AADConnectProvisioningAgentSetup.exe Error 0x80070643: Failed to execute MSI package

Hello EFR,

You pointed me in the right direction.

(It’s not just "Administrators" but also "NETWORK SERVICE" that cause the problem.)

On a Windows client:

1. MSI:

• Extract the MSI using dark.exe (WiX Toolset) (download wix314-binaries.zip from GitHub)
• Create a directory for extraction: (c:\ExtractedFiles)
• dark.exe AADConnectProvisioningAgentSetup.exe -x c:\ExtractedFiles
• In c:\ExtractedFiles\AttachedContainer, right-click the file named "a0"
• Rename the file exactly to:

AADConnectProvisioningAgent.msi

2. ORCA:

• Download the web installer for the current Windows SDK directly from the Microsoft Windows SDK download page.

• When selecting features to install, choose only "MSI Tools" (Windows SDK components for Windows Installer developers) and uncheck everything else to save disk space.

• Complete the SDK installation.

• Once the SDK setup is finished, the actual installation file for Orca will be located in a subdirectory of your Windows Kits folder (by default, at a path like C:\Program Files (x86)\Windows Kits\10\bin<version number>\x86).

• Look for the file Orca-x86_en-us.msi (or a similarly named file) there.

• Double-click this MSI file to install Orca.exe on your system.

2. Create MST:

• Launch Orca.
• Open the MSI file AADConnectProvisioningAgent.msi. - Menu: Transform - New Transform
• Under Tables: Wix4SecureObject
• Delete the domain (builtin) for UserAdministrators and change the User to "Administratoren"
• Delete the domain (NT Authority) for the NETWORK SERVICE user and change the User to "Netzwerkdienst" (or whatever the local account is named on the DC—launch services.msc to check the exact account name, as there are likely already services running under this account).
• Menu: Transform - Generate Transform - name and save the .mst file (e.g., fix-accounts.mst).
• Copy it to the DC along with the .msi file.

Start the installation via the command line:

msiexec.exe /i "C:\Sources_AADConnect_msi_mst\AADConnectProvisioningAgentSetup.msi" TRANSFORMS="@C:\Sources_AADConnect_msi_mst\fix-accounts.mst" /qn /norestart /L*v "C:\Sources_AADConnect_msi_mst\install.log"

The wizard should now launch.

(Use at your own risk)

It would be great to see a timely solution from Microsoft, though. It’s in their interest, after all—they want us on M365.

This whole process is an incredibly messy workaround.

German Server here too. I resolved it by using orca. The error is, that the msi is using the english group/user names. Why Microsoft can't use parameters that resolve globaly and is using english localisation is beyond me.

Here a screenshot from Orca:

I resolved it by building a transformation file with deleted Domain and correct Username.
You also need the msi File. I can't upload them here i suppose.

Path to resolve:
While the installaer runs at AppData\Local\Temp there will be folder created with the msi file in it, copy it out of it, before the roll back deletes it.
Use Orca to create a transformation File with working usernames
Run the msi file with the transformation file for example:

msiexec /i "C:\Temp\agentlayout\Microsoft.SCIM.Provisioning.Setup.msi" `
TRANSFORMS="C:\Temp\fix-accounts.mst" `
/l*v C:\Temp\agent_mst.log

We are experiencing the exact same issue in our environment.

Environment

• Windows Server 2025 Datacenter
• Fully patched (September 2026 updates installed)
• Server is a Domain Controller
• Microsoft Entra Provisioning Agent upgrade and clean reinstallation both fail
• Existing agent version: 1.1.2505.0
• Installer: AADConnectProvisioningAgentSetup.exe

Observed behavior

The bootstrapper always ends with:

Error 0x80070643: Failed to execute MSI package.

After reviewing the MSI log, the actual failure appears to be:

Plain Text

ExecSecureObjects: Error 0x80070534:

failed to get sid for account: BUILTIN\Administrators

Custom Action:

Wix4ExecSecureObjects_X64

MSI Error:

1603

The installation then rolls back and the upgrade fails.

Additional observations

• .NET Framework requirements are fulfilled.
• The package is successfully downloaded and verified.
• The installer is executed with elevated administrative privileges.
• Disk space is available.
• Tenant registration and connectivity are not the issue.
• The same error occurs during both an in-place upgrade and a complete reinstall attempt.
• The problem appears when the MSI tries to apply security permissions through the Wix4ExecSecureObjects_X64 custom action.

Important detail

The affected server is a Domain Controller. This could indicate that the installer is making assumptions about the presence or resolution of the local BUILTIN\Administrators group that do not hold true in all Domain Controller scenarios.

At this point it looks less like an environmental issue and more like a potential installer defect or unsupported security handling on Windows Server 2025 Domain Controllers.

Can Microsoft please confirm:

1. Whether the current Entra Provisioning Agent version officially supports Windows Server 2025 Domain Controllers.
2. Whether there is a known issue with the Wix4ExecSecureObjects_X64 custom action and SID resolution of BUILTIN\Administrators.
3. Whether a fix or updated installer is planned.

Thanks.We are experiencing the exact same issue in our environment.

Environment

• Windows Server 2025 Datacenter
• Fully patched (September 2026 updates installed)
• Server is a Domain Controller
• Microsoft Entra Provisioning Agent upgrade and clean reinstallation both fail
• Existing agent version: 1.1.2505.0
• Installer: AADConnectProvisioningAgentSetup.exe

Observed behavior

The bootstrapper always ends with:

Error 0x80070643: Failed to execute MSI package.

After reviewing the MSI log, the actual failure appears to be:

Plain Text

ExecSecureObjects: Error 0x80070534:

failed to get sid for account: BUILTIN\Administrators

Custom Action:

Wix4ExecSecureObjects_X64

MSI Error:

1603

The installation then rolls back and the upgrade fails.

Additional observations

• .NET Framework requirements are fulfilled.
• The package is successfully downloaded and verified.
• The installer is executed with elevated administrative privileges.
• Disk space is available.
• Tenant registration and connectivity are not the issue.
• The same error occurs during both an in-place upgrade and a complete reinstall attempt.
• The problem appears when the MSI tries to apply security permissions through the Wix4ExecSecureObjects_X64 custom action.

Important detail

The affected server is a Domain Controller. This could indicate that the installer is making assumptions about the presence or resolution of the local BUILTIN\Administrators group that do not hold true in all Domain Controller scenarios.

At this point it looks less like an environmental issue and more like a potential installer defect or unsupported security handling on Windows Server 2025 Domain Controllers.

Can Microsoft please confirm:

1. Whether the current Entra Provisioning Agent version officially supports Windows Server 2025 Domain Controllers.
2. Whether there is a known issue with the Wix4ExecSecureObjects_X64 custom action and SID resolution of BUILTIN\Administrators.
3. Whether a fix or updated installer is planned.

Thanks.