A Package Deployment with Four Different Failure Modes
You deploy a package to install a required agent on 6,000 Windows endpoints. The package downloads a 45 MB MSI and runs msiexec /i with a 10-minute timeout. The action targets a computer group that includes 800 laptops last seen more than 30 days ago. The action group requires approval, which was granted at 14:00; the action expires at 18:00. At 16:00 the action status shows 4,100 completed, 300 failed, 1,100 pending, and 500 expired. Most failures are on Windows 7 clients with exit code 1603; a few are on servers with file download failed.
1. Interpret the four status counts. Which ones indicate a package problem and which indicate a targeting or timing problem?
Read the worked answer
Completed 4,100 is straightforward. Failed 300 is a package or endpoint problem: exit code 1603 is a generic MSI fatal error, so you need the MSI log to find the real cause; file download failed points to distribution, proxy, disk, or network. Pending 1,100 is not a package failure; those endpoints have not returned a result, often because they are offline or have not checked in. Expired 500 means the action's 18:00 deadline passed before those endpoints ran it; the 800 stale laptops in the target group are a likely contributor. So separate availability/timing (pending, expired) from execution (failed) before retrying anything.
2. How would you triage the 300 failures so you do not just re-run the same deployment?
Read the worked answer
Group failures by OS, client version, last-seen date, exit code, free disk space, and whether the MSI file was present. Pull MSI logs for a sample of 1603s; common causes include pending reboot, insufficient privileges, another installer in progress, missing prerequisites, or a previous version. For download failures, check file distribution and hash, proxy, bandwidth, and disk. Compare a failed endpoint with a completed endpoint of the same OS. Fix the root cause or split the package by OS; do not blindly retry all 300.
3. Redesign the deployment for the remaining endpoints.
Read the worked answer
Pilot on 100-200 representative endpoints, including Windows 7 if it must be supported. Exclude endpoints not seen in 14 days or handle them with a separate long-lived action. Extend expiration or use a deployment that persists for offline clients. Throttle the action to protect bandwidth, split by OS, and pre-stage the MSI where possible. Increase timeout only after checking why 10 minutes was insufficient. Capture logs in the package command and report exit codes. Confirm approval before the window and monitor pending vs failed separately.