Fix CS_E_NO_CLASSSTORE 0x80040168 — No AD software data

You're trying to install software pushed through Active Directory — maybe from a Group Policy Software Installation (GPSI) assignment — and you get CS_E_NO_CLASSSTORE (0x80040168). The exact message says "There is no software installation data in Active Directory".

I've seen this most often after a domain rename or migration from an old Windows Server 2003/2008 domain to a newer one. Also happens when a user's account was moved to a different OU and the class store object didn't come along. Or when someone accidentally deleted the CN=Class Store container in AD.

What's actually happening here

Windows has a system called the Class Store — it's a special container in Active Directory under CN=Class Store,CN=System,DC=yourdomain,DC=com. This container holds references to all software packages that can be installed via Group Policy. When an app triggers this error, the Windows Installer service (msiexec) can't find the CN=Class Store object, or the permissions on it don't let the current user read it.

The reason step 3 works (see below) is that ADSI Edit lets you check this container directly. If it's missing, no software installation will work — period. If it's there but permissions are wrong, you'll see the same error for some users but not others.

The fix — step by step

Check the Class Store container exists.
Open ADSI Edit on a domain controller or a machine with RSAT tools installed. Connect to the default naming context. Navigate to CN=Class Store,CN=System,DC=yourdomain,DC=com. If you don't see it, the container is missing — that's your root cause. Go to step 2.
Re-create the missing container.
In ADSI Edit, right-click CN=System, choose New > Object. Select classStore as the class. Name it exactly Class Store (case-sensitive). Leave all other fields blank. Click OK. This recreates the container that Windows Installer needs. You don't need to populate it — AD will fill it automatically when you deploy software via GPO.
Fix permissions on the Class Store container.
Right-click the CN=Class Store object, choose Properties, go to Security. Make sure Authenticated Users has Read permission. If it's missing, add it. Also check that Domain Computers and Domain Users have Read access. Without Read, the client can't query software packages.
Force a Group Policy refresh on the affected machine.
Open a command prompt as Administrator and run:
```
gpupdate /force
```
This pulls the latest policy settings, which includes the software installation data link to the Class Store.
Test the software installation again.
Try installing the app that gave you the error. For GPSI assignments, restart the machine or run gpupdate /force again and wait a few minutes. The software should appear in Add/Remove Programs or install automatically depending on your policy settings.

If it still fails

Sometimes the problem isn't the Class Store itself but the user's security token. If you're in a large domain with multiple domains in a forest, check that the user has access to the Class Store in the domain where the software is published. Cross-domain software installation requires proper trust and permissions — the default Class Store permissions might not cover cross-domain reads.

Another thing: verify the software package itself is still published in the GPO. Go to Group Policy Management, edit the GPO, navigate to Computer Configuration > Software Settings > Software installation (or User Configuration). Make sure the package is still assigned there. If it's missing, re-add it. I've seen administrators accidentally remove a package during cleanup and forget to re-add it.

Last resort: check the Application event log for Event ID 108 (for machine policy) or Event ID 105 (for user policy). These events give you more specific details about which package failed and why. If the event says "The software installation data in the Active Directory is not available", you've confirmed the Class Store issue.

If none of this works, you might have a deeper AD replication problem. Run repadmin /showrepl on your DCs to see if the Class Store container is replicating properly across all domain controllers. If one DC doesn't have the object, clients hitting that DC will get the error — even if other DCs are fine.