How to fix Error 1640 on Windows 11

by

Why This Error Happens

This error occurs because the Remote Desktop/Terminal Services session is running in “Install Mode” restrictions, which by default only allows administrator accounts to install or modify software (like MSI packages) during a remote session. This is a security feature (User Account Control combined with Terminal Services multi-user isolation) designed to prevent standard users from altering shared system files or registry keys on a multi-user server. It also frequently occurs when the change user /install mode hasn’t been properly toggled before running an installer in a Remote Desktop Session Host (RDSH) environment.

Step-by-Step Resolution Guide

Step 1: Verify Administrative Privileges

  • Log off the current Remote Desktop session completely.
  • Log back in using an account that is a member of the local “Administrators” group on the target machine.
  • Right-click the installer file and select “Run as administrator” to bypass the initial permission gate.

Step 2: Toggle Terminal Server Install Mode Manually

  • Open Command Prompt as Administrator.
  • Type change user /install and press Enter. This switches the server into a state where the first user to log in can install applications.
  • Run your software installation as normal.
  • Once finished, type change user /execute to return the server to standard multi-user restricted mode.

Step 3: Adjust Group Policy for Remote Desktop Services

  • Press Win + R, type gpedit.msc, and hit Enter.
  • Navigate to: Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Application Compatibility.
  • Locate the policy named “Turn off Automatic Installation of Enterprise Applications” and set it according to your organizational software deployment needs.
  • Run gpupdate /force in Command Prompt to apply the changes immediately.

Step 4: Check Local Security Policy for User Rights

  • Open secpol.msc (Local Security Policy).
  • Go to Local Policies > User Rights Assignment.
  • Ensure your specific user account or group has appropriate rights, though for most non-domain machines, adding the account to the local Administrators group is the primary fix.

Alternative or Verification Steps

  • Verification: After running change user /execute, attempt to install a different piece of unrelated software as a standard (non-admin) user; if it fails with the same 1640 error, permissions are working correctly and expectedly.
  • Alternative: If Group Policy is being centrally managed by a domain controller and overriding your local changes, contact your network administrator to request a specific Group Policy Object (GPO) exception for the target server’s Organizational Unit (OU).