Skip to content

WINDOWS INSTALLER ERROR · ERROR_INSTALL_PACKAGE_REJECTED

Error 1625: This Installation Is Forbidden by System Policy

Windows Installer did not fail: it refused. A system policy set on this PC does not allow this installation to run, and Microsoft's text sends you to the system administrator.

WHAT WINDOWS SAYS

This installation is forbidden by system policy. Contact your system administrator.

Wording from Microsoft's documentation, linked under Sources.

TECHNICAL SUMMARY

Number1625
Windows nameERROR_INSTALL_PACKAGE_REJECTED
Where it appearsExit code of msiexec.exe
In PC Tweaker UninstallerShows the exit code

What causes Error 1625

  • The DisableMSI policy. Microsoft documents it under HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer: with the value 2, Windows Installer is always disabled for all applications and no installs are allowed, including repairs and reinstalls; with 1, non-elevated per-user installations are blocked while elevated and per-machine installs are allowed.
  • A software restriction policy. Microsoft's event list has two entries for it: event 1007, the installation is not permitted by software restriction policy, and event 1008, it is not permitted because of an error in software restriction policy processing.

How to fix Error 1625, safest step first

Microsoft's message says to contact the system administrator. On a work or school PC that is the fix; on your own PC, read the policy first.

  1. On a managed PC, ask the administrator

    If the PC belongs to an employer or school, the policy is there on purpose. Send the administrator the program's name and this error number.

    To undo: Nothing to undo.

  2. Run the setup as administrator

    Right-click the setup and choose Run as administrator. Microsoft documents that with DisableMSI set to 1, non-elevated per-user installations are blocked but elevated and per-machine installs are allowed.

    To undo: Uninstall the program from Settings if you did not want it after all.

  3. On your own PC, set DisableMSI back to 0

    Only if the first check below shows DisableMSI with the value 1 or 2 and nobody manages this PC. In an administrator Command Prompt, export the key with reg export "HKLM\Software\Policies\Microsoft\Windows\Installer" "%USERPROFILE%\Desktop\installer-policy.reg", then run reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v DisableMSI /t REG_DWORD /d 0 /f. Microsoft documents 0 as Windows Installer enabled for all applications.

    To undo: Double-click installer-policy.reg on the Desktop to put back the values you exported.

Check it yourself, without changing anything

  1. Read the Windows Installer policies (Command Prompt)

    An error saying the key was not found means no Windows Installer policy is set. Otherwise look for DisableMSI and its value. Nothing is changed.

    reg query "HKLM\Software\Policies\Microsoft\Windows\Installer"
    cmd

  2. Find the message in the Application log (PowerShell)

    Microsoft documents 1007 and 1008 as the events for an installation refused by software restriction policy. Nothing is changed.

    Get-WinEvent -FilterHashtable @{ LogName='Application'; ProviderName='MsiInstaller'; Id=1007,1008 } -MaxEvents 5 |
  Format-List TimeCreated, Message
    PowerShell

What PC Tweaker Uninstaller does with Error 1625

Shows the exit code

PC Tweaker Uninstaller removes a Windows Installer program with the command it shows you first in the Removal Brief, msiexec.exe /x {ProductCode} /qn /norestart, after asking Windows for a restore point when the removal needs administrator rights. If a policy refuses it, the report shows the exit code msiexec.exe returned. The Uninstaller does not read, change or work around policies: on a managed PC the administrator decides what can be installed or removed.

PC Tweaker Uninstaller: see the exact command before a removal runs

Common questions

Why does error 1625 appear on my own PC, with no administrator?

A policy value can be present on a PC nobody manages. Read the key shown on this page: if DisableMSI is there with the value 1 or 2, that is the policy Microsoft documents as disabling Windows Installer.

Does running as administrator get past error 1625?

Only in one documented case: with DisableMSI set to 1, Microsoft says non-elevated per-user installations are blocked while elevated and per-machine installs are allowed. With the value 2 no installs are allowed.

Is it safe to change the DisableMSI policy?

On your own PC, with the key exported first, it is a single value you can put back. On a PC managed by an organisation, leave it to the administrator: the policy is intentional.