0x87D30067 Unzipping Downloaded Content: Intune Win32 Fix

The Company Portal or Intune device install status shows:

Error unzipping downloaded content. (0x87D30067)

That string lands before your install command runs. Changing silent switches, detection rules, or return codes usually wastes the first hour, because the Intune Management Extension (IME) never reached installer execution.

I have not reproduced this HRESULT on a live tenant for this article. The sections below keep three items apart: the portal message, what Microsoft Learn’s published tables actually contain, and the remediations Learn documents for Win32 content download and extract failures. Diagnostic snippets are read-only unless noted, and I have not executed them against an Intune deployment.

Key takeaways

• Lead with the exact portal string and 0x87D30067. That is what admins search for.
• Microsoft Learn’s app installation error codes page does not list 0x87D30067 (retrieved 2026-11-02). Do not invent an official HRESULT definition.
• Microsoft’s Win32 processing Support Tip places unzipping after download and hash verification: from Content\Staging into C:\Windows\IMECache\<contentId>. That is the stage this portal message usually points at.
• Apply the antivirus exclusions Learn publishes for the IME Content and IMECache folders before you rebuild every package.
• Confirm the failure in AppWorkload.log and the other IME logs under C:\ProgramData\Microsoft\IntuneManagementExtension\Logs.
• Rebuild with the current Microsoft Win32 Content Prep Tool when packaging or source files look wrong; otherwise fix AV, locks, or network first.

Quick Fix checklist

Work this list on one affected test device before you reimage or repackage everything:

1. Confirm the portal or Company Portal text is exactly Error unzipping downloaded content. (0x87D30067), not a later install or detection code such as 0x87D300C9 or 0x87D1041C.
2. Collect IME logs first (paths below). Search for the app id, content id, unzip, Staging, and IMECache around the failure time.
3. On x64 clients, confirm antivirus and EDR exclude:
   • C:\Program Files (x86)\Microsoft Intune Management Extension\Content
   • C:\windows\IMECache
4. On x86 clients, exclude:
   • C:\Program Files\Microsoft Intune Management Extension\Content
   • C:\windows\IMECache
5. Check free disk space on the system drive and whether another process still holds files under IMECache or the IME Content tree.
6. If only one app fails on many devices, download a clean vendor installer and rebuild the .intunewin with the latest Content Prep Tool, then redeploy to the test device.
7. If many Win32 apps fail on one device or one network path, check IME CDN reachability for your tenant region (Learn network endpoints) before you chase packaging.
8. After a clean extract succeeds and a different error appears, stop treating it as unzipping and move to install-command or detection troubleshooting.

Paste 0x87D30067 into the free Intune App Failure Analyzer for a client-side lookup. It runs in your browser and does not upload error codes or logs. Treat its entry for this code as community-sourced and unverified (details below).

What the portal shows vs what Microsoft publishes

Three labels show up for the same hex value. Keep them separate.

The portal message talks about unzipping. The analyzer’s current 0x87D30067 title talks about CDN download. Learn’s published error-code tables list neither 0x87D30067 nor 0x87D30065. The remediation path below uses Learn pages that document IME content handling, AV exclusions, logs, diagnostics collection, packaging, and network endpoints. It does not claim Microsoft published an official meaning for this HRESULT.

Why the obvious diagnosis can be wrong

“Just repackage forever.” A bad .intunewin can fail extract, and Learn warns you to use the latest Content Prep Tool when you upload. The same portal string also shows up when antivirus locks or quarantines files under Content or IMECache, when disk space runs out, or when a leftover process holds the IMECache folder. Rebuild after you have log evidence, not as step one on every device.

“It must be the CDN because the analyzer says CDN.” The analyzer entry for 0x87D30067 is labeled community and unverified, and its title does not match the portal unzipping string. Microsoft’s Support Tip still documents a distinct unzip step after download and hash verification. If logs show the download finished and unzipping started, a CDN block is the wrong branch.

“Neighbor code 0x87D30065 is the same issue.” Adjacent hex values are not interchangeable. Confirm 0x87D30067 on the failing device. The analyzer titles for 65 and 67 already differ, and neither is Learn-verified.

“Fix the install command / detection.” Installer switches and detection rules matter only after IME runs the install command. Microsoft’s processing flow puts installer execution after unzipping into IMECache.

