Node.js MSI install fails on Windows 11 due to Smart App Control blocking custom action DLL (Error 1723)

[PtJade-Ceramic]

Version

24.15.0

Platform

Microsoft Windows NT 10.0.26200.0 x64

Subsystem

No response

What steps will reproduce the bug?

1. Open an elevated PowerShell session.
2. Run:

   Start-Process winget.exe -ArgumentList 'install --id OpenJS.NodeJS.LTS -e --accept-package-agreements --accept-source-agreements' -Verb RunAs -Wait

3. Wait for the installer to start.
4. Observe Windows Security notification:
   • "This app has been blocked partly"
   • "Windows Installer may not work correctly because it could not verify what MSI2C91.tmp was trying to load"
5. Installation fails.

How often does it reproduce? Is there a required condition?

Always, with Smart App Control (SAC) enabled on Windows 11.

What is the expected behavior? Why is that the expected behavior?

winget install --id OpenJS.NodeJS.LTS should complete successfully on Windows 11 with SAC enabled.

What do you see instead?

Installation fails. Windows Security / SAC blocks a temporary DLL loaded by Windows Installer during a custom action. The main MSI package is signed, but installation fails with Error 1723.

Additional information

Application log / MsiInstaller:

Product: Node.js -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run.
Action SetInstallScope, entry: SetInstallScope, library: C:\Windows\Installer\MSI2C91.tmp

CodeIntegrity / Operational:

Code Integrity determined that a process (msiexec.exe) attempted to load C:\Windows\Installer\MSI2C91.tmp that did not meet the Enterprise signing level requirements or violated code integrity policy
Smart App Control Block Details

• MSI payload downloaded by winget is signed and valid (Get-AuthenticodeSignature reports Status : Valid).
• Not caused by winget arguments, GPO, MDM, or domain-join policy.
• Blocked file: C:\Windows\Installer\MSI2C91.tmp loaded by msiexec.exe.
• SmartAppControlState: On
• CI\Policy: VerifiedAndReputablePolicyState = 1
• Block occurs when msiexec.exe loads the temporary DLL for custom action SetInstallScope.

Note

The Node.js MSI contains a custom action named SetInstallScope. SAC appears to block the temporary custom-action DLL generated during installation, not the signed MSI package itself. If this is expected, a clearer error message identifying the blocked install step and affected component would help troubleshooting.

Tip

Turn SAC off to work around.
You can turn it on later manually without a clean installation (the former documentation is obsolete if you have gotten recent Windows updates).