Windows EXE app deployment stuck pending or failed with Exit Code 1603 due to success criteriaSolved

Participant
Discussion
2 days ago Jun 27, 2026

I’m testing a Proofpoint DLP agent deployment on a Windows device through Hexnode. Manual installation works, and the device appears in the Proofpoint portal, but the app deployment in Hexnode stays Pending or fails with Exit Code 1603.

I first tried using the Windows app identifier from the Applications tab after a manual install, but Hexnode still marked the app as missing. I’m more used to macOS app identifiers, so I wasn’t sure if the Windows GUID-style value was the right success criteria or if I should be using something else.

Replies (2)

Marked SolutionPending Review
Hexnode Expert
2 days ago Jun 27, 2026
Marked SolutionPending Review

Hello @harold ,

For Windows app deployments, Hexnode UEM uses the success criteria configured in the app repository to confirm whether the application was installed successfully. If the success criteria does not match what Windows reports locally, the app can remain Pending or show as Failed even when some Proofpoint components appear in the Proofpoint console.

A few important points for this type of deployment:

  1. Windows identifiers are different from macOS identifiers. Apple Team IDs or macOS bundle-related identifiers cannot be used as Windows success criteria.
  2. If using App Identifier as the success criteria, manually install the app on an enrolled Windows test device, then go to Manage > Devices > select the device > Applications. Use the exact identifier shown for the correct Proofpoint component.
  3. Security agents may install multiple components, such as an updater, service, or helper utility. If the identifier belongs to a secondary component instead of the main installed agent, Hexnode may still report the app as missing.
  4. For EXE deployments, Exit Code 1603 usually means the installer itself failed. This is often caused by incorrect or incomplete silent install parameters. For Proofpoint-style agents, the silent install command may require vendor-provided tenant-specific values, such as tenant ID, token, server URL, cluster URL, or other deployment arguments.

If the app identifier method is unreliable for this installer, try using File Path as the success criteria and point it to a file that is created only after the main agent is installed successfully.

Regards,
Simon Scott
Hexnode UEM

Marked SolutionPending Review
Participant
6 hours ago Jun 29, 2026
Marked SolutionPending Review

Got it. I had used a GUID-style app identifier from the Windows Applications tab, but Hexnode still thought the app was missing. It looks like the installer drops more than one component, so maybe I picked the wrong one. Also using File Path as the success criteria worked. Hexnode now shows the deployment as Success.

Save