Where unzipping sits in the IME flow

Microsoft’s Support Tip on Win32 deployment, delivery, and processing walks the client-side sequence from IME logs. The content-relevant stretch is:

If the portal reports unzipping failure, stay in download → verify → unzip until AppWorkload.log (and related IME logs) show installer execution. Only then open silent-switch or detection work such as Win32 timeout 0x87D300C9 or exit code 0 but detection fails.

Evidence to collect

IME log folder

Learn’s Troubleshoot Win32 apps page puts agent logs at:

C:\ProgramData\Microsoft\IntuneManagementExtension\Logs

For a deeper read of these files, see AppWorkload.log and IME log reading.

Read-only search pattern (not executed for this article):

# Read-only. Not executed for this article.
$LogRoot = 'C:\ProgramData\Microsoft\IntuneManagementExtension\Logs'
$Terms = @(
  '0x87D30067',
  'unzip',
  'Staging',
  'IMECache',
  'Incoming',
  'decrypt'
)
Get-ChildItem $LogRoot -Filter '*.log' |
  Select-String -Pattern $Terms |
  Select-Object Path, LineNumber, Line

Content and cache folders

On a typical x64 client, inspect (do not delete blindly):

C:\Program Files (x86)\Microsoft Intune Management Extension\Content
C:\windows\IMECache

Microsoft’s Support Tip names Content\Incoming, Content\Staging, and C:\Windows\IMECache\<contentId> during download and unzip. Look for stuck content ids that match the failing app, locked files, or AV quarantine events at the same timestamp as the log lines.

Collect diagnostics from Intune

When a Win32 install fails, Learn’s Troubleshooting Win32 app installations page documents Collect diagnostics on the Installation details pane. Requirements from that page include Windows 11 or Windows 10 version 1909 or later, exact file paths, allowed extensions such as .log / .txt / .zip, and a maximum of 250 MB or 25 files. Collection is described as about 15 to 20 minutes. Prefer collecting before you wipe staging folders.

Verified fixes grounded in Learn

1. Antivirus exclusions for Content and IMECache

From Troubleshoot Win32 apps in Microsoft Intune:

To allow proper installation and execution of LOB Win32 apps, antimalware settings should exclude the following directories from being scanned:

On x64 client machines: C:\Program Files (x86)\Microsoft Intune Management Extension\Content C:\windows\IMECache

On x86 client machines: C:\Program Files\Microsoft Intune Management Extension\Content C:\windows\IMECache

Apply these in Defender or your EDR the way your security team already manages exclusions, then retry one device. If extract starts working and a new error appears, move to that stage instead of widening exclusions further.

2. Confirm packaging with the current Content Prep Tool

Add and assign Win32 apps says to use the latest Microsoft Win32 Content Prep Tool, and warns that an older tool version surfaces a packaging warning on upload. The public tool repo (Microsoft-Win32-Content-Prep-Tool) currently documents version 1.8.7 in its README (retrieved 2026-11-02).

Quiet rebuild example from that README (adjust paths; not executed here):

IntuneWinAppUtil -c <setup_folder> -s <source_setup_file> -o <output_folder> -q

Use a clean vendor installer, keep the setup folder limited to that app’s files, and prefer short folder names if you suspect path-length problems during extract. After upload, assign only to a pilot device or group.

If you need a pre-packaging integrity check on the vendor binary itself, see verify installer hash before Win32 packaging.

3. Network and CDN reachability (when download never finishes)

If logs never leave the download / CDN discovery steps, use Microsoft’s network endpoints for Intune section Network requirements for PowerShell scripts and Win32 apps. Find Tenant location under Tenant administration → Tenant details, then allow the regional IME / CDN endpoints on TCP 443. Learn also states that Allow HTTP Partial response is required for Scripts and Win32 Apps endpoints. Do not guess a CDN failure from the portal unzipping string alone.

4. Clear stuck content carefully, then retry

After logs and AV are in place, remove only the confirmed stale content id folders under Content / IMECache for the failing app, or reboot if a process still locks IMECache. Then sync the device or restart the Microsoft Intune Management Extension service and retry. Broad “delete the entire cache” sweeps make the next failure harder to prove.

What not to waste time on

• Inventing an official Microsoft meaning for 0x87D30067 from blog posts or the analyzer’s unverified title.
• Editing detection rules, soft-reboot return codes, or install timeouts while logs still show unzip failure.
• Treating 0x87D30065 write-ups as interchangeable with 0x87D30067.
• Mixing Win32 and classic LOB MSI installs during Autopilot enrollment when you can avoid it. Learn’s Win32 troubleshooting page notes that mix can fail during Autopilot enrollment (Device Preparation mixing is called out as supported).
• Chasing supersedence graph limits or ESP LOB + Win32 “another installation in progress” until extract succeeds.

