Win32 app errors in Intune: 0x87D30065 downloads, exit code 1603 and Delivery Optimization

A Win32 app passes through more stages than any other Intune app type: the Intune Management Extension (IME) fetches content details, downloads the encrypted package, checks and unpacks it, runs your command, maps the exit code and runs detection. Each stage fails differently. In this post I'll show how to find the stage that failed, then fix download-side errors such as 0x87D30065 and installer failures such as exit codes 1603 and 1618.

Symptoms#

• The app's device install status shows Failed with the first message below (wording as reported by admins on Microsoft Q&A).
• The Company Portal shows the app downloading or pending for hours.
• AppWorkload.log shows the install command ran and returned 1603 or 1618.
• The app installs when an admin tests it, but fails for users.

Failed to retrieve content information. (0x87D30065)
1603 Fatal error during installation.
1618 Another installation is already in progress.

In the portal, a failing exit code often appears as an HRESULT: 1603 becomes 0x80070643, because 0x643 is 1603 in hex.

Why it happens#

Microsoft's Win32 app documentation doesn't give a specific cause for 0x87D30065, so its wording is the best clue: the extension never got the content details it needed, and nothing was installed. Look at connectivity, the IME, and the app's uploaded content.

How to fix it#

1. Find the failing stage#

Open the app in the Microsoft Intune admin center and copy its ID from the browser address bar. You can also use Collect logs in the app's installation details. On the device, pull the lines for that app from AppWorkload.log:

$appId = '<app-id-guid>'
Select-String -Path "$env:ProgramData\Microsoft\IntuneManagementExtension\Logs\AppWorkload*.log" -Pattern $appId |
    Select-Object -Last 40 | ForEach-Object { $_.Line }

The last stage that logged success tells you where to look. For a full tour of the logs, see Reading Intune Management Extension logs.

2. Content details and download failures#

• Allow the Intune service and Win32 content endpoints from Microsoft's Intune network endpoint list, and bypass TLS inspection and proxy authentication for them. Compare with a device on a different network.
• Restart the extension to force a fresh check-in: Restart-Service IntuneManagementExtension.
• If one app fails everywhere while other Win32 apps work, suspect the app's content. Replace the package file in the app's App information properties, repackaged with the latest Win32 Content Prep Tool.

3. Check Delivery Optimization#

Win32 content downloads through Delivery Optimization. In each assignment, App settings › Delivery optimization priority chooses background or foreground download; use foreground for required apps users are waiting on. On the device:

Get-DeliveryOptimizationStatus |
    Format-Table FileId, Status, Priority, FileSize, BytesFromHttp, BytesFromPeers -AutoSize
# Run elevated: reading the DoSvc logs needs administrator rights
Get-DeliveryOptimizationLog | Select-Object -Last 30 TimeCreated, Message

Priority shows whether the job runs in the foreground or background. If peers are unavailable, Delivery Optimization downloads from the cloud over HTTP. Blocking TCP 7680, the port the service listens on for peers, only removes peering. A download that never progresses usually means the HTTP path itself is blocked or inspected.

4. Rule out antivirus and disk space#

Microsoft recommends excluding these folders from antimalware scanning on x64 devices: C:\Program Files (x86)\Microsoft Intune Management Extension\Content and C:\Windows\IMECache. The package is downloaded and then extracted, so add a Disk space required (MB) requirement rule for large apps. Windows apps are capped at 30 GB.

5. Fix installer exit codes#

New Win32 apps get these default return codes:

Anything else counts as a failure.

• 1603 is Windows Installer's generic failure, so get the real reason from a verbose log: msiexec /i "App.msi" /qn /l*v "C:\Windows\Temp\App-install.log", then search for Return value 3. Reproduce as SYSTEM with Sysinternals PsExec (psexec.exe -s -i cmd.exe) from the extracted content. Typical causes are missing prerequisites, a newer version already installed, or a pending restart. An app set to User install behavior runs with the user's rights, so it can work for admins and fail for standard users; install it as System if it needs admin rights.
• 1618 means another Windows Installer session was running. Keep it as Retry; if it persists, look for a stuck msiexec or another app installing at the same time.
• Vendor codes: add documented success or reboot codes from EXE installers to the return code list.
• Timeouts: Installation time required defaults to 60 minutes (max 1,440). Intune doesn't support interactive installs, so a prompt waiting for input ends in a timeout.
• PowerShell: powershell.exe in the install command starts 32-bit; use %SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe for 64-bit.

Verify the fix#

• Restart the IME service to trigger a check-in. A failed required app may wait for the next reevaluation, which Microsoft describes as a 24-hour cadence, so an Available install from the Company Portal gives quicker feedback.
• AppWorkload.log shows the download completing, the exit code (0 or 3010), and detection reporting the app as installed.
• The app's device install status changes to Installed. If it installs but reports 0x87D1041C, follow the detection guide.

Prevent it next time#

• Test install and uninstall commands as SYSTEM before uploading; see packaging a Win32 app for Intune.
• Keep 1618 as Retry and add vendor exit codes up front.
• Agree proxy, TLS inspection and antivirus exclusions with the network and security teams before a large rollout.
• Chain prerequisites with dependencies and supersedence rather than install scripts.
• More codes: Intune app install error codes quick reference.

References#

• Troubleshoot Win32 app issues (Microsoft Learn)
• Add, assign and monitor a Win32 app in Microsoft Intune (Microsoft Learn)
• Monitor Delivery Optimization (Microsoft Learn)