Knowledge

ERROR_PATCH_PACKAGE_REJECTED - 1643 (0x66B)

The update package is not permitted by software restriction policy.

Updated: Feb 21, 2026

Technical Background

The error code ERROR_PATCH_PACKAGE_REJECTED (1643, 0x66B) indicates that a software update package has been denied by the system due to restrictions imposed by the Software Restriction Policies (SRP). SRPs are part of the Windows security model designed to control application execution based on various criteria such as file paths and digital signatures.

Error Details

When this error occurs, it signifies that the operating system is unable to apply a patch or update because the package does not meet the conditions specified by the SRP. This can happen if the update package originates from an untrusted source or if the package contains files that are restricted based on predefined security policies.

Common Causes

  • Invalid Source: The update package may come from an unauthorized or unverified source, leading to its rejection.
  • File Path Restrictions: If the SRP includes restrictions on file paths, and the update package attempts to modify a protected directory, it will be rejected.
  • Digital Signature Issues: If the update package lacks valid digital signatures required by the SRP, it may not be allowed.

Real-World Context

This error is commonly encountered during patch management processes where administrators configure SRPs to control which updates can be applied. For instance, an organization might use SRPs to block updates from external sources or to ensure that only signed and trusted packages are installed.

Is This Error Critical?

The criticality of this error depends on the nature of the update package. If it is a security patch, failing to apply it could leave the system vulnerable to known exploits. However, if the package is non-critical, the impact might be minimal.

How to Diagnose

To diagnose why an update package was rejected, follow these steps:

  1. Review SRP Settings: Check the current Software Restriction Policy settings using gpresult or by reviewing the Group Policy Editor (gpedit.msc). Ensure that no restrictions are overly broad and blocking legitimate updates.
  2. Validate Package Integrity: Verify that the update package is complete and has valid digital signatures if required by the SRP.
  3. Check File Paths: Confirm that the paths accessed by the update package do not conflict with any SRP rules.

How to Resolve

To resolve this issue, consider the following steps:

  1. Update SRP Settings: Modify the Software Restriction Policy to allow the update package if it is from a trusted source and meets all necessary criteria.
  2. Reinstall Update Package: Ensure that the package is correctly installed and signed before attempting to apply it again.

Developer Notes

Developers should be aware of the SRP settings when creating or distributing software updates, ensuring they comply with the security policies in place. This can help prevent such errors during deployment.

Related Errors

FAQ

Q: Why is my update package being rejected?

A: The update package may be blocked by the Software Restriction Policy. Check SRP settings and ensure the package meets all necessary criteria.

Q: How can I troubleshoot this issue?

A: Review SRP configurations, validate package integrity, and check file paths to identify any conflicts or restrictions.

Summary

The ERROR_PATCH_PACKAGE_REJECTED (1643) error indicates that a software update package has been denied by the Software Restriction Policy. This can occur due to various reasons such as invalid sources, path restrictions, or digital signature issues. Diagnosing and resolving this issue involves reviewing SRP settings and ensuring the update package complies with security policies.