Upgrading Citrix WEM On-Prem from version 2511 to 2603 fails before completion.
The installer displays or logs error code 0x80070643 (Fatal error during installation).
The installation rolls back, leaving WEM on the previous version or in an incomplete state.
Error 0x80070643 is a generic MSI failure triggered during WEM upgrades by file locks from active 2511 binaries, corrupted RSA machine crypto keys (S-1-5-18), or insufficient SQL db_owner permissions during database schema updates.
Follow these steps to diagnose and resolve the upgrade failure:
Open File Explorer and navigate to %temp% or C:\ProgramData\Citrix.
Locate the latest WEM MSI installation log files.
Search for Return Value 3 or the string 0x80070643 to identify whether the failure occurred during database script execution, service installation, or file replacement.
Navigate to:
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18
Verify folder permissions and clear old or corrupted RSA key files that may block cryptographic validation during the upgrade process.
Perform a complete system restart of the WEM Infrastructure Server to release file locks on legacy 2511 binaries.
Ensure the administrative account running the upgrade has full Local Administrator rights on the server.
Confirm the account possesses db_owner privileges on the SQL server hosting the WEM database if a schema migration is required.
Open Services (services.msc).
Manually stop all active Citrix WEM services (e.g., Citrix WEM Infrastructure Service).
Right-click the Citrix WEM 2603 installer executable and select Run as Administrator to complete the upgrade.
Upgrading an on-premise Citrix Workspace Environment Management (WEM) installation from version 2511 to 2603 fails with error code 0x80070643. This issue typically occurs due to active file locks, database schema permission mismatches, or cryptographic key validation failures during the MSI installer execution.