How to fix error 0x80070659 in Windows?

Error 0x80070659 is Windows Installer error 1625: "This installation is forbidden by system policy." A policy on the PC blocks .msi packages, so nothing is broken. Run the installer as administrator first, then check the Windows Installer policy.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What error 0x80070659 means in Windows

0x80070659 is a Windows Installer error in the eight digit form that setup programs print. 0x8007 marks a Win32 error wrapped for programs, and 0659 is 1625 in hexadecimal. Microsoft's list of Windows Installer errors names 1625 ERROR_INSTALL_PACKAGE_REJECTED, with the text "This installation is forbidden by system policy. Contact your system administrator."

So the error does not say that the download is bad or that Windows is damaged. Windows Installer, the service that runs .msi packages, checked its policy and refused. The fix is to find which policy and either satisfy it or change it.

Why error 0x80070659 happens, from most to least likely

Every cause is a policy, because that is what 1625 means. The ranking follows Microsoft's description of the DisableMSI policy and where readers of this page meet the code. Each cause points to its fix.

How to fix error 0x80070659 in Windows

Fix 1 takes two minutes and changes nothing, so everybody starts there. Fix 2 is for the Python installer. Fix 3 is for PCs a company or school manages: there, the policy is intended and only IT should change it. Fixes 4 to 6 find and remove the policy on your own PC.

Fix 1. Run the installer as administrator

2 minutesNo riskAlways first, above all when you started the setup with a double-click.

Microsoft writes that with DisableMSI set to 1, "Non-elevated per-user installations are blocked. Per-user elevated and per-machine installs are allowed." A setup started with admin rights is elevated, so the same policy lets it through.

1. Close the failed setup window.
2. Open the folder with the installer, usually Downloads.
3. Right-click the installer (.exe or .msi) and select Run as administrator. On Windows 11, an .msi file may need Show more options first.
4. Select Yes when User Account Control asks. Enter an administrator password if Windows asks for one.
5. If the setup offers Install for all users or a similar choice, select it.
6. Finish the setup.

If Windows hides Run as administrator for an .msi file, start it from an elevated prompt instead. Right-click Start, select Terminal (Admin), and run the line below with your own path. On Windows 10, search for cmd and select Run as administrator.

msiexec /i "%USERPROFILE%\Downloads\setup.msi" /l*v "%TEMP%\msi-install.log"

The /l*v part writes a full log. If the install fails again, that log shows 1625 near the end, which proves the block is a policy and not the package. Steps for elevated programs: How to run a program as administrator or in compatibility mode.

Fix 2. Fix "Error 0x80070659: Failed to install MSI package" in the Python installer

5 minutesNo riskThe Python installer for Windows shows Setup failed with 0x80070659, or its log has "Error 0x80070659: Failed to install MSI package."

The classic Python installer is a bundle of several .msi packages. Install Now installs for your user only and without admin rights, which is exactly what DisableMSI 1 blocks. An install for all users is elevated and allowed.

1. In the Setup failed window, open the log file link and look for 0x80070659 to confirm it is this error. The log sits in your %TEMP% folder.
2. Close the window. Right-click the Python installer and select Run as administrator.
3. Select Customize installation, not Install Now, then Next.
4. Under Advanced Options, tick Install Python for all users. The install folder changes to C:\Program Files\Python3xx.
5. Select Install and confirm the User Account Control prompt.
6. When it finishes, open a new terminal and run python --version to check it.

Fix 3. On a work or school PC, ask IT to allow or deploy the program

5 minutes, then IT's timeNo riskThe PC belongs to a company or school, or Access work or school lists an account.

Organizations set DisableMSI or similar rules on purpose so that only approved software is installed. The message itself says "Contact your system administrator." A local change is overwritten at the next policy refresh, and it may break your company's rules.

1. Open Settings > Accounts > Access work or school.
2. If an account is listed with Connected to a company or school, the PC is managed.
3. Check your company's software portal first. On many PCs it is Company Portal or Software Center in the Start menu.
4. If the program is not there, send IT the program name, its version, the exact message and the code 0x80070659 (error 1625).
5. Do not edit the policy or the registry yourself on a managed PC.

Fix 4. Set "Turn off Windows Installer" to Not Configured in Group Policy

10 minutesLow riskYour own PC with Windows 11 or 10 Pro, Enterprise or Education, and Fix 1 did not help.

Turn off Windows Installer is the Group Policy that writes the DisableMSI value. If it is Enabled, every new install meets the block. Setting it to Not Configured removes the value and Windows Installer works normally again.

1. Press Win + R, type gpedit.msc and select OK. Full steps: Open the Local Group Policy Editor.
2. Go to Computer Configuration > Administrative Templates > Windows Components > Windows Installer.
3. Double-click Turn off Windows Installer and note its current state.
4. Select Not Configured, then OK.
5. Check Prohibit User Installs in the same folder. Set it to Not Configured too if it is Enabled.
6. Right-click Start, select Terminal (Admin) and apply the change.

   gpupdate /force

7. Run the installer again.

Fix 5. Remove the DisableMSI value in the registry

10 minutesRead the warningWindows Home, which has no Group Policy Editor, or a Pro PC where Fix 4 showed nothing.

Microsoft documents the policy at HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer, value DisableMSI. A value of 2 blocks all installs, including repairs and reinstalls. Tweak tools and old management agents can leave it there with no Group Policy to show it.

