Fix Application Deployment error 0x87d00213 in ConfigMgr

What is Error 0x87d00213?

Error 0x87d00213 SCCM (ConfigMgr) indicates that an application deployment has timed out. This usually happens when the installation takes longer than the maximum run time defined in the deployment settings, or when user interaction is required but not allowed.

When the application deployment fails with error 0x87d00213 (timeout occurred), you will see the following details on AppEnforce.log file.

Exceeded timeout of 120 minutes while waiting for process 8584 to finish.

WaitForRunningProcess failed. Error 0x87d00213.

CMsiHandler::CompleteEnforcement failed with 0x87d00213

CAppProvider::CompleteEnforcement failed with error 0x87d00213

++++++ Failed to enforce app. Error 0x87d00213. ++++++

Common Cause

The timeout error generally happens due to the following reasons.

Maximum Run Time Exceeded: The application installer runs longer than the configured limit.
User Interaction Required: Prompts or dialogs appear but cannot be displayed to the user.
Group Policy Changes: GPOs affecting PowerShell execution or script signing can block installations.
Environment Changes: Updates or configuration changes that alter how scripts run.

Step-by-Step Troubleshooting Guide

You need to understand both the issue itself and the number of impacted machines. This will help you determine whether the problem is isolated to individual devices or if broader environmental changes are causing a larger impact. If application deployment was functioning properly and suddenly stopped, the root cause may be related to recent changes in the environment, such as modifications to group policies

1. Verify Maximum Run Time

Check if the Maximum Allowed Run Time is sufficient for application installation.
Enable the “Allow users to view and interact with the program installation” option. If the application displays any dialog box, it will be visible to the user.

2. Test Manual Installation

Run the installer manually on the affected machine.
Confirm whether prompts or errors appear.

3. Check Group Policy Settings

Review GPOs related to PowerShell execution policies.
Ensure scripts are signed if required.

4. Review Logs

Inspect AppEnforce.log for detailed error messages.
Look for timeout entries or blocked script execution.

As you see in the screenshot below, the application installation was started at 16:34:29. The Configuration Manager client waited for 2 hours for execution to complete, and then it is considered the deployment as failed with a timeout occurred message.

Real-World Example

I recently encountered a similar issue where all PowerShell script–initiated application deployments suddenly stopped working. The deployments consistently failed with error 0x87d00213, and even previously successful deployments were impacted.

In my case, the root cause was a Group Policy Object (GPO) change. The policy was updated to allow execution only of digitally signed PowerShell scripts. As a result, any unsigned script triggered a hidden prompt asking whether the untrusted script should be executed. Because this prompt was not visible to end users, the script stalled at that stage and eventually timed out, causing the deployment to fail.

Since this mandate came from the corporate security team, the resolution was to digitally sign all existing PowerShell scripts. Once signed, deployments through SCCM resumed successfully.

Best Practices to Prevent Future Errors

Set realistic maximum run times for applications.
Use silent installation parameters whenever possible.
Proactively sign PowerShell scripts.
Regularly review GPO changes that may affect deployments.

Subscribe to Techuisitive Newsletter

Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news.