You double-click an installer for something boring — a printer driver, an old version of QuickBooks, a vendor's VPN client — and it throws CO_E_MSI_ERROR (0x80004023): "A Microsoft Software Installer error was encountered." No progress bar, no log, just that box. I see this most often on machines where a previous install was force-killed (Task Manager, or a hard power-off mid-install) or where some "registry cleaner" from 2013 was allowed to run loose. It's also common right after a Windows feature update drops, when the Windows Installer registration gets half-migrated.
What's actually broken
The Windows Installer service (msiexec.exe) is registered in a handful of places: COM classes under HKCR\CLSID, the LocalServer32 entry pointing to msiexec.exe, and the MSI service entry under HKLM\SYSTEM\CurrentControlSet\Services\msiserver. When one of those pointers goes stale, msiexec can't create the COM object it needs to do its job, and you get 0x80004023 — which is literally CO_E_MSI_ERROR, "the COM object could not be created because the MSI service failed." It's not a disk problem, it's not a permissions problem in the obvious sense. It's registration rot.
Second most common cause: the local MSI database in C:\Windows\Installer has a stale or corrupt entry for the product you're trying to install. That's a different failure that produces the same code, and the fix is different.
The fix
Do these in order. Don't skip #1 — it fixes the error more than half the time and takes 30 seconds.
1. Re-register msiexec
Open an elevated Command Prompt (Start, type cmd, right-click, Run as administrator). Run these two commands:
msiexec /unregserver
msiexec /regserverThe first one silently unregisters the COM classes; the second rebuilds them. No confirmation message either way — that's normal. Don't panic if it looks like nothing happened. Try your installer again right after. If it still fails, move on.
2. Check the Windows Installer service isn't disabled
Hit Win+R, type services.msc, find Windows Installer. It should be set to Manual with status Stopped when idle — that's correct. If it's Disabled, set it to Manual, click Start, then retry. I've had clients' "IT guy" disable it years ago as a security measure and forget. Everything MSI-related broke and nobody connected the dots.
3. Rebuild the Installer cache entry
If the failure is on a specific product install, the cached MSI is probably bad. Uninstall the product as best you can (Settings, Apps, find it, Uninstall — even if it errors out, let it run). Then run the Microsoft Program Install and Uninstall troubleshooter — yes, it's old, but it's the one tool from Microsoft that actually cleans up orphaned MSI registrations.
Pick "Uninstalling" when asked, choose the product from the list, let it rip. Then pick "Installing" and point it at your installer file. This rebuilds the local database entry. It's the closest thing to a magic bullet for this specific error.
4. Reinstall the Windows Installer itself
Only do this if steps 1–3 all failed. On Windows 10/11, the installer is baked in, so you can't download the old MSI for it anymore. You re-register it via DISM:
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannowRun DISM first, then SFC. Both need elevation. This pulls fresh copies of the system files including msiexec.exe and its supporting DLLs from Windows Update. Reboot after.
5. Nuke the stale entry with the MSI cleanup utility if you're desperate
Microsoft removed msizap.exe from public circulation years ago because people kept destroying their machines with it. The community replacement is MSICUU2 alternatives like Windows Installer CleanUp Utility clones — but be careful, these can leave a program half-installed and unrepairable. Only use this if the product is broken beyond repair and you need the registry entry gone so you can reinstall from scratch. Back up the registry first (reg export HKLM\SOFTWARE\Classes\Installer backup.reg).
If it still fails
- Check the log. Run the installer with logging:
msiexec /i "C:\path\to\your.msi" /l*v C:\temp\install.log. Open the log, search for0x80004023and read the 20 lines before it. The real cause is always right there. - Pending reboot. Sometimes an OS update or a prior failed install left a pending rename op. Reboot, then retry. Sounds dumb, works more often than it should.
- Antivirus interference. Corporate AV (looking at you, older Kaspersky and SentinelOne builds) can block msiexec from writing to
C:\Windows\Installer. Temporarily disable real-time protection and retry. - User profile trouble. Log in as a fresh local admin account and try the install there. If it works, your user profile has a broken MSI cache under
%LOCALAPPDATA%\Microsoft\Windows\Installer. Delete the contents of that folder and retry as your normal account. - Run as SYSTEM. For stubborn cases, use
psexec -s -i msiexec /i "C:\path\to\your.msi"from Sysinternals. If SYSTEM can install it and your admin account can't, the problem is in your account's security context, not the installer service.
One thing I'll say flat out: don't waste time running the Windows Update troubleshooter for this. It has nothing to do with Windows Update and it'll just make you wait 10 minutes for a shrug. Stick to the msiexec re-register and the Program Install troubleshooter — those two solve it in almost every case I've touched.