Free tools Windows power users keep installed
One-click scans. No signup required.
Error 0x80070643 in SCCM (Microsoft Configuration Manager) is a generic Windows Installer failure, not a diagnosis. The reliable fix is to identify whether the failure occurred during a software-update scan, CcmSetup client installation, or a specific component load, then apply the narrow remedy supported by the matching log.
Start with WUAHandler.log, WindowsUpdate.log, CcmSetup.log, and the relevant MSI entries. Do not resize WinRE partitions, delete registry values, or remove installer files until those records identify the corresponding failure.
As an Amazon Associate I earn from qualifying purchases.
What 0x80070643 means in SCCM
Windows defines hexadecimal 0x80070643 as ERROR_INSTALL_FAILURE. It only says that an installation operation failed; it does not identify the failed update, MSI package, ConfigMgr component, or prerequisite. The same code can therefore appear in unrelated situations.
In a ConfigMgr environment, the code commonly surfaces in one of three stages:
#1 Best Overall
- Software-update evaluation or installation: the Windows Update Agent, WSUS configuration, or a downloaded update fails.
- ConfigMgr client deployment or upgrade:
CcmSetup.execannot complete an MSI or prerequisite operation. - Component loading: a provider DLL or another client component fails while the client is registering or starting.
Because the hexadecimal value is non-specific, a fix copied from a different stage can waste time or damage a working installation. Treat the first matching error in the logs—not the final summary line—as the diagnostic starting point.
Find the failing phase before changing anything
Software-update activity
For a deployment, scan, or update-installation failure, inspect the ConfigMgr WUAHandler.log and the Windows Update Agent’s WindowsUpdate.log. WUAHandler records what the Windows Update Agent reports; the underlying error, applicability decision, download state, and HRESULT are usually more detailed in WindowsUpdate.log. On a standard client these logs are normally under C:WindowsCCMLogs, although a customized installation can use another Windows directory.
Record the update identifier (for example, a KB number), the timestamp, the HRESULT immediately before 0x80070643, and whether the failure occurred during detection, download, applicability evaluation, or installation. That distinction determines whether you investigate communication and policy or repair local update state.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Client installation or upgrade
For “CcmSetup failed” messages, inspect CcmSetup.log and the MSI log entries generated during the same attempt. The usual CcmSetup log location is C:WindowsccmsetupLogsCcmSetup.log. Search around the first failure for the package name, MSI return code, prerequisite, architecture, and any path or access error. The final CcmSetup summary may repeat 0x80070643 without naming the component that actually failed.
Component-load failure
If the log names a DLL, provider, or registry setting, use that evidence rather than applying a general Windows Update reset. A named component such as PolicyAgentProvider.dll points to a different branch from a failed update scan.
Choose the least invasive remedy
| Observed stage | Evidence to confirm it | First remedy | Scope and reversibility |
|---|---|---|---|
| Update scan or installation | WUAHandler.log plus the corresponding Windows Update Agent entry; update KB or scan HRESULT |
Check management-point/software-update-point access, firewall, proxy, authentication, and Group Policy or WSUS settings; reset SoftwareDistribution only when local update state is implicated |
Client-only; renaming the folder is reversible |
| CcmSetup client deployment or upgrade | CcmSetup.log and MSI log identify cache, package, prerequisite, or installer-remnant failure |
Correct the named prerequisite or package; conditionally clear the ConfigMgr cache and quarantine matching .ipi remnants |
Client-only; preserve files so the change can be rolled back |
| ConfigMgr 2509 client on ARM x64 | Installation or upgrade fails on the affected architecture and the site is running the applicable release | Verify whether Microsoft hotfix rollup KB36949461 applies before deployment | Version- and architecture-specific; site rollout may affect many clients |
| Provider DLL load | Log explicitly cites PolicyAgentProvider.dll and CWDIllegalInDllSearch=0xFFFFFFFF |
Use the documented registry or PATH correction for that exact symptom | System configuration change; back up and document before editing |
Check communication, policy, and prerequisites
Before resetting files, prove that the client can communicate with its management point and software-update point. A client that cannot authenticate or reach those roles may report a generic installation failure even though its local update database is healthy.
Management point and software-update point
- Confirm the client has received a valid site assignment and current machine policy.
- Verify DNS resolution and reachability for the management point and software-update point from the affected device.
- Check that the Windows firewall, network firewall, proxy, and TLS inspection rules allow the required ConfigMgr and Windows Update traffic.
- Confirm proxy credentials and authentication behavior. A service account or Local System process may not use the same proxy credentials as an interactive user.
