Error Codes Details for Windows Patch Failure

Apart from the patch-specific failure reasons, the patch deployment can fail due to OS issues or a vendor patch issue.

The following are the vendor patch and OS patch failure issues:

HTTP Status: Issues related to the internet. For more information, see Response Status Codes.
OS Status: Issues related to the OS. For more information about Windows-specific error codes, see Debug system error codes.
Exit Code: Issues related to vendor-specific software. To find more information about the issues related to the vendor-specific software, visit the vendor site.

Table 1: Exit codes and possible root cause for the Windows patch failure

See the following table that shows the exit codes, the possible root cause for the Windows patch failure, and possible solutions to fix the issue. To know how to view the exit code details, refer to Viewing Patch Failure Error Code Details.

Exit Code & Vendor	Abstract	Possible Root Cause	Possible Solution
3010 Microsoft	The patch installation is successful, and the changes will be effective only after the asset is rebooted.	The agent machine is still in the pending reboot state.	The issue will be resolved after rebooting the endpoint.
112 All	The required disk space is not available on the agent machine.	The disk space is full.	The issue will be resolved after you free up the disk space of the targeted asset.
1603 Adobe	This is a generic error that is specific to the asset.	The 1603 MSI error code indicates a generic failure, but it's asset specific.	Refer to the following link for the suggested solution: https://helpx.adobe.com/in/creative-suite/kb/error-1603-install-cs3-cs4.html
1603 Microsoft	While installing the MS Office updates that utilize the Click-to-Run technology for some versions, such as some Office 2016, all Office 2019, and later, or Office365/Microsoft 365, OfficeC2RClient.exe must be utilized to trigger the update. This is handled by the \"noop.exe\" process, which calls the OfficeC2RClient.exe process with various switches. In some cases, if this process doesn't execute successfully, the security controls return the 1603 error.	The 1603 error indicates that the noop.exe application does not have the rights to run the OfficeClickToRun.exe or OfficeC2RClient.exe executable. Security Controls use \"noop.exe\" to deploy the OfficeClickToRun.exe or OfficeC2RClient.exe with switches that enable the Office update process to complete.	The issue will be resolved after downloading the GPO settings required for the Office Customization tool. You can download the GPO settings from https://www.microsoft.com/en-us/download/details.aspx?id=49030. Also, \"Management of Microsoft 365 Apps for enterprise\" needs to be set to "Enabled".
1642 Microsoft, Splunk, and VMware	The Windows Installer service couldn't install the upgrade patch because either the program to be upgraded might be missing or the upgrade patch might update a different version of the program.	The version of the program targeted in the patch differs from the one on the agent machine. It might happen when an upgrade in the application is done in any other way before the actual patch installation.	The issue will be resolved by selecting the correct patch that supports the application version on the endpoint. But if the targeted application is already updated, you can ignore this message.
17044 Microsoft	This error is encountered on failed patch deployments for Microsoft Office in the "Security Controls" or "Patch for Windows" console.	This issue is caused by a corrupt Microsoft Office installation or missing installation files that cause the patch installation to fail.	currently, the issue will be resolved by the following two methods: - Run the Microsoft Office installer you used to install the package & use the same to repair the installation. As a result, the missing files will be replaced. - Completely uninstall or reinstall Microsoft Office using the following Microsoft Uninstall Support tool to ensure that any old files or registry items are removed during the uninstall. https://support.microsoft.com/en-us/office/uninstall-office-from-a-pc-9dd49b83-264a-477a-8fcc-2fdf5dbf61d8?ui=en-us&rs=en-us&ad=us

Table 2: OS codes and possible root cause for the Windows patch failure

See the following table that shows the OS codes, the possible root cause for the Windows patch failure, and possible solutions to fix the issue. To know how to view the exit code details, refer to Viewing Patch Failure Error Code Details.

