference. The instructions below follow those branches so you can use the evidence in your own log instead of applying an unrelated universal fix.
What does task-sequence error 0x80004005 mean?
In Configuration Manager, 0x80004005 is the HRESULT commonly rendered as “Unspecified error.” It is used as a roll-up when a task-sequence action, policy request, setup hook, client operation, or script has already failed. The final line is therefore a symptom. The actionable cause is normally the first component-specific message, URL, certificate warning, WMI code, installer return value, or restart event earlier in the log.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Microsoft documents materially different causes for the same code. A policy-retrieval failure over HTTPS can be a missing root CA in boot media; a post-reboot failure can mean Windows servicing restarted the computer outside the sequence; an Install Application message can merely expose a content or installer error; and MDT capture failures can originate in WMI or a missing folder. Treat the deployment phase and preceding log entries as the diagnosis.
How should I identify the failing phase before changing anything?
Write down the exact screen text and the action that was running. The distinction determines which log path and remediation branch apply.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- Policy retrieval: the wizard says “Retrieving policy for this computer,” or fails before an action starts.
- Action execution: a named step such as Install Application, Install Software Updates, Run Command Line, or Setup Windows and ConfigMgr fails.
- New-OS transition: Windows has been applied and the failure occurs while setup hooks or the Configuration Manager client are being installed.
- Resume after restart: the sequence returns with “Task Sequence environment not found” or cannot find its state.
- Capture or MDT: Sysprep-and-Capture,
LTIApply.wsf, WMI, or image-reference messages appear.
Also record whether the deployment uses bootable, prestaged, dynamic, or standalone media; whether management points require HTTPS; whether the computer restarted unexpectedly; and which task-sequence and Configuration Manager update versions were used. Rerun with the same media and sequence version after each change so the comparison is meaningful.
Where is SMSTS.log during each task-sequence phase?
Use the path that matches the phase. The log location changes as Windows PE formats the disk, applies the operating system, installs the client, and completes the sequence.
| Phase | SMSTS.log location |
|---|---|
| Windows PE, before Format and Partition Disk | X:Windowstempsmstslogsmsts.log |
| Windows PE, after Format and Partition Disk | X:smstslogsmsts.log, then copied to C:_SMSTaskSequenceLogssmstslogsmsts.log |
| New operating system, before the Configuration Manager client is installed | C:_SMSTaskSequenceLogssmstslogsmsts.log |
| After the client is installed | C:WindowsCCMLogssmstslogsmsts.log |
| After task-sequence completion | C:WindowsCCMLogssmsts.log |
The read-only task-sequence variable _SMSTSLogPath reports the current log directory. In Windows PE, open a command prompt from the task-sequence environment and copy the relevant file to removable storage or a network share before rebooting. In the full operating system, collect both smsts.log and the component log named by the failing step, such as AppEnforce.log or CCMExec.log, when available.
How do I read the log instead of stopping at 0x80004005?
- Open the log from the phase table and search for
80004005or0x80004005. - Start at the last occurrence, then move upward until you find the first message that names a component, URL, file, certificate, WMI namespace, installer, or restart.
- Copy several lines before and after that entry. A line such as
Install application action failedidentifies where the sequence noticed the problem, not necessarily where it began. - Classify the earlier message into policy/PKI, restart state, application or package, setup hook, MDT/WMI, or security-context failure.
- Apply only the matching branch below, then rerun the same sequence and compare the new log around the original failure point.
For example, 0x80072F8F, WINHTTP_CALLBACK_STATUS_FLAG_INVALID_CA, “Failed to get client identity,” or “Failed to query Management Point locator” points to certificate validation or management-point discovery, not to an application installer. An earlier 0x80041002 (“Not found”) points to WMI or an MDT script. A line showing !sVolumeID.empty(), HRESULT=80004005 after a restart points to lost task-sequence state.
How do I fix 0x80004005 while retrieving policy over HTTPS?
When the wizard stalls at “Retrieving policy for this computer” and the log shows an invalid CA, client-identity, or management-point-locator message, check the media’s certificate chain and origin.
Why can the media be missing a root certificate?
In Microsoft’s documented PKI scenario, HTTPS management points required a root CA, but bootable or prestaged media was created at a central administration site that did not contain that root-CA information. The resulting media could not validate the management-point certificate during policy retrieval.
Recommended Free Tools
Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
What is the documented correction?
- Create new bootable or prestaged media at a primary site that has the required PKI information.
- If the same media must work across sites, use dynamic media; it can be created at any site and obtains site-specific information during deployment.
- Verify that the management-point certificate chain presented to the computer ends in a trusted root CA included in the media’s trust store.
- Check the device’s date, time, and time zone before retrying. An incorrect clock can make an otherwise valid certificate appear expired or not yet valid.
- Retest policy retrieval with the rebuilt media and confirm that the earlier WinHTTP or client-identity message has disappeared.
Rebuilding media is relevant to this certificate/media-origin pattern. It will not correct an unrelated Install Application, setup-hook, or MDT failure, so keep the original log evidence when choosing this branch.