- Review Group Policy and WSUS settings for a conflicting intranet update service, blocked scan source, or policy that prevents Windows Update from contacting the configured endpoint.
After correcting communication or policy, trigger a Machine Policy Retrieval & Evaluation Cycle and then a Software Updates Scan Cycle from Control Panel > Configuration Manager > Actions. Wait for new log entries and verify that the same KB or phase fails again before making a local reset.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsBasic system checks
- Use an elevated account for service, folder, registry, and client-maintenance changes.
- Ensure the system drive has sufficient free space for the update payload, temporary files, and MSI rollback data.
- Check that the system clock, time zone, and certificate chain are correct; authentication and signed-update validation can fail when time is substantially wrong.
- Pause overlapping maintenance tasks while testing. A second deployment, restart, or repair can obscure which action produced the error.
Reset Windows Update state when the logs point to corruption
Microsoft documents a focused reset for a damaged Windows Update cache. This is appropriate when WindowsUpdate.log shows corrupted or inconsistent local update state, repeated failed scans after connectivity is confirmed, or a cache-related error. It is not a universal ConfigMgr repair.
Rank #3
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This Wire-O book contains spaces for managers to keep track of shift notes, employees, etc
- There are spaces to keep lists of top level items as well as daily to-do lists
- You can track your comps, sales, payments, and customer behavior
- 100 Pages, Wire-O, 8.5" x 11" Reorder SKU: LOG-100-7CW-PP(ManagerNotebook)
- Open Command Prompt (Admin) or an elevated PowerShell window.
- Stop the Windows Update service:
net stop wuauserv- Rename the cache folder so Windows can create a clean one while preserving the old data for rollback:
ren C:WindowsSoftwareDistribution SoftwareDistribution.old- Start the service again:
net start wuauserv- From Control Panel > Configuration Manager > Actions, run Machine Policy Retrieval & Evaluation Cycle, followed by Software Updates Scan Cycle.
- Watch
WUAHandler.logand WindowsUpdate.log for a fresh scan. If the same update still fails, keep the renamed folder until you have completed troubleshooting; do not assume a second reset will solve a server-side, policy, or package problem.
If the reset does not help, the old folder can be removed later after confirming that the new update cache is functioning and no rollback data is needed. Avoid deleting it during the diagnostic window because its contents may help explain what was corrupted.
Repair a CcmSetup failure using the installation evidence
Client-installation failures require a narrower approach than an update-cache reset. Use the package and MSI information in CcmSetup.log to identify what CcmSetup was trying to install.
Clear the ConfigMgr client cache only when logs implicate it
A secondary procedure reported by Windows Report recommends clearing %windir%ccmcache when stale or incomplete content is blocking a client installation. Treat this as conditional guidance, not a default step. First confirm in the log that the failing package is in the client cache or that the cache contains an incomplete copy.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Open Control Panel > Configuration Manager and select the Cache tab, or inspect
%windir%ccmcachedirectly. - Record any package identifiers and confirm that no active deployment is using the content.
- Use the Cache tab’s deletion control for the identified content, or remove only the stale package directory after stopping the related installation process.
- Retry the deployment so ConfigMgr downloads a new copy, then verify the new content identifier and MSI result in the logs.
Do not empty the entire cache on a production device merely because 0x80070643 appears. Doing so can force unrelated deployments to download again and can remove useful evidence.
Rank #4
- EASY TO USE - The manager notebook is easy-to-use that help you keep track of shift notes, employees, etc.
- MONITOR YOUR DATAS - Using a project manager notebook to store all your data, you can track your comps, sales, payments, and customer behavior,consult your records whenever needed.
- HIGH QUALITY - The manager office supplies is used to high quality 100gsm pure white paper, elastic band and a back pocket for extra space. Make sure you have enough space for all manager plan
- UNIQUE DESIGN & A4 SIZE - Manager log book cover is lovely, golden spiral bound design, size of 8.2" x 10.5". Just the perfectly size to fit in your backpack, purse or laptop case. Without taking up your space and always helping you keep track of your small business
- THE PERFECT GIFT - Management logbook as gift for woman & man. Use it to improve your management efficiency, make efficient adjustments whenever needed
Quarantine leftover .ipi files instead of deleting them
The same secondary guidance describes moving leftover .ipi files from %systemroot%Installer when CcmSetup or the MSI log specifically reports an installer-remnant conflict. This directory is used by Windows Installer, so indiscriminate deletion can break repair and uninstall operations.
- Confirm the exact file name or pattern in the MSI log and create a dated quarantine folder outside
%systemroot%Installer. - Stop the CcmSetup attempt and any Windows Installer operation that has a lock on the file.
