sccm client error 0x87d00324 software updates failed

TL;DR

0x87d00324 means the client could not determine the compliance state for the update after the install attempt, typically a broken WMI repository, a stuck scan, or a state message that never updated. Verify the KB is really installed with Get-HotFix or DISM, check WUAHandler.log for scan errors, repair WMI if scans fail, and force a fresh scan.

sccm client error 0x87d00324 software updates failed

Use this when

• Software Center shows an update failed with 0x87d00324.
• The KB from the deployment is visible in installed updates.
• Many updates on one client show unknown or failed states together.

Not for this skill when

• The KB is genuinely absent and its setup log shows a failure. Treat it as a real install failure.
• The client cannot scan against WSUS at all. Fix scan errors under their own codes first.

Steps

1. Confirm whether the KB is installed using Get-HotFix or by checking Update history. Verify: you know if this is a state-reporting fault or a real failure
2. Read WUAHandler.log and UpdatesStore.log on the client for scan completion and state errors. Verify: the last scan result and any WMI errors are visible
3. Run a software updates scan cycle from the Configuration Manager control panel. Verify: WUAHandler.log records a completed scan with a result count
4. If WMI errors appear, verify the repository with winmgmt /verifyrepository and run the documented salvage or reset only if it reports inconsistent. Verify: the repository reports consistent
5. Refresh the deployment state by re-running the deployment evaluation cycle. Verify: Software Center state matches the real installed state

Variant phrasings

sccm 0x87d00324 update state verification failed

The meaning-first phrasing.

software center failed but update installed 0x87d00324

The confusing-symptom phrasing admins actually search.

sccm client wmi scan state error fix

The root-cause phrasing.

Compatibility: Compatibility: Configuration Manager current branch clients on Windows 10 and 11.

Why it happens

After installing, the client re-scans and reports per-update state to the site. That reporting depends on the Windows Update Agent scan completing and on WMI classes that hold update state. When WMI or the scan is broken, the site sees a failure state even though setup succeeded, so the code describes reporting health, not patch health.

Edge cases / pitfalls

• Resetting the WMI repository is disruptive to other management tooling; verify inconsistency first and prefer salvage.
• A single client with this code among healthy peers is a client repair; a site-wide pattern points at the SUP or WSUS instead.
• State messages can lag; give a repaired client a full scan and summarization cycle before judging.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_lEznB7cOMtRUI71X6HrRZQ