Windows MSI installation fails with error 1603

重要

Known Issue for infrastructure agent v1.73.0 and above: Silent MSI installation (/qn) will fail with error 1603 if mandatory configuration parameters are missing, or on systems with strict Windows Group Policy restrictions.

Problem

Installation worked with v1.72.x but fails with v1.73.0 or newer
MSI silent installation exits with Error 1603
Occurs on hardened or CIS-compliant Windows systems
Service newrelic-infra is not created

Cause

From version v1.73.0 onwards, the Windows MSI installer uses deferred PowerShell custom actions to automatically validate and generate the agent's configuration file during the installation phase.

This error is typically triggered by one of the following two causes:

Missing mandatory installation parameters (most common): When using the /qn (silent) switch, the installer's custom action script will immediately fail and rollback the installation (Error 1603) if you do not explicitly pass GENERATE_CONFIG=true and LICENSE_KEY=YOUR_LICENSE_KEY as command-line arguments.
Windows group policy restrictions: On hardened or CIS-compliant Windows systems, the group policy setting HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableMSI (when set to 1 or 2) blocks these deferred PowerShell custom actions from executing, resulting in a 1603 error.

Solution

Step 1: Ensure mandatory parameters are passed (primary solution)

If you are performing a silent installation, you must provide the mandatory configuration parameters directly in the msiexec.exe command line.

Ensure you are executing the installation using the following parameter-inclusive syntax:

msiexec.exe /qn /i PATH\TO\newrelic-infra.msi GENERATE_CONFIG=true LICENSE_KEY=YOUR_LICENSE_KEY

Note

The installer requires these parameters to successfully complete the silent installation loop. If you wish to manage or overwrite the newrelic-infra.yml file post-install via external configuration management tools, you still need to pass these parameters to allow the MSI to complete successfully.

Step 2: Temporarily disable MSI restriction (for hardened systems)

If the installation still fails with Error 1603 even after passing the mandatory parameters in Step 1, your OS security policy is likely blocking the installer's custom actions.

Run the following script to temporarily disable the DisableMSI restriction during installation and restore it immediately afterward:

# Store original value
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer"
$origValue = (Get-ItemProperty -Path $regPath -Name DisableMSI -ErrorAction SilentlyContinue).DisableMSI

try {
    # Temporarily allow MSI custom actions
    if (-not (Test-Path $regPath)) { 
        New-Item -Path $regPath -Force | Out-Null 
    }
    Set-ItemProperty -Path $regPath -Name DisableMSI -Value 0 -Type DWord -Force
    
    # Run the installation with mandatory parameters
    msiexec.exe /qn /i PATH\TO\newrelic-infra.msi GENERATE_CONFIG=true LICENSE_KEY=YOUR_LICENSE_KEY
    
} finally {
    # Restore original value
    if ($null -ne $origValue) {
        Set-ItemProperty -Path $regPath -Name DisableMSI -Value $origValue -Type DWord -Force
    } else {
        Remove-ItemProperty -Path $regPath -Name DisableMSI -ErrorAction SilentlyContinue
    }
}

You can use this PowerShell script to pre-check if the DisableMSI policy exists and is likely to cause issues:

$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer"
$disableMsi = (Get-ItemProperty -Path $regPath -Name DisableMSI -ErrorAction SilentlyContinue).DisableMSI

if ($null -eq $disableMsi -or $disableMsi -eq 0) {
    Write-Host "DisableMSI not set or set to 0 - Installation should work if mandatory parameters are supplied."
} else {
    Write-Host "WARNING: DisableMSI is set to $disableMsi - Installation will likely fail with error 1603 due to OS security policy."
    Write-Host "Use the Step 2 workaround script above to install successfully."
}