- Move only the named remnants to the quarantine folder; do not delete them.
- Restart the client installation and monitor the MSI log. If another component fails, stop and reassess rather than moving more files.
- Restore the files if the retry creates a new error or if another application’s repair operation needs them.
Check ConfigMgr version and CPU architecture
Version and architecture can change whether a known fix applies. A report on Configuration Manager 2509 identifies Microsoft hotfix rollup KB36949461 for 0x80070643 during client installation or upgrade on ARM x64 devices. The item was reported by Prajwal Desai in 2026; verify the applicability statement, release notes, and package availability in your own Microsoft Configuration Manager console before deployment.
Verify before deploying a hotfix
- Confirm the site and client version, not just the console version.
- Confirm the affected device’s CPU architecture and the architecture of the client package being installed.
- Check whether the failure occurs during a new installation, an in-place client upgrade, or another operation covered by the rollup.
- Test the hotfix on a representative ARM x64 device and review the resulting CcmSetup log before broad deployment.
Do not apply an ARM-specific rollup to Intel or AMD x64 clients on the assumption that the same hexadecimal code proves the same defect. If the version or architecture does not match, return to the phase-specific logs.
Recommended Free Tools
Handle PolicyAgentProvider.dll only when the matching symptom exists
Microsoft documents a separate installation failure involving PolicyAgentProvider.dll when the registry value CWDIllegalInDllSearch is set to 0xFFFFFFFF. This is a component-specific condition, not a general explanation for SCCM error 0x80070643.
Confirm the condition
Use this branch only if the MSI or CcmSetup log names PolicyAgentProvider.dll and shows the CWDIllegalInDllSearch=0xFFFFFFFF behavior. If those strings are absent, changing this setting is unrelated and should be skipped.
Apply one documented correction
After creating a system-state backup and recording the current value, use the documented Microsoft remedy for your operating-system configuration: remove or change the offending registry value, or add C:WindowsCCM to the system PATH. Make one change at a time, restart if the installer requires it, and retry the client installation while capturing a new MSI log. A registry edit should be performed by an administrator who can restore the original value; do not delete unrelated registry keys.
Do not resize WinRE for a generic SCCM failure
Windows recovery-partition resizing is relevant to specific Windows Recovery Environment update failures, where the update cannot service an undersized WinRE partition. It is not a general remedy for ConfigMgr error 0x80070643, a failed CcmSetup, or an ordinary software-update scan.
Only consider a WinRE procedure when the Windows Update logs explicitly identify a WinRE servicing or partition-capacity failure and the affected update’s documentation calls for it. Otherwise, changing partition boundaries adds boot-recovery risk without addressing the diagnosed SCCM component.
Validate the repair and know when to stop
- Repeat the exact action that originally failed: the same scan, KB installation, client installation, or upgrade.
- Capture fresh timestamps in
WUAHandler.log, WindowsUpdate.log,CcmSetup.log, and MSI logs. - Confirm that the original component now completes, not merely that a later summary line changed.
- In the Configuration Manager console, verify the client’s active status, policy retrieval, hardware inventory, and software-update state.
- Restore quarantined files or the previous configuration if the change introduced a new failure.
Escalate with the complete logs, client and site versions, architecture, update KB, management-point and software-update-point details, and a timeline of every change when the error persists. A repeated generic code without its preceding component error is not enough information to choose another repair.
Quick Recap
Practical decision checklist
- Only WUAHandler or WindowsUpdate.log fails: investigate update endpoints, firewall, proxy, authentication, and policy first; reset
SoftwareDistributiononly when local corruption is supported. - CcmSetup and MSI logs fail on cached content: conditionally clear the identified cache item and retry.
- MSI logs name installer remnants: quarantine only the named
.ipifiles and preserve a restore path. - The device is ARM x64 and the site is ConfigMgr 2509: check KB36949461 applicability before changing the client package.
- PolicyAgentProvider.dll and CWDIllegalInDllSearch are explicit: follow the component-specific registry or PATH correction.
- Only a WinRE servicing error is present: investigate the recovery partition; otherwise leave WinRE unchanged.
Optional shortcut
After the manual diagnosis and backups, Outbyte PC Repair can be an optional shortcut for common Windows issues, broken system elements, invalid redirects, shared DLL files, settings that increase CPU, RAM or disk load, temporary and cache cleanup, privacy warnings, vulnerability checks, a real-time boost, file shredding, and an app-crash log. It runs on Windows 11, 10, 8 and 7; a category-based free trial lasts at least two days before a paid subscription. It complements antivirus software rather than replacing it, results vary, and no tool repairs every crash.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
