---
title: Windows MSI installation fails with error 1603
source: https://docs.newrelic.com/docs/infrastructure/infrastructure-troubleshooting/troubleshoot-infrastructure/windows-msi-install-fails-error-1603
---

> #### ⚠️ IMPORTANT
>
> **Known Issue for infrastructure agent v1.73.0 and above:** Silent MSI installation (`/qn`) will fail with error **1603** if mandatory configuration parameters are missing, or on systems with strict Windows Group Policy restrictions.

## Problem [#problem]

-   Installation worked with v1.72.x but fails with v1.73.0 or newer
-   MSI silent installation exits with Error **1603**
-   Occurs on hardened or CIS-compliant Windows systems
-   Service `newrelic-infra` is not created

## Cause [#cause]

From version v1.73.0 onwards, the Windows MSI installer uses deferred PowerShell custom actions to automatically validate and generate the agent's configuration file during the installation phase.

This error is typically triggered by one of the following two causes:

-   **Missing mandatory installation parameters (most common):**
    When using the `/qn` (silent) switch, the installer's custom action script will immediately fail and rollback the installation (Error 1603) if you do not explicitly pass `GENERATE_CONFIG=true` and `LICENSE_KEY=YOUR_LICENSE_KEY` as command-line arguments.
-   **Windows group policy restrictions:**
    On hardened or CIS-compliant Windows systems, the group policy setting `HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableMSI` (when set to `1` or `2`) blocks these deferred PowerShell custom actions from executing, resulting in a 1603 error.

## Solution [#solution]

### Step 1: Ensure mandatory parameters are passed (primary solution)

If you are performing a silent installation, you **must** provide the mandatory configuration parameters directly in the `msiexec.exe` command line.

Ensure you are executing the installation using the following parameter-inclusive syntax:

```powershell
msiexec.exe /qn /i PATH\TO\newrelic-infra.msi GENERATE_CONFIG=true LICENSE_KEY=YOUR_LICENSE_KEY
```

> #### 💡 NOTE
>
> The installer requires these parameters to successfully complete the silent installation loop. If you wish to manage or overwrite the `newrelic-infra.yml` file post-install via external configuration management tools, you still need to pass these parameters to allow the MSI to complete successfully.

### Step 2: Temporarily disable MSI restriction (for hardened systems)

If the installation still fails with Error 1603 even after passing the mandatory parameters in Step 1, your OS security policy is likely blocking the installer's custom actions.

Run the following script to temporarily disable the DisableMSI restriction during installation and restore it immediately afterward:

```powershell
# Store original value
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer"
$origValue = (Get-ItemProperty -Path $regPath -Name DisableMSI -ErrorAction SilentlyContinue).DisableMSI

try {
    # Temporarily allow MSI custom actions
    if (-not (Test-Path $regPath)) { 
        New-Item -Path $regPath -Force | Out-Null 
    }
    Set-ItemProperty -Path $regPath -Name DisableMSI -Value 0 -Type DWord -Force
    
    # Run the installation with mandatory parameters
    msiexec.exe /qn /i PATH\TO\newrelic-infra.msi GENERATE_CONFIG=true LICENSE_KEY=YOUR_LICENSE_KEY
    
} finally {
    # Restore original value
    if ($null -ne $origValue) {
        Set-ItemProperty -Path $regPath -Name DisableMSI -Value $origValue -Type DWord -Force
    } else {
        Remove-ItemProperty -Path $regPath -Name DisableMSI -ErrorAction SilentlyContinue
    }
}
```

You can use this PowerShell script to pre-check if the DisableMSI policy exists and is likely to cause issues:

```powershell
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer"
$disableMsi = (Get-ItemProperty -Path $regPath -Name DisableMSI -ErrorAction SilentlyContinue).DisableMSI

if ($null -eq $disableMsi -or $disableMsi -eq 0) {
    Write-Host "DisableMSI not set or set to 0 - Installation should work if mandatory parameters are supplied."
} else {
    Write-Host "WARNING: DisableMSI is set to $disableMsi - Installation will likely fail with error 1603 due to OS security policy."
    Write-Host "Use the Step 2 workaround script above to install successfully."
}
```