This article has been build with the greatly appreciated assistance and input of José Carrilho.


This article is part of a set troubleshooting articles, containing:


When you try to install a (or any) hotfix on a FIM or MIM 2016 server or component, you might run into a situation where the installation seems to run fine until the very last second and then the wizard starts a rollback.

Certainly, when you start the setup, msi or msp (patch) directly without any logging parameters, you will hardly get any information on the root cause.

Therefore it's wise to start the setup or hotfix installation with verbose logging.

Generating log

Use this article to install the hotfix with verbose logging: FIM Troubleshooting: Attempted to perform an unauthorized operation.

As explained by Tim:

  1. Open an Administrative Command-Prompt by right-clicking  Command-Prompt and selecting Run As Administrator
  2. Navigate to where you downloaded and extracted the hotfix
  3. Execute the following:

    msiexec.exe /p <name of msp file> /l*v mylog.txt

  4. Open and review the log  

Log Error Message Indicators


CAQuietExec:  An exception occurred while running Microsoft.IdentityManagement.SolutionPackUtility.exe: A deployment or retraction is already under way for the solution "microsoftidentitymanagement.wsp", and only one deployment or retraction at a time is supported.

CAQuietExec:  An error occurred while retracting FIM portal solution packs.

MSI (s) (20:4C) [10:04:50:187]: Running as a service.

CAQuietExec:  Error 0xfffffffa: Command line returned an error.

CAQuietExec:  Error 0xfffffffa: CAQuietExec Failed

CustomAction PatchRemoveFIMPortal returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)



Sharepoint Timer service task

One of the possible causes of the installation logging that entry is the Sharepoint Timer service to be stopped.

If the service is stopped on any of the machines, please start the service, and attempt the installation.

Sharepoint job - Windows SharePoint Services Solution Retraction

If the Sharepoint Timer service is started in both servers then proceed with the following steps:

Go to Sharepoint Central Administration > Operations > Timer Job Definitions

Check if there is a job called Windows SharePoint Services Solution Retraction (or similar) for “microsoftidentitymanagement.wsp”

If so, click on the job definition and delete it.

See also