Kaspersky install error 1721 and 1327: setup fails on this Windows machine

Fix it now

These are Windows Installer errors rather than Kaspersky ones. Microsoft publishes 1721 as a program required for the install being unable to run – and the message itself names the action, location and command – and 1327 as the installer resolving a path to a drive that is not present. Neither says anything about your licence.

sc query msiserver
msiexec /i "C:\Users\Public\Downloads\kaspersky.exe" /l*v "%TEMP%\kav-install.log"

1. Read the 1721 dialog properly before doing anything. Microsoft’s published message includes Action, location and command, and that names the step that failed.
2. Remove any other antivirus or security suite with its vendor’s own removal tool, not through Settings, then reboot.
3. Reboot again if Windows is waiting on an update or a pending file rename. Setup cannot complete over the top of one.
4. Copy the installer to a local folder, right-click it and choose Run as administrator. Do not run it from a network share or a mapped drive.
5. If the error names a drive letter, reconnect that drive if it still exists, or move the affected user folder back to a local path before retrying.
6. If a previous Kaspersky installation is stuck on the machine, remove it with Kaspersky’s own removal utility and reboot.

1327 names the drive in the message. That letter is being referenced by a redirected user folder or a stored install path, and the quickest legitimate workaround is to map something to that letter temporarily and remove the mapping afterwards.

If setup completes and the product opens, you are done. If not, the next section explains what setup is doing when it stops and which of these codes belongs to which obstacle.

Why it happens

Installing a security suite is not a file copy. Setup registers kernel-mode components, installs a file-system filter driver, creates services that start before you sign in, and writes registry keys ordinary accounts cannot touch. Windows Installer drives those steps through custom actions, and a custom action that cannot run is what 1721 reports.

The important detail about 1721 is one people skip: Microsoft’s published message text is not just “a program could not be run”. It ends with “Action: [2], location: [3], command: [4]”, and the installer fills those in. The dialog is telling you which step failed and what it tried to execute. Reading it turns a generic failure into a specific one, and it is free.

1327 is a different animal and much more specific. Microsoft publishes it as “Invalid Drive: [2]”. Something in the environment resolves to a drive letter that is not present – most often a user folder such as Documents or Desktop that was redirected to a mapped network drive or a removable disk that has since gone. Windows Installer resolves the path, finds nothing, and stops.

The remaining three numbers are supporting evidence rather than separate problems. 1401 is “Could not create key: [2]. System error [3].” – a permissions answer, and the system error number in the message is the part to read. 1627 is ERROR_FUNCTION_FAILED, the function failed during execution. 27300 is a Kaspersky setup identifier with no published meaning; treat it as the installer’s own report that one of its stages did not complete.

Full reference

What each number is published as

Getting a verbose log

Where the package is an MSI, a verbose log turns a generic failure into a named failing action. Read it from the end backwards: the rollback is at the bottom and the last thing that failed is immediately above it.

msiexec /i "<package>.msi" /l*v "%TEMP%\kav-install.log"

Search the log for “Return value 3”, which is Windows Installer’s marker for the action that ended the installation. Everything after that point is cleanup.

Removal tools, and why an ordinary uninstall is not enough

• A security suite’s filter driver attaches to the file system and is not removed by deleting the program.
• Self-protection is designed to prevent anything modifying the product’s files, including an uninstaller that fails part way.
• Registrations with the Windows Security Center outlive the files that created them.
• Every major antivirus vendor publishes a dedicated removal tool for exactly this reason. Use the one belonging to the product you are removing, not a generic cleaner.
• If two other suites have been on the machine over the years, assume both left something and run both tools.

The drive-letter case in more detail

1327 turns up most often on machines where Documents, Desktop or Downloads were redirected to a network share or an external disk. The redirection is recorded per user, the drive is no longer attached, and every installer that asks Windows where Documents lives gets an answer pointing at nothing. The supported repair is to open the folder’s Properties, use the Location tab and move it back to a local path, which relocates the contents as well as the pointer. That is slower than editing a registry value and it is the version that leaves a working profile behind.

Things not to do

• Do not turn the Windows firewall off. It does not block a local installation, and switching security off to install security software is the wrong instinct.
• Do not try to remove Microsoft Defender first. Windows moves it aside by itself once a third-party antivirus registers.
• Do not install with another suite still present on the theory that setup will sort it out. It will not, and you will then have two products that neither work nor uninstall.
• Do not run the installer from a network share or a mapped drive. Copy it locally first.
• Do not delete the previous product’s folders by hand. The files go, the services and driver registrations stay, and the replacement will refuse to install.

When setup finally completes

1. Open the application and confirm it reports protection as active rather than as needing attention.
2. Activate it, if you have not already, and confirm an expiry date in the future.
3. Run a database update and let it finish; the first one after installation is the large one.
4. Check Windows Security, Virus and threat protection, and confirm exactly one third-party provider is listed.
5. Restart and confirm the product starts by itself.

Every code this article covers

Confirm the fix worked

1. Kaspersky appears in Settings, Apps, Installed apps with the version you intended.
2. The application opens and reports protection as active rather than as needing attention.
3. Windows Security, Virus and threat protection lists Kaspersky as the registered provider with no second suite alongside it.
4. A database update and a quick scan both complete.
5. Restart and confirm the product starts on its own.

Questions people ask about this