Prevention checklist

• Bake the Learn Content + IMECache exclusions into the gold image or security baseline before the first Win32 wave.
• Pin packaging to the current Content Prep Tool version and record the tool version in your package change log.
• Keep setup folders lean; avoid huge unrelated trees inside the .intunewin (Learn caps a Win32 app at 30 GB).
• Pilot every new package on one device and read AppWorkload.log through unzip before broad required assignment.
• Document tenant location and the matching IME CDN endpoints for the network team, including HTTP partial response.

Methodology

• Primary sources: Microsoft Learn Win32 troubleshooting, Win32 install diagnostics, Win32 add/assign, app-install error-codes (negative check), Intune network endpoints, Win32 processing Support Tip, and the Microsoft Win32 Content Prep Tool README. Retrieved 2026-11-02.
• Analyzer behavior and the 0x87D30067 / 0x87D30065 entries come from the live ZakitPro analyzer page and src/data/intune-errors.json in this repo. Both entries are marked community / unverified there.
• Q&A threads and competitor posts informed search intent only. They are not fact sources for this article.
• No live-tenant reproduction. PowerShell and IntuneWinAppUtil examples are labeled and were not executed for this write-up.

FAQ

Does Microsoft Learn define 0x87D30067?

Not on the published app installation error codes page as of 2026-11-02. Admins still see Error unzipping downloaded content. (0x87D30067) in Intune and Company Portal. Triage against that portal string and against IME logs, not against an invented Learn definition.

Is 0x87D30067 the same as 0x87D30065?

No. Confirm the hex on the device. The ZakitPro analyzer currently titles 0x87D30067 as a CDN download error and 0x87D30065 as an unzip / content-information error; both entries are community-sourced and unverified. Prefer the portal string plus AppWorkload.log over neighboring-code articles.

Where does IME unzip Win32 content?

Microsoft’s Win32 processing Support Tip shows unzipping from Content\Staging into C:\Windows\IMECache\<contentId> after download and hash verification, and before installer execution.

Which antivirus paths does Microsoft say to exclude for Win32?

On x64: C:\Program Files (x86)\Microsoft Intune Management Extension\Content and C:\windows\IMECache. On x86: C:\Program Files\Microsoft Intune Management Extension\Content and C:\windows\IMECache. Source: Learn’s Troubleshoot Win32 apps page.

Does the Intune App Failure Analyzer upload my codes or logs?

No. The analyzer runs in the browser and does not upload or store error codes or logs. Its 0x87D30067 row remains community-sourced and unverified.

Get the Deployment Doctor

Kit 1 founding presale is open: $39 (regular $49). The Autopilot + Device Prep Deployment Doctor checks your tenant, read-only, for the config that breaks ESP and Device Preparation. You pay now and get the files by Tuesday, December 1, 2026, sooner if they’re ready. Full refund any time before delivery, then 14 days after delivery. The founding price runs until Friday, December 4, 11:59 PM MT.

Want to look first? The free, read-only beta scripts are on GitHub: autopilot-deployment-doctor-beta. Its README says they haven’t been run against a live tenant.

Sources

All retrieved 2026-11-02 (America/Denver).

• Troubleshoot Win32 apps in Microsoft Intune, Microsoft Learn: IME log folder and file roles; Content and IMECache antivirus exclusions; Collect logs pointer.
• Troubleshooting Win32 app installations with Intune, Microsoft Learn: Collect diagnostics requirements and flow.
• Add and assign Win32 apps to Microsoft Intune, Microsoft Learn: latest Content Prep Tool warning; 30 GB app size cap; program and detection settings.
• App installation error codes for Microsoft Intune, Microsoft Learn: confirms 0x87D30067 is not listed.
• Support Tip: Win32 deployment, delivery, and processing flow, Microsoft Learn: Incoming download path; unzip from Content\Staging to IMECache; install after unzip.
• Network endpoints for Microsoft Intune, Microsoft Learn: Network requirements for PowerShell scripts and Win32 apps; regional IME endpoints; HTTP partial response.
• Microsoft Win32 Content Prep Tool README: tool version 1.8.7 and IntuneWinAppUtil usage.
• ZakitPro Intune App Failure Analyzer: browser-only processing; no upload of codes or logs.