# Office Patch Download Failure Last Updated On: 31 Oct 2026 8 minutes read ## Problem Patch downloads for Microsoft Office applications can fail with the following errors. Affected applications include Microsoft 365, Office 2021, and Office 2019. Both the main Office patch and its dependency patch must download before you deploy. - Command execution failure - Unable to execute command - Unknown Error Code:- 2147012894 - Unknown Error Code:- 2147012852 - `Download failed with Please whitelist this url: and also allow extension-[]`. The error code, URL and file extension vary with the failure. ## Investigating Problem Causes For a remark containing **Please whitelist this url** or **allow extension**, capture the full error, failed URL and extension. Test that exact URL from the configured downloading host, not only from an endpoint browser. Follow the ODT and dependency checks below; a browser download does not confirm product-service access. For package selection and upload instructions, see [Upload Pending eligibility](https://www.manageengine.com/products/desktop-central/help/patch-management/attention-required.html). Use [Office network and execution checks](https://www.manageengine.com/products/desktop-central/help/patch-management/office-patch-download-whitelisting.html) if allowlisting alone has not resolved the download failure. A failed Office download does not automatically add the package to Upload Patches. Use manual upload only when the matching patch or dependency is explicitly listed with upload instructions. Office download processing can include extraction, configuration, additional content downloads and packaging. A separately downloaded Office Deployment Tool executable does not replace this complete process. Do not substitute an arbitrary ODT executable when the required package is absent from Upload Pending. An empty Upload Patches list does not by itself confirm that an Office package is unsupported. It can also reflect the selected filters and the package's download or upload state. Check these before you continue. If no matching upload entry is available, follow the network and ODT checks below. Provide Support with the Patch ID, dependency ID, language, server build and full error. See [Upload Pending requirements](https://www.manageengine.com/products/desktop-central/help/patch-management/attention-required.html#upload-pending). Possible causes include: - **The user cannot access or execute the Setup.exe file.** - **Antivirus software blocks the operation.** - **The proxy credentials in Proxy Settings are invalid.** Follow these steps to identify and resolve the issue: ### Allowlist Office download domains Allowlist the domains listed on this [page](https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide) in your proxy to download the Office patches. ### Test the Office Deployment Tool download If the download still fails after allowlisting the links, use the following test to check for network or privilege issues: - Log on to the computer where the server is installed and create a folder named **o365**. - Copy the XML content below and save it as **download.xml**. Place the file in the **o365** folder that you created in the first step. ```xml ``` - Download the [office deployment tool](https://www.microsoft.com/en-US/download/details.aspx?id=49117) and place it in the **o365** folder along with **download.xml**. - Use 7zip to extract the **.exe** file in the same path. - Run Command Prompt as **administrator** and execute these commands: ```bat setup.exe /download download.xml echo %errorlevel% ``` - After the test, the error level should be **0**. If another value appears, [contact support](https://www.manageengine.com/patch-management/support.html). ### Check server service-account permissions If the test returns **exit code 0** but the product download still fails, a privilege issue might be present. Follow these steps: 1. Open Run (Windows key + R) and enter **services.msc**. 2. Right-click on **Patch Manager Plus UEMS - Server** > **Properties** 3. Click **Log On**. 4. Click **This account**. Enter the credentials of the system's admin account and click **OK**. ![Microsoft 365 patch download failure](https://www.manageengine.com/patch-management/images/o365-download-failure.png) 5. Restart the server and deploy or download the O365 patch. If the problem persists, [contact support](https://www.manageengine.com/patch-management/support.html). ## Diagnose hosted Office metadata failures For a computer served by a Distribution Server, verify the main patch and each dependency for the affected Remote Office. Compare the requested JSON URL and responding host with the replication result. An overall download success does not verify that serving copy. If the 404 continues, collect matching server, Distribution Server and agent logs. See [HTTP 404 checks](https://www.manageengine.com/products/desktop-central/kb/patch-management/patch-download-failures.html#http-404-%E2%80%94-not-found) and [patch-store checks](https://www.manageengine.com/products/desktop-central/kb/patch-management/patch-store-location-not-available.html). For **Failed to download office patch meta json with error code : 404** or **Failed to decrypt office meta - .json**, identify the stage that failed: downloading the dependency JSON, decrypting it, or downloading the Office files described by it. These are separate stages in the hosted-metadata flