AADConnectProvisioningAgentSetup.exe Error 0x80070643: Failed to execute MSI package

We are experiencing the exact same issue in our environment.

Environment

• Windows Server 2025 Datacenter
• Fully patched (September 2026 updates installed)
• Server is a Domain Controller
• Microsoft Entra Provisioning Agent upgrade and clean reinstallation both fail
• Existing agent version: 1.1.2505.0
• Installer: AADConnectProvisioningAgentSetup.exe

Observed behavior

The bootstrapper always ends with:

Error 0x80070643: Failed to execute MSI package.

After reviewing the MSI log, the actual failure appears to be:

Plain Text

ExecSecureObjects: Error 0x80070534:

failed to get sid for account: BUILTIN\Administrators

Custom Action:

Wix4ExecSecureObjects_X64

MSI Error:

1603

The installation then rolls back and the upgrade fails.

Additional observations

• .NET Framework requirements are fulfilled.
• The package is successfully downloaded and verified.
• The installer is executed with elevated administrative privileges.
• Disk space is available.
• Tenant registration and connectivity are not the issue.
• The same error occurs during both an in-place upgrade and a complete reinstall attempt.
• The problem appears when the MSI tries to apply security permissions through the Wix4ExecSecureObjects_X64 custom action.

Important detail

The affected server is a Domain Controller. This could indicate that the installer is making assumptions about the presence or resolution of the local BUILTIN\Administrators group that do not hold true in all Domain Controller scenarios.

At this point it looks less like an environmental issue and more like a potential installer defect or unsupported security handling on Windows Server 2025 Domain Controllers.

Can Microsoft please confirm:

1. Whether the current Entra Provisioning Agent version officially supports Windows Server 2025 Domain Controllers.
2. Whether there is a known issue with the Wix4ExecSecureObjects_X64 custom action and SID resolution of BUILTIN\Administrators.
3. Whether a fix or updated installer is planned.

Thanks.We are experiencing the exact same issue in our environment.

Environment

• Windows Server 2025 Datacenter
• Fully patched (September 2026 updates installed)
• Server is a Domain Controller
• Microsoft Entra Provisioning Agent upgrade and clean reinstallation both fail
• Existing agent version: 1.1.2505.0
• Installer: AADConnectProvisioningAgentSetup.exe

Observed behavior

The bootstrapper always ends with:

Error 0x80070643: Failed to execute MSI package.

After reviewing the MSI log, the actual failure appears to be:

Plain Text

ExecSecureObjects: Error 0x80070534:

failed to get sid for account: BUILTIN\Administrators

Custom Action:

Wix4ExecSecureObjects_X64

MSI Error:

1603

The installation then rolls back and the upgrade fails.

Additional observations

• .NET Framework requirements are fulfilled.
• The package is successfully downloaded and verified.
• The installer is executed with elevated administrative privileges.
• Disk space is available.
• Tenant registration and connectivity are not the issue.
• The same error occurs during both an in-place upgrade and a complete reinstall attempt.
• The problem appears when the MSI tries to apply security permissions through the Wix4ExecSecureObjects_X64 custom action.

Important detail

The affected server is a Domain Controller. This could indicate that the installer is making assumptions about the presence or resolution of the local BUILTIN\Administrators group that do not hold true in all Domain Controller scenarios.

At this point it looks less like an environmental issue and more like a potential installer defect or unsupported security handling on Windows Server 2025 Domain Controllers.

Can Microsoft please confirm:

1. Whether the current Entra Provisioning Agent version officially supports Windows Server 2025 Domain Controllers.
2. Whether there is a known issue with the Wix4ExecSecureObjects_X64 custom action and SID resolution of BUILTIN\Administrators.
3. Whether a fix or updated installer is planned.

Thanks.

Hi Silvan,

I've got the exact same problem.

I've tried 2016 + 2025 German Server.

Error: 0x80070643

@Microsoft: Any idea?

I've opened a SupportCall:
Unable to install Microsoft Entra Provisioning Agent ‎ (#‎2610021420001769‎)

Greetings from Neuss
Oliver