MSI Failed With Error Code 1625

Brandon

Updated: July 28, 2026 02:21

Problem:

When attempting to install an MSI package through an Automox Worklet, the installation fails with Windows Installer error code 1625.
According to Microsoft, error 1625 means:
This installation is forbidden by system policy. Contact your system administrator.

Resolution:

Error 1625 indicates that Windows blocked the installation because of a policy or application-control rule on the endpoint. The error generally does not indicate a problem with Automox or with the delivery of the MSI package.

The sections below provide troubleshooting options. Start by checking the Windows Installer policy and DisableMSI setting, since these are the most direct causes of error 1625. If those settings are not responsible, continue with the application-control, Group Policy, Event Viewer, and verbose logging checks that apply to the environment.

Automox Worklets on Windows run as NT AUTHORITY\SYSTEM. Therefore, focus primarily on computer-scoped policies and application-control rules that apply to the SYSTEM account.

Review Windows Installer and Software Restriction Policies

Review the following local or domain Group Policy locations:

Computer Configuration > Administrative Templates > Windows Components > Windows Installer

and:

Computer Configuration > Policies > Windows Settings > Security Settings > Software Restriction Policies

Within the Windows Installer policies, review Turn off Windows Installer and any other configured policies that restrict installations or Windows Installer packages.

The corresponding DisableMSI registry value can be found at:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer

The supported DisableMSI values are:

0: Windows Installer is enabled for all applications.
1: Windows Installer is disabled for unmanaged applications but remains enabled for managed applications.
2: Windows Installer is disabled for all applications, including repairs, reinstalls, and on-demand installations.

The registry value might not exist when the policy is not configured.

Do not change a domain-managed registry value directly. Review and modify the applicable Group Policy with the organization’s system or domain administrator.

Review application-control policies

The installation may be blocked by an application-control policy rather than the DisableMSI setting.

Check for rules configured through:

Software Restriction Policies
AppLocker
Windows Defender Application Control, also known as App Control for Business
Third-party application-control or endpoint-security software

AppLocker contains a specific Windows Installer Rules collection that applies to .msi, .msp, and .mst files.

Microsoft deprecated Software Restriction Policies beginning with Windows 10, version 1803, and Windows Server 2019. For newer application-control deployments, Microsoft recommends using AppLocker or Windows Defender Application Control.

Confirm the effective Group Policy

Domain policies can override locally configured settings, so reviewing only the Local Group Policy Editor might not identify the policy responsible for the block.

Generate a Group Policy Results report from an elevated Command Prompt:

gpresult /h C:\Windows\Temp\gpresult.html

Open the generated HTML file and review the computer policy results for Windows Installer, Software Restriction Policies, and other application-control settings.

You can also open Resultant Set of Policy by running:

rsop.msc

These reports can help identify which Group Policy Object applied a setting to the device.

Review AppLocker events

When AppLocker is configured, review Event Viewer at:

Applications and Services Logs > Microsoft > Windows > AppLocker

Check the MSI and Script event log for events indicating that the Windows Installer package was blocked.

If AppLocker is running in audit-only mode, the events may show that the package would have been blocked, rather than confirming that AppLocker actively blocked it.

Create a verbose Windows Installer log

Run the installation with verbose Windows Installer logging enabled:

msiexec.exe /i "C:\Path\Application.msi" /qn /norestart /L*V "C:\Windows\Temp\Application-install.log"

Review the log for error 1625 and messages indicating that Windows Installer rejected the package because of system policy. The log may also display the effective DisableMSI machine policy value or provide additional information about when the package was rejected.

Make sure the destination directory for the log already exists and is writable.

Review security and publisher rules

Software Restriction Policies and other application-control products may use publisher, certificate, file hash, or path-based rules.

If one of these rules is blocking the MSI, have the organization’s security, application-control, or Group Policy administrator review the effective rule before making changes.

Do not remove certificates, bypass application-control policies, or modify security rules unless the MSI has been verified and the change has been approved by the organization.

See Also:

Was this article helpful?

0 out of 0 found this helpful