Win32 Appshex 0x643

Fix Intune Error 1603: Windows Installer hit a fatal error during the install (ERROR_INSTALL_FAILURE); the MSI log shows the step that failed.

Open the log below first. It is the quickest way to confirm which of the causes applies before you change anything.

AppWorkload.log

Folder: C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\

Also check: MSI verbose log (msiexec /i app.msi /l*v C:\Windows\Temp\app-msi.log) · AppEnforce.log (ConfigMgr) · Application event log (MsiInstaller)

Root causes

A custom action failed, such as a script or helper that needs a user session, network share or file the SYSTEM account cannot reach.
A previous version, or a leftover from a failed install, is still registered and blocks the new one.
The installer needs permissions the SYSTEM account lacks, or a file is locked by a running process or security agent.
A pending reboot from a previous install stops the new package from continuing.
The MSI is a per-user package deployed machine-wide, or the 32-bit and 64-bit packages were mixed up.

Re-run the exact install command as SYSTEM with verbose logging: msiexec /i "app.msi" /qn /l*v C:\Windows\Temp\app-msi.log.
Search the MSI log for "Return value 3". The lines just above it name the failing action or error.
Clear the cause: close the locking process, remove the stale previous version, or restart if a reboot is pending.
Fix a custom action failure in the package rather than ignoring the exit code. Do not map 1603 to success.
Redeploy and confirm exit code 0 in the log, then confirm the detection rule passes.

For the full diagnosis around this error, read Win32 app stuck at waiting or pending.

Most Win32 failures are decided by the detection rule and the install command, so fix them at the source before the app is assigned again.

Other Win32 Apps errors with their own runbooks.