Fix ERROR_INSTALL_REMOTE_PROHIBITED (0x0000066D) on Remote Desktop
This error blocks MSI installs over RDP. Usually a group policy or registry tweak fixes it. I'll show you the exact steps.
What Triggers This Error
You're connected to a Windows machine via Remote Desktop, try to run an MSI installer, and get hit with ERROR_INSTALL_REMOTE_PROHIBITED (0x0000066D). The message says: "The Windows Installer does not permit installation from a Remote Desktop Connection."
This happens because Windows Installer by default blocks any MSI execution from a remote session. Microsoft did this for security reasons—prevents bad actors from silently pushing installs over a remote connection. But if you're an admin legitimately installing software, it's infuriating.
I've seen this on Windows 10 Pro 22H2, Windows 11 23H2, and Windows Server 2019/2022. The fix is almost always one of two things: a group policy tweak or a registry edit. Let's start with the most common cause.
Cause 1: Group Policy Blocks Remote MSI Install
This is the most frequent culprit. The "Always install with elevated privileges" policy is often set to Disabled, but there's a specific policy that controls remote MSI behavior.
The Fix
- Press Win + R, type
gpedit.msc, hit Enter. - Navigate to:
Computer Configuration → Administrative Templates → Windows Components → Windows Installer. - Find "Prohibit removal of update from a remote desktop session" or "Allow installation from a remote desktop connection" (the exact name varies by OS version). In Windows 10/11, look for "Allow installation from a Remote Desktop Connection".
- Set it to Enabled. If you see a dropdown, choose "Allow Windows Installer to install from a Remote Desktop session."
- Click OK, then run
gpupdate /forcein an admin command prompt. - Reconnect your RDP session and try the MSI again.
If the policy isn't there (common on Windows 10/11 Home), skip to Cause 2.
Cause 2: Registry Key Disables Remote Install
When the group policy path is missing or you're on a non-Pro/Enterprise edition, the registry is your next target. Windows Installer checks a specific key to decide if remote installs are allowed.
The Fix
- Open Regedit as Administrator.
- Go to:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer - If the Installer key doesn't exist, right-click Windows, select New → Key, name it
Installer. - Inside the Installer key, right-click in the right pane, select New → DWORD (32-bit), name it
DisableRemoteMSI. - Set its value to
0(zero). The default is 1, which blocks remote installs. - Close Regedit. No reboot or gpupdate needed—changes apply instantly.
- Reconnect RDP and test.
I've used this on dozens of Server 2019 boxes where group policy wasn't applied. Works every time.
Cause 3: User Account Control (UAC) or Token Filtering
Less common, but I've seen it on Windows 11 23H2. When you connect via RDP, your account might not have full admin token unless you're in the local Administrators group and UAC is set to a certain level.
The Fix
- Make sure you're connecting with an account that's a member of the local Administrators group.
- Temporarily set UAC to the lowest notch:
Control Panel → User Accounts → Change User Account Control settings. Slide to Never notify. Apply, reboot. - RDP back in, try the install. If it works, you know the issue is UAC-related. Reset UAC to your normal level after testing.
- Alternatively, right-click the MSI file, select Run as administrator. Sometimes this bypasses the token issue even in RDP.
I don't recommend leaving UAC disabled permanently. It's a security feature. But for a one-off install, it's fine.
Quick Reference Summary
| Cause | Fix | Works On |
|---|---|---|
| Group Policy blocks remote MSI | Enable "Allow installation from Remote Desktop Connection" in gpedit.msc | Windows Pro/Enterprise, Server |
| Registry key DisableRemoteMSI = 1 | Set DisableRemoteMSI DWORD to 0 in HKLM\Software\Policies\Microsoft\Windows\Installer | All Windows editions |
| UAC or token filtering | Run MSI as admin, or lower UAC temporarily | Windows 10/11 |
Start with the registry fix if you're on a non-Pro machine. It's quick, reversible, and doesn't touch policies. If that doesn't work, check the group policy path. The UAC workaround is a last resort.
One more tip: After applying any fix, disconnect and reconnect your RDP session. The change often doesn't take effect until the session is re-established. I've chased this error for an hour before realizing I just needed to reconnect.
Was this solution helpful?