Software change returned error code 0x87D00607 (-2016410105)

The application installation error code 0x87D00607 means that the content is not found by SCCM/client computer and the reason for that can be numerous like improper configuration of boundaries or boundary groups, pre-staged content, blockage from the firewall, etc.

The issue arises when a user tries to deploy a package or application through Microsoft System Center Configuration Manager (SCCM) but encounters the following message:

The software change returned error code 0x87D00607(-2016410105)

You can fix the error code 0x87d00607 by trying the solutions below but before diving into more technical solutions, check if rebooting your primary SCCM server sorts out the issue.

Moreover, make sure the date and time are correct on the server and client machines. Furthermore, make sure all updates or hotfixes for SCCM are applied to your machine.

Additionally, check if all the affected users are present in the SourceContentLib directory. If not, add the users to the mentioned library and check if the issue is resolved.

If the package or application, you are trying to install (or uninstall), has an official installer/uninstaller (like Adobe CC Uninstaller), check if using that official installer/uninstaller solves the problem.

Also, do not forget to check if the package or application has any dependencies, if so, then make sure those dependencies are included in the source files of the package or application.

If you are trying to install an updated version of an application (e.g., MS Office) that is already installed on the client machine, then check if uninstalling the older version of the application lets you install the newer version without any issue.

1. Change the Default Browser of the Client Machine

The application or package might show the error code 0x87d00607 if the default browser of your client machine is not set to Edge or Internet Explorer (due to different OS dependencies in a corporate networking environment). In this case, setting the default browser of the client machine (or machines) to Internet Explorer or Edge may solve the problem. Before proceeding, check if you are using a metered connection (e.g., a notebook with a SIM card), then allowing the same in the Default Client Settings of SCCM may solve the problem.

1. Click Windows, type: Default Apps, and then open Default Apps.

   

2. Now click the option under Web Browser (e.g., Google Chrome) and choose Internet Explorer.

   

3. Then reboot your client machine and upon reboot, check if it is clear of the error code 0x87d00607.

If at step 2, the default browser is already set to Internet Explorer, set it as Microsoft Edge and reboot your machine to check if the error 0x87d00607 is cleared out.

2. Add the SMS_DP Path in the IIS Settings

SMS_DP hosts the log files of DP, files to validate content, pre-stage content (if enabled), and is the temporary storage hub of the package/application before its inclusion in the Content Library. You may encounter the error 0x87d00607 if the SMP_DP path is not properly configured in the IIS Settings of DP. In this scenario, adding the path to SMS_DP in the IIS Settings may solve the problem. But before proceeding, make sure to remove NAP (Network Access Protection), as it has been deprecated by Microsoft in Windows Server 2012 R2, and if you are still using it, then uninstalling it may solve the problem.

1. Log on to the DP server and navigate to its IIS settings.
2. Now select the server and open ISAPI and CGI Restrictions.

   

3. Then check if an entry for SMS_DP is present there. If not, then add a new entry with the following path:

   C:\Windows\system32\inetsrv\smsfileisapi.dll

4. Now apply your changes and check if the error 0x87d00607 is cleared.

3. Use HTTP to the Client Connections

The error code can be caused by the improper configuration of the client connections protocol; the clients are required to connect to the server by using HTTPS protocol. In this scenario, setting the client connections to use HTTP protocol may solve the problem.

1. Open the SCCM and in the left pane, expand Site Configuration.
2. Now select Servers and Site System Rules and in the right pane, open Management Point (in the Site System Roles section).
3. Then select HTTP and apply your changes.

   

4. Wait for at least 5 minutes and check if the error 0x87d00607 is resolved.

If that did not do the trick, check if the DNS server of your organization is functioning properly.

4. Unblock the Source Files of the Package/Application

You may encounter the error code 0X87d00607 2016410105 if the OS of your device does not trust some of the source files and blocks their execution. In this context, unblocking the source files might solve the problem.

1. Navigate to the directory of the source files of your package/application, right-click on any of the files, and select Properties.
2. Then check if an unblock option is available (either checkbox or button), if so, then click on it to Unblock the file.

   

3. Now repeat the same to unblock all the source files and check if the system is clear of the error code 0X87d00607 2016410105.

This method might work for some files, but for a large number of files, you may use the SysInternels Streams to unblock all files. If that did not work, then check if removing the package/application from the SCCM server, creating a new directory on the SCCM server, and copying the package/application source files to that directory solves the issue.

5. Change the Deployment Options of the Package/Application

You may encounter the error code 0x87d00607 if the Deployment Options of the package/application are not configured to run locally. In this case, setting the Deployment Options to download content and run locally may solve the problem.

1. Open the Properties of your package/application in SCCM and head to the Content tab.
2. Now expand the dropdown of the Deployment Options and select Download Content from Distribution Point and Run Locally.

