Fix ERROR_PATCH_PACKAGE_REJECTED (0X0000066B) Fast

Quick answer: Open gpedit.msc, go to Computer Configuration → Windows Settings → Security Settings → Software Restriction Policies → Security Levels, set to "Unrestricted," then delete any explicit path rules blocking the update file.

Why you're seeing error 0X0000066B

I know this error is infuriating—especially when you've downloaded the update legitimately and Windows still rejects it. The error code 0X0000066B means ERROR_PATCH_PACKAGE_REJECTED: the installer is blocked by a Software Restriction Policy (SRP). This isn't a corrupted download or a Windows Update glitch. It's your own system's security policy stepping in and saying "nope."

This tripped me up the first time too. I spent an hour chasing file hashes before realizing I'd tightened SRP rules months earlier and forgot. The policy can be set via Group Policy (on Pro/Enterprise editions) or directly in the registry (on Home editions). The fix is the same: locate and disable the rule that's blocking your installer.

Here's a real-world trigger: you're installing a third-party app like a Cisco VPN client or a printer driver that uses an MSI wrapper. Windows sees the package, checks SRP, and blocks it because the default rule is "Disallowed" or a path rule explicitly blocks the install.

How to fix error 0X0000066B (step by step)

Step 1: Check your Software Restriction Policy

Press Win + R, type gpedit.msc, and hit Enter. If Group Policy Editor doesn't open (you're on Windows Home), skip to Step 2.

Navigate to: Computer Configuration → Windows Settings → Security Settings → Software Restriction Policies

If you see "No Software Restriction Policies" listed, right-click the folder and choose New Software Restriction Policies.

Double-click Security Levels in the right pane. Make sure Unrestricted is set as the default. If Disallowed is the default, right-click Unrestricted and choose Set as Default. Click Apply and OK.

Step 2: Check path rules

Still in the same window, click Additional Rules in the left pane. Look for any rule with a path that matches where your installer lives—like C:\Users\[name]\Downloads or C:\Program Files. If you see a Path Rule set to Disallowed for that folder, right-click it and choose Delete.

Be careful: only delete rules you're certain you added or that are blocking the install. Don't touch system-level rules like %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir unless you know what you're doing.

Step 3: If you're on Windows Home—fix via registry

Windows Home doesn't include gpedit.msc, but the policy still exists in the registry. Here's how to fix it:

Press Win + R, type regedit, and hit Enter. Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers

If the Safer or CodeIdentifiers key doesn't exist, your system isn't using SRP—then this error is caused by something else entirely (try a different download source).

Look for a value named DefaultLevel. Double-click it and set the data to 0x00040000 (Disallowed) or 0x00000000 (Unrestricted). Change it to 0x00000000 to allow all patches. Click OK and close regedit.

Step 4: Check for explicit path rules in registry

Under the same CodeIdentifiers key, look for subkeys named 0, 1, 2, etc. Each of these represents a path rule. Double-click each Path value to see if it points to the folder containing your installer. If it's set to ItemData with a path like C:\Users\[name]\Downloads and the SaferFlags value is 0x00010000 (disallowed), delete that subkey.

Reboot after making registry changes—they don't take effect until restart.

Alternative fixes if the main approach fails

Run the installer as Administrator

Sometimes the error appears because the installer lacks elevation. Right-click the .msi or .exe file and select Run as administrator. This won't bypass SRP, but it can help if the policy is misconfigured for standard users only.

Move the installer to a safe location

Copy the installer to C:\Windows\Temp or C:\ProgramData—these folders are often excluded from SRP rules. Re-run the installer from there.

Temporarily disable Software Restriction Policies

If you need the install to work immediately and can't find the rule:

1. Open gpedit.msc (or regedit).
2. Set the default security level to Unrestricted as shown in Step 1.
3. Install your update.
4. Re-enable the policy afterward by setting it back to Disallowed.

This is a temporary bypass—don't leave it disabled long-term.

Prevention: avoid this error in the future

Don't create overly broad path rules. Instead of blocking an entire download folder, use hash rules or certificate rules to allow specific installers. Hash rules are safer because they follow the file, not the folder.

Also, keep a log of rules you've added. I use a simple text file in \admin\SRP_Changes.txt with dates and paths. When an update fails months later, I check the log first.

Pro tip: If you manage multiple machines, export the SRP policy via reg export before making changes. That way you can revert in seconds if something breaks.

And if you're still stuck after these steps, check the event viewer (Event ID 865 in Microsoft-Windows-SoftwareRestrictionPolicies/Operational). That log tells you exactly which rule blocked the package.