sccm software update deployment error 0x87d00267 how to fix

TL;DR

0x87d00267 on a ConfigMgr client means the update deployment job failed after content arrived, most often a hash mismatch on a re-downloaded or partially cached package. Check UpdatesDeployment.log and CAS.log on the client, purge the CCM cache for that package, confirm the distribution point copy matches the site source, and redeploy.

sccm software update deployment error 0x87d00267 how to fix

Use this when

• Software Center shows the deployment failed with 0x87d00267.
• The same deployment succeeds on most clients and fails on a subset.
• Failures cluster on clients that interrupted an earlier download.

Not for this skill when

• No clients can get the content and the DP reports errors. That is a distribution problem upstream of the client.
• The client never starts the deployment. Check assignment and maintenance windows first.

Steps

1. On a failing client, read UpdatesDeployment.log and CAS.log in the CCM Logs folder and find the package ID tied to 0x87d00267. Verify: the failing package and its hash or download error are identified
2. Clear that package from the client cache using the Configuration Manager control panel cache settings or the client SDK. Verify: the cached copy is gone and cache space is reclaimed
3. On the site server, redistribute the content to the distribution point and watch distmgr.log until it completes. Verify: content status shows Success for that DP
4. Trigger a software updates deployment evaluation cycle on the client from the Configuration Manager control panel Actions tab. Verify: the client downloads fresh content
5. Confirm the install result in Software Center and UpdatesHandler.log. Verify: the deployment reports Installed or a pending restart, not 0x87d00267

Variant phrasings

sccm 0x87d00267 content hash mismatch

The root-cause phrasing.

software center update failed 0x87d00267

The user-visible symptom phrasing.

configmgr deployment job failed download content

The log-message phrasing from UpdatesDeployment.log.

Compatibility: Compatibility: Configuration Manager current branch clients and distribution points; log locations under the CCM folder.

Why it happens

ConfigMgr verifies downloaded update content against the hash recorded when the package was created. If the source files changed without a proper content update, or a client cached a partial download across a network drop, verification fails and the deployment job is marked with this code even though the network path is healthy.

Edge cases / pitfalls

• Updating content on the site without redistributing leaves DPs serving the old files with new metadata; always pair the two actions.
• Clients on slow VPN links corrupt downloads more often; boundary group and peer cache settings change the failure rate.
• A fleet-wide outbreak after a content edit points at the source files, not at hundreds of client caches.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstHsQC2gGYXjELXmQcZqvYg