Fix Intune Error 0x80070643: A Windows Installer based update hit a fatal error (the 1603 error as an HRESULT); Windows Update, .NET, Defender or Office updates all report it.

Root causes

• The recovery partition is too small for the WinRE update (the well-known KB5034441 failure).
• The Windows Installer service or its registration is damaged, or its startup type was changed by policy.
• A previous version of the component is half-removed, or a file is locked by a security agent.
• A pending restart blocks the new servicing operation.

Step-by-step remediation

1. 1Merge the Windows Update traces into a readable file with Get-WindowsUpdateLog (it writes WindowsUpdate.log to the desktop), then search it for the error code.
2. 2Check the Application event log for MsiInstaller events around the failure time. They name the product that failed.
3. 3Run reagentc /info. If the update is the WinRE one, resize the recovery partition or follow the Microsoft guidance for the KB.
4. 4Check the Windows Installer service is left at its default Manual startup type and that no policy changes it.
5. 5Repair servicing: DISM /Online /Cleanup-Image /RestoreHealth, then sfc /scannow, then restart.
6. 6Retry the update.