How do I recover when the task-sequence environment disappears after a restart?
If the sequence reaches Install Software Updates, restarts, and later reports “Task Sequence environment not found,” look for an uncontrolled second restart. The task sequence can save its state for the restart it initiated, while a second restart initiated by Windows servicing occurs outside that orchestration and loses the execution context.
Prevent the extra restart
- Edit the Install Software Updates step and use its built-in retry option so update installation and retries remain managed by the task sequence.
- Alternatively, manage those updates through the normal Configuration Manager software-updates feature instead of installing them in a sequence that must survive multiple servicing restarts.
- Review the timeline in
smsts.logfor the first task-sequence restart and a subsequent servicing restart. The second event is the key distinction.
Repair a client left in provisioning mode
If the computer remains in client provisioning mode, use the documented WMI SetClientProvisioningMode method or reinstall the Configuration Manager client according to your organization’s standard procedure. Do not simply change the registry value for ProvisioningMode to false; Microsoft explicitly warns, “Do not try to fix the client by changing the value of ProvisioningMode to false.”
Why does Install Application return 0x80004005?
Install Application is often the place where the error surfaces, but rarely where it originates. Inspect the lines immediately before the roll-up for policy evaluation, content location, download, installer execution, and CCMExec errors.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check policy and content first
- Confirm that the client can communicate with its assigned management point during the step.
- Look for a policy-evaluation failure such as
hr=0x80004005, then determine whether the application policy was received. - Check content-location and download entries for a missing distribution point, inaccessible content, or a connectivity interruption.
- Verify that the SMS Agent Host service starts without error and that its component log records the application request.
- Only after policy and content succeed, inspect the application installer’s own return code and command line.
Handle standalone-media restarts
Microsoft also documents a standalone-media roll-up when the computer restarts between two Install Application steps and the first step does not have Continue on error enabled. Check the sequence’s restart order, enable Continue on error only where that behavior is acceptable, and confirm that the applicable Configuration Manager update rollup is installed. Do not use Continue on error to hide a required application failure; use it only when the sequence is intentionally designed to continue after that step.
How do I fix a Setup Windows and ConfigMgr setup-hook failure?
If the failure occurs in Windows PE while Setup Windows and ConfigMgr is running and the log contains OSDSetupHook ... HRESULT=80070005 or “Failed to install OSD setup hook,” inspect the applied image for a pre-existing SetupComplete.cmd.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Configuration Manager needs to install its own setup hook. A custom file already present in the operating-system image, or copied by an earlier Run Command Line step, can block that installation and produce the access-denied error.
- Search the reference image for
WindowsSetupScriptsSetupComplete.cmd. - Remove the Run Command Line step that copies the custom file, if the sequence adds it.
- Remove the file from the reference image, or delete it in a step between Apply Operating System and Setup Windows and ConfigMgr.
- Move the custom actions into ordinary task-sequence steps that run after Setup Windows and ConfigMgr, where they do not compete for the setup-hook location.
- Run the sequence again and confirm that the OSD setup-hook installation completes before investigating later steps.
What should I do for MDT capture, WMI, or image-reference failures?
Repair the MDT capture script’s missing folder
In a documented MDT Sysprep-and-Capture case, the log showed an earlier WMI 0x80041002 (“Not found”) before the final 0x80004005. LTIApply.wsf called takeown.exe for a Boot folder that did not exist. Create the expected Boot folder before that call, or apply the script change described in Microsoft’s documented remedy. The later HRESULT is only the roll-up.
Create a new sequence after changing the image reference
If a sequence became unreliable after changing the referenced operating-system image or architecture, create a new task sequence with the correct reference instead of modifying the existing image reference in place. This gives the new sequence a clean set of architecture- and image-specific settings and makes a rerun easier to compare.
Check the exact WMI message
Do not treat every WMI entry as the same problem. Capture the namespace, class, method, and return code surrounding the first WMI error, then correct that object or script before retrying. A generic 0x80004005 line without the earlier WMI context is insufficient to choose a fix.
Why does a Run Command Line or PowerShell step fail only in Windows PE?
Windows PE cannot be joined to a domain. A Run Command Line or Run PowerShell Script step configured to run under another domain account can therefore fail in Windows PE even though the same command works in the full operating system.
If the log points to this security-context condition, run the step in a supported local or task-sequence security context, or move it to the full OS phase after domain and client initialization. Do not troubleshoot it as a certificate, application-content, or installer problem unless the log shows evidence for one of those causes.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAlso popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Which remediation should I choose?
Use the first specific log code and deployment conditions to select a single branch rather than changing several parts of the sequence at once.
| Log pattern or condition | Most likely branch | Primary change |
|---|---|---|
| Invalid CA, 0x80072F8F, failed client identity, policy retrieval; HTTPS management point | PKI or media origin | Recreate bootable or prestaged media at a primary site; use dynamic media for multi-site deployments; verify chain and time |
| “Task Sequence environment not found” after Install Software Updates and an extra restart | Uncontrolled servicing restart | Use the update-step retry option or normal software-updates management; repair provisioning mode with the documented WMI method or reinstall the client |
| Install Application or policy-evaluation roll-up | Policy, content, CCMExec, or installer | Inspect preceding policy, content-location, download, service, and installer entries |
| Standalone media restarted between application steps | Restart sequencing | Review Continue on error and restart order; install the applicable Configuration Manager update rollup |
| OSDSetupHook 0x80070005 | Conflicting SetupComplete.cmd | Remove the copied or image-resident file and move custom actions to normal task-sequence steps |
| MDT WMI 0x80041002, missing Boot folder | MDT script prerequisite | Create the folder before LTIApply.wsf calls takeown.exe, or update the script as documented |
| Failure after changing image or architecture reference | MDT/task-sequence reference state | Create a new task sequence with the correct image reference |
| Run step under another account in Windows PE | Unsupported security context | Use a supported context in PE or move the step to the full OS |
What should I collect before escalating the failure?
- The exact screen text and task-sequence step name.
- The deployment phase and the matching
smsts.logpath. - The first specific error above the final 0x80004005, including nearby timestamps.
- Media type and creation site, especially whether the media is bootable, prestaged, dynamic, or standalone.
- Whether management points use HTTPS/PKI and whether the device clock was correct.
- Restart history, including any reboot triggered by Windows servicing.
- Relevant component logs from the Configuration Manager client, application installer, MDT script, or WMI provider.
- The task-sequence revision, operating-system image and architecture, and Configuration Manager update level used for the test.
This information lets an administrator distinguish a media rebuild, sequence edit, client-state repair, script correction, or product update instead of repeatedly retrying the same generic HRESULT.
As an optional shortcut after the manual checks, Outbyte PC Repair can address more than 100 common Windows issues, clean temporary and cache files, check selected Windows vulnerabilities, and provide an app-crash log and other maintenance tools. It runs on Windows 11, 10, 8, and 7; its free trial is offered by category for at least two days before a subscription. It complements an antivirus rather than replacing one, results vary, and no tool repairs every Configuration Manager task-sequence failure.
Frequently asked questions
Can a wrong system clock really cause this error?
Yes. HTTPS certificate validation checks validity dates, so a clock that is ahead or behind can produce an invalid-CA or WinHTTP security error even when the certificate chain is correctly installed. Correct the time and time zone in Windows PE and confirm that the management-point certificate is valid for that date before rebuilding other components.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWill rebuilding boot media always solve 0x80004005?
No. Rebuilding media addresses the documented case where PKI information was omitted because media was created at a central administration site. It will not repair a lost task-sequence environment, a failing application installer, a conflicting setup hook, or an MDT script error.
Should I delete the task-sequence cache before trying again?
Not as a first response. Deleting cached state can remove logs and content needed to identify the original cause. Preserve the relevant logs, correct the branch-specific problem, and then let the sequence or your approved deployment process recreate its working state.
Is 0x80004005 evidence that the computer is infected?
No. The code is a generic Configuration Manager HRESULT and does not identify malware. Investigate the deployment phase, certificate and policy messages, restart history, content, scripts, and WMI entries shown in smsts.log; use your organization’s separate security tools if there is independent evidence of a security incident.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
What is the fastest way to compare two reruns?
Keep the task-sequence revision, media type, image, and target conditions unchanged while testing one correction. Compare timestamps around the first specific error, not just whether the final 0x80004005 line moved, so you can tell whether the original fault was removed or merely masked by a later step.
Free tools Windows power users keep installed
One-click scans. No signup required.
Frequently Asked Questions
Can a wrong system clock really cause this error?
Yes. HTTPS certificate validation checks validity dates, so a clock that is ahead or behind can produce an invalid-CA or WinHTTP security error even when the certificate chain is correctly installed. Correct the time and time zone in Windows PE and confirm that the management-point certificate is valid for that date before rebuilding other components.
Will rebuilding boot media always solve 0x80004005?
No. Rebuilding media addresses the documented case where PKI information was omitted because media was created at a central administration site. It will not repair a lost task-sequence environment, a failing application installer, a conflicting setup hook, or an MDT script error.
Should I delete the task-sequence cache before trying again?
Not as a first response. Deleting cached state can remove logs and content needed to identify the original cause. Preserve the relevant logs, correct the branch-specific problem, and then let the sequence or your approved deployment process recreate its working state.
Is 0x80004005 evidence that the computer is infected?
No. The code is a generic Configuration Manager HRESULT and does not identify malware. Investigate the deployment phase, certificate and policy messages, restart history, content, scripts, and WMI entries shown in smsts.log; use your organization’s separate security tools if there is independent evidence of a security incident.
What is the fastest way to compare two reruns?
Keep the task-sequence revision, media type, image, and target conditions unchanged while testing one correction. Compare timestamps around the first specific error, not just whether the final 0x80004005 line moved, so you can tell whether the original fault was removed or merely masked by a later step.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