1. Right-click Start, select Terminal (Admin) and read the value.

   reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer"

2. If you see DisableMSI with 0x1 or 0x2, a policy blocks installs. If the key or value is missing, this is not your cause: go to Fix 6.
3. Export the key as a backup.

   reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" "%USERPROFILE%\Desktop\Installer-policy-backup.reg"

4. Delete the DisableMSI value.

   reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" /v DisableMSI /f

5. Restart with Start > Power > Restart, then run the installer again.

Fix 6. Check Software Restriction Policies for a rule that blocks the package

10 minutesLow riskDisableMSI is not set and the code stays, on Windows Pro, Enterprise or Education.

Software Restriction Policies can also refuse a package that Windows Installer is asked to run. If a rule exists on a home PC, it was set by a tool or by hand, and Windows Installer reports the block as a policy.

1. Press Win + R, type secpol.msc and select OK.
2. Select Software Restriction Policies in the left pane.
3. If the right pane says No Software Restriction Policies Defined, nothing here blocks you. Stop and read the section after the fixes.
4. If rules exist, open Additional Rules and look for a rule that names the installer, its folder or .msi files with the level Disallowed.
5. On your own PC, delete that one rule. Do not create new policies.
6. Restart and run the installer again.

If error 0x80070659 is still there: what to check and send

Error 1625 is always a policy decision, so the question is which policy. A full Windows Installer log names the step where the block happened.

• On a work PC: send the log lines with 1625, the program name and the version to IT. Do not try to bypass the block.
• If DisableMSI comes back: a management agent, a parental control tool or a tweak tool writes it. Remove or reconfigure that tool, then repeat Fix 5.
• It is never hardware: 1625 is a refusal by policy. A disk or memory fault shows other codes.
• A related install error: if a setup stops with a different code, such as an NVIDIA installer error, see our guide to NVIDIA installer error 0xE6000000.

How to keep 0x80070659 from coming back

• Install programs with Run as administrator or choose for all users when a setup offers it.
• Avoid tweak and privacy tools that change policies in bulk. Note what each one changes before you apply it.
• Keep a note of any Group Policy you change, so you can set it back.
• On a work PC, install software from the company portal only.

Frequently asked questions

What is error 0x80070659?

It is Windows Installer error 1625 in the eight digit form that setup programs print. Microsoft names it ERROR_INSTALL_PACKAGE_REJECTED with the text "This installation is forbidden by system policy. Contact your system administrator." It means a policy on the PC, usually DisableMSI, refused to run the .msi package. Nothing is damaged. Run the installer as administrator first, then check the policy with Fix 4 or Fix 5.

What does "this installation is forbidden by system policy" mean?

It is the text of the same error, 0x80070659 or 1625. Windows Installer checked its policies and found one that does not allow this install. Most often the policy blocks installs that run without administrator rights, so the same setup works when you start it with Run as administrator. If even that fails, the policy blocks all installs, and on a work PC only IT should change it.

How do I fix 0x80070659 when installing Python?

Run the Python installer as administrator, select Customize installation and tick Install Python for all users under Advanced Options. The default Install Now installs for your user only without admin rights, which the DisableMSI 1 policy blocks. The log then says "Error 0x80070659: Failed to install MSI package." If you cannot get admin rights, the Microsoft Store version of Python does not use Windows Installer. Fix 2 has the steps.

What does "Error 0x80070659: Failed to install MSI package" in a log mean?

It is the line a setup bundle writes when one of its .msi packages was refused by Windows Installer policy. Python's installer and many other setups that bundle several packages write it to a log in your %TEMP% folder. The line says which package failed, but the reason is always the same policy block. Start the setup with admin rights (Fix 1) and check DisableMSI (Fix 5).

Can I fix 0x80070659 without admin rights?

Usually not. The policy exists to stop installs by standard users, and getting around it is what it is meant to prevent. Ask someone with an administrator account to run the installer for you, or ask IT on a work PC. Some programs are also offered as Microsoft Store apps, which do not use Windows Installer. Whether the Store is allowed depends on the same organization's rules.

Is 0x80070659 a Windows Update error?

Rarely. Windows 10 and 11 cumulative updates do not install as .msi packages, so the Windows Update troubleshooter and resetting the update cache do not touch this code. An update that is delivered as a Windows Installer patch, such as some program updates, is refused with the related code 1643 when policy forbids patches. The policy checks in Fix 4 and Fix 5 apply to both.

Is 0x80070659 caused by a virus?

We know of no Microsoft source that ties it to malware. The code is a policy refusal. A policy you did not set can come from a tweak tool, an old management agent or a parental control program. If you find a DisableMSI value you cannot explain, remove it with Fix 5, and run a scan with Microsoft Defender to be sure: How to scan for malware with Microsoft Defender.

Does error 0x80070659 happen on Windows 11 and Windows 10?

Yes, on both, in every edition. The DisableMSI policy and its registry location are the same on Windows 11 25H2 and 26H2 and on Windows 10 22H2. Windows 10 left support on 14 October 2025, but the fixes work the same. The only difference is the edition: Windows Home has no Group Policy Editor, so use the registry steps in Fix 5.

I see this page in a search in another language. Does it help?

Yes, if your screen shows 0x80070659. The code and its meaning are the same in every Windows language. The message is translated, for example in Chinese it says that system policy forbids this installation and you should contact the system administrator. The steps on this page are in English, but the menu paths have the same order in other languages.