Error 0x80091007 When Installing Windows Updates With SCCM

Jason Barrett Jason Barrett | 14 Sep 2023 | Deployments

Today I saw error code ‘0x80091007’ when installing a windows update that was pushed out via sccm. The error code ‘0x80091007’ can appear when installing an application, windows update or running a task sequence.

The error ‘0x80091007’ is caused because the client is unable to download the package from a SCCM distribution point.  By checking logs on the client we can pin point where the root cause is.

Error 0x80091007 Summary

I first came across the error 0x80091007 when I was checking the previous days “Microsoft Endpoint Protection” deployment.  Usually the deployment has around 3500 compliant installs, but on the day there were only 376. Below is from \Monitoring\Overview\Deployments in the configmgr console.

Error 0x80091007 in sccm deployment

To find out more about the deployment status I clicked on view status, then selected the Error tab and I saw the below errors.

  • Error Code 0x80091007
  • Error Code 0x8007066A
  • Error Code 0x80091007
  • The hash value is not correct
  • The upgrade cannot be installed by the windows installer service because the program to be upgraded may be missing

0x80091007 deployment status

Next I logged on to a client that failed to install the update and I saw error code 0x80091007 & 0x8007066A (-2147023254) in software center.

error 0x8007066A in system center

I have also seen the error 0x80091007 cause a task sequence to fail with the below error showing.

sccm task sequence error 0x80091007

How To Fix Error Code 0x80091007

The error will be caused because there is an issue with one of the packages in the SCCM console.

You will need to check the sccm client logs to find out exactly which package is causing the issue and what the issue is with the package.

Step 1 : Check SCCM Client Logs

First thing we need to do is review the logs on the client (Machine having the issue)

Application Deployment Or Windows Updates Logs

If you are having issues with an application deployment or a windows update you will need to review the following logs

  • C:\Windows\CCM\Logs\CAS.log
  • C:\Windows\CCM\Logs\ClientLocation.log
  • C:\Windows\CCM\Logs\CIDownloader.log
  • C:\Windows\CCM\Logs\DataTransferService.log

In these logs I found the following information which helped me resolve the issue.

  • Hash for file c:\windows\ccmcache\14j\am_delta_48b261ba132fb0c84383f97b4ae6cc54.exe is D18FF58F8794847CFE3A292A3CB4C04, does not match expected 48B261BA132FB0C8407C11725383F97B4AE6CC54
  • Download failed for content 1b3cdd8a-f2df-f6bdec464d9.1 under context System, error 0x80091007
  • Download failed for download request {AD1A822A-234B-41D43095DE22}
  • DTSJob {4C81EC10-6712-4ED0A18012D} created to download from ‘http://configmgr.Local:80/SMS_MP’ to ‘C:\windows\CCM\14j’.
  • UpdateURLWithTransportSettings(): NEW URL – http://download.windowsupdate.com:80/c/msdownload/update/software/defu/2023/09/am_delta_48b261ba132fb0c84383f97b4ae6cc54.exe
  • ReadStringFromFile failed (0x80070002).

Task Sequence Logs

If you are getting the error in a task sequence you need to check the logs which will be in one of the following locations.

  • C:\windows\ccm\logs\Smstslog\smsts.log
  • x:\smstslog\smsts.log
  • c:\_SMSTaskSequence\Logs\Smstslog\smsts.log

Step 2 : Check Download Location

To resolve the error 0x80091007 you need to confirm if the client can access the location where the install files or updates are located, To do this follow these steps on the client that is having the issue.

  1. C:\Windows\CCM\Logs\DataTransferService.log
  2. Look for the following line “UpdateURLWithTransportSettings(): NEW URL – http://download.windowsupdate.com:80/c/msdownload/update/software/defu/2023/09/am_delta_48b261ba132fb0c8407c11725383f97b4ae6cc54.exe”
  3. This will give us the location the client is trying to download the update from.  Now copy the url and paste it in to internet explorer to confirm if you can access or not.

By looking in this log file I found out that the package was trying to be downloaded from download.windowsupdate.com even though that should be a backup download location as the package existed on a local distribution point.

My firewall blocks access to download.windowsupdate.com so the client would never be able to download from that location.  Now we know the location we can apply one of the following fixes.

Disable Downloading From Microsoft Update

If your clients can not access http://download.windowsupdate.com you can either enable the access or remove the option to update via microsoft update in the sccm console.  To do that follow these steps

  1. Open SCCM console
  2. go to \Monitoring\Overview\Deployments
  3. Right click on the required deployment and select properties
  4. Click the “Download Settings” tab
  5. Untick the bottom two boxes as shown in below screenshot

sccm deployment settings

Check Package Is Present On SCCM Distribution Point

We now need to check that the package has been distributed / copied correctly to the sccm distribution point.  To do this we first need to check what distribution point is being used to download the package.  To find this out do the following on the client trying to download the package.

  1. Open the log file C:\Windows\CCM\Logs\DataTransferService.log
  2. Locate the SCCM Distribution point by looking for the line  DTSJob {4C81EC10-6712-4ED0A18012D} created to download from ‘http://configmgr.Local:80/SMS_MP’ to ‘C:\windows\CCM\14j’.
  3. Above you can see the SCCM DP is configmgr.Local

Next we need to check the package status on the sccm distribution point server. Follow the below steps

  1. Log on to the SCCM console
  2. go to
  3. For Applications : \Software Library\Overview\Application Management\Applications\Deployments – Campaign   or
  4. For Windows Updates : \Software Library\Overview\Software Updates\Deployment Packages
  5. Click on Content Status
  6. Click view status
  7. Confirm the sccm distribution point is in the successful tab  (Shown Below)
  8. If the package is showing as successful the first thing we can do is redistribute the package.
  9. Go to \Administration\Overview\Site Configuration\Servers and Site System Roles
  10. Select the required SCCM distribution point
  11. At the bottom under Site system roles right click on Distribution Point > Properties
  12. Click content tab
  13. Select the required package
  14. Click redistribute
  15. Wait until the package has been copied (Repeat steps 1-7 above)
  16. If the above does not work we can use the “Update Content” feature
  17. Go to your application \Software Library\Overview\Application Management\Applications\
  18. At the bottom click on deployment types
  19. Click Update Content at the top

sccm application content status

Redistribute Package On Distribution Point

Sometimes packages just can not be downloaded until they are redistributed on a distribution point, it is usually because the package became corrupt or there was a network outage when the package was being copied.

To redistribute a package on a distribution point follow these steps.

  1. In the SCCM console go to \Monitoring\Overview\Distribution Status\Content Status
  2. Right click on the package and click “View Status”
  3. Find the distribution point you want to redistribute the package to under asset details
  4. Right click on the distribution point and select redistribute

Redistribute Package On Distribution Point

Step 3 : Fixing The Hash Value is Not Correct

To confirm you are having this issue check the following on the client having the issue do the following.

  1. Log on to the client
  2. Open the log file C:\Windows\CCM\Logs\CAS.log
  3. Confirm you can see “Has For File, does not match expected” errors

To fix the error “The Hash Value is Not Correct” we can try the follow things

  • Disable Binary Differential Replication

Disable Binary Differential Replication

Binary differential replication is used only for software updates. To disable binary differential replication follow these steps.

  1. Confirm the client can download the package (Complete Checks in Step 2 in this guide)
  2. In the SCCM console go to \Software Library\Overview\Software Updates\Deployment Packages
  3. Right click on the required package
  4. Untick “Enable binary differential replication”
  5. Click ok
  6. Right click on the required package
  7. Click Update distribution points
  8. Wait a few hours to a day to see results

If this does not fix the issue I recommend that you re-enable this option.

Turn Off Content Validation On Distribution Point

Over the years I have seen content validation causing issues with packages being downloaded.  I recommend to disable this setting and keep it disabled.

To turn off content validation follow these steps

  1. In the Configmgr console go to \Administration\Overview\Site Configuration\Servers and Site System Roles
  2. Left click on the distribution point you want to turn off content validation for
  3. Down the bottom right click on distribution point and select properties
  4. Select “Content Validation” tab
  5. Untick “Validate content on a schedule”
  6. Click Ok
  7. Wait a few hours to a day to see results