   

3. Then apply your changes and check (at least after 5 minutes) that the software change returned error is cleared.

6. Disable the Pre-staged Content of the Distribution Point

You may encounter the error code 0X87d00607 in SCCM if you have configured the distribution point to only use the pre-staged content (which will only accept content manually copied to it). In this scenario, disabling the pre-staged content for the distribution point may solve the problem.

1. Open SCCM and open the Properties of the Distribution Point.
2. Now remove the checkmark of Enable This Distribution Point for Prestaged Content and apply your changes.

   

3. Then wait for 5 minutes and check if the error code 0x87d00607 is cleared.

7. Enable Fallback Location for Content

If the client machine cannot access a preferred distribution point, then enabling the fallback location for the content may enable the machine to fetch the same from another source and thus solve the error at hand.

1. Open the Properties of your package/application and head to its Content tab.
2. Now, checkmark the option of Allow Clients to Use a Fallback Source Location for Content and make sure the Deployment Options dropdown is set to Download Content from the Distribution Point and Run Locally.

   

3. Then apply your changes and check (at least after 5 minutes) if the error code 0X87d00607 2016410105 is cleared.

8. Allow the Users’ Machines to Use Distribution Points

If your organization is using SCCM’s Distribution Points to distribute the packages/applications, then allowing the clients’ machines to use the distribution points from the default site boundary group may clear the 0x87d00607 error. But before proceeding, check if setting the maintenance window of the deployed software to collection solves the issue.

1. Steer to your package/application in the SCCM and open package/application’s Properties.
2. Now head to the Content tab and checkmark the option of Allow Clients to Use Distribution Points from the Default Site Boundary Group.

   

3. Then apply your changes and check if SCCM’s error 0X87d00607 is cleared.

If that did not do the trick, check if allowing the client machines to download from a cloud source/distribution point solves the problem. If that did not work, you may check if the DP server is not corrupt or is missing from the group of DP servers.

9. Edit Boundaries and Boundary Group in SCCM

The error code 0x87d00607 in SCCM may emerge if the boundaries and boundary group are not properly configured or the IP of the client’s machine is not added to them. In this context, editing the boundaries and boundary groups may solve the problem.

1. Launch the SCCM and navigate to the following path:

   Administration>>Overview>>Hierarchy Configuration>>Boundary Groups

2. Now head to the Reference tab of the Boundary Group and checkmark Use This Boundary Group for Site Assignment (under Site Assignment).
3. Then add the server to the boundary group and apply your changes to check if the SCCM issue is resolved.

   

4. If not, make sure boundary groups are enabled in the properties of the Distribution Point and check if the IPs (make sure no IP address is typed wrongly) of the client machine are included in the boundary group.
5. Keep in mind that adding IPs like 10.22.8.0 to 10.22.9.10 will not add 10.22.9.0 in the boundary group (although, it works in the networking world), so, add the IPs accordingly.
6. Also, check if using the IPv6 IP range of the client machines in the boundary groups sorts the issue.

10. Allow the SCCM Required Ports in the Firewall of the Client Machine

The SCCM might show the error code 0x87d00607 if the SCCM’s required ports are blocked by the firewall on the client machine. In this case, allowing the SCCM’s required ports on the client machine may solve the problem. You may check the SCCM’s required ports as per the protocol from the official Microsoft source and add the required port to the firewall of your client machine. For illustration, we will discuss the process for opening the port of Global catalog LDAP to the Windows Defender Firewall. But before proceeding, check if the ports of the webserver of SCCM are not in conflict with another service (especially, port 80).

Warning: Advance with utmost care and at your own risk as editing the firewall settings is a skillful task and if not done properly, you may cause unintended and everlasting damage to your data/system.

1. Click Windows, type: Windows Defender Firewall, and open it.

   

2. Now, in the left pane, select Outbound Rules, and in the Action pane, click on New Rule.

   

3. Then select Port as the Rule Type and select the radio button of TCP.

   

4. Now enter 3268 in the Specific Remote Ports box.

   

5. Then click on Next and select the radio button of Allow the Connection.

   

6. Now select all the three types of networks (i.e., Domain, Private, and Public) and click on Next.
7. Then name the rule as per your requirement and click Finish.
8. Now try again to check if SCCM is clear of the error 0x87d00607.

If that issue persists, check if the firewall of your VPN or router is not causing the issue. If the issue is still there, check if re-adding the client machine to the domain solves the problem. If that did not do the trick, then you may use ContentLibraryCleanup.exe in the delete mode against your SCCM server and check if that solves the issue at hand. If the issue persists, then you may reinstall IIS (with BITS and ASP.Net) or SCCM (with IIS). If none of the solutions did the trick for you, then you may share the package/application with users (till the problem is reported to be solved).