OS Code & Vendor	Abstract	Possible Root Cause	Possible Solution
59 Windows	Network Connectivity or Proxy issue	There is an issue with network connectivity or proxy configuration.	Verify agent communication for network connectivity. While using Proxy, verify the correctness of agent proxy settings using "QualysProxy.exe /c".
4317 Windows	Unspecified error during execution	An unspecified error, such as out of memory or outdated certification, occurred during the execution of the agent that caused patch deployment failure.	In case of an Outdated Certificate issue, refer to https://success.qualys.com/support/s/article/000007218.
12002 Windows	Request timed out	The request is timed out while connecting to the server.	Refer to https://success.qualys.com/support/s/article/000002845 to fix the issue.
12152 Windows	The server response cannot be parsed	The response is not parsed because the response from the server is invalid.	Validate the patch download URL. If the issue persists, contact Support.
12175 Windows	An issue with the SSL Certificate	One or more errors are found in the server's Secure Sockets Layer (SSL) certificate.	Refer to https://success.qualys.com/support/s/article/000002857 to fix the issue.
12007 Windows	The server name could not be resolved.	This WinHTTP error causes the agent to connect to the cloud endpoint using a fallback (or backup) URI that has been previously determined and stamped into the cloud agent. This is typically the same URI that the Agent used when it was first installed on the client.	Check internet connectivity on the asset endpoint.

Table 3: HTTP codes and possible root cause for the Windows patch failure

See the following table that shows the HTTP codes, the possible root cause for the Windows patch failure, and possible solutions to fix the issue. To know how to view the exit code details, refer to Viewing Patch Failure Error Code Details.

HTTP Code & Vendor	Abstract	Possible Root Cause	Possible Solution
307 All	Temporary Redirect	The resource requested is temporarily moved to the URL given by the Location headers.	Validate the patch download URL. If the issue persists, contact Support.
401 All	Unauthorized	The client request is incomplete because of invalid authentication credentials for the requested resource.	Validate the authentication. If the issue persists, contact Support.
403 All	Forbidden	The server refused the authorization request.	Validate the patch download URL. If the issue persists, contact Support.
404 All	Not Found	The server does not find the requested resource.	Validate the patch download URL. If the issue persists, contact Support.
407 All	Proxy Authentication Required	The request is not applied because of invalid authentication credentials for a proxy server between the browser and the server that accesses the requested resource.	Validate the authorization. If the issue persists, contact Support.
500 All	Internal Server Error	The request is not fulfilled because of an unexpected error encountered by the server.	Validate the patch download URL. If the issue persists, contact Support.
502 All	Bad Gateway	While the server acted as a gateway or proxy, it received an invalid response from the upstream server.	Validate the patch download URL. If the issue persists, contact Support.
503 All	Service Unavailable	The server is not ready to handle the request.	Validate the patch download URL. If the issue persists, contact Support.
504 All	Gateway Timeout	While the server acted as a gateway or proxy, it did not get an in-time response from the upstream server.	Validate the patch download URL. If the issue persists, contact Support.

HTTP Code & Vendor

Abstract

Possible Root Cause

Possible Solution

307

All

Temporary Redirect

The resource requested is temporarily moved to the URL given by the Location headers.

Validate the patch download URL. If the issue persists, contact Support.

401

All

Unauthorized

The client request is incomplete because of invalid authentication credentials for the requested resource.

Validate the authentication. If the issue persists, contact Support.

403

All

Forbidden

The server refused the authorization request.

Validate the patch download URL. If the issue persists, contact Support.

404

All

Not Found

The server does not find the requested resource.

Validate the patch download URL. If the issue persists, contact Support.

407

All

Proxy Authentication Required

The request is not applied because of invalid authentication credentials for a proxy server between the browser and the server that accesses the requested resource.

Validate the authorization. If the issue persists, contact Support.

500

All

Internal Server Error

The request is not fulfilled because of an unexpected error encountered by the server.

Validate the patch download URL. If the issue persists, contact Support.

502

All

Bad Gateway

While the server acted as a gateway or proxy, it received an invalid response from the upstream server.

Validate the patch download URL. If the issue persists, contact Support.

503

All

Service Unavailable

The server is not ready to handle the request.

Validate the patch download URL. If the issue persists, contact Support.

504

All

Gateway Timeout

While the server acted as a gateway or proxy, it did not get an in-time response from the upstream server.

Validate the patch download URL. If the issue persists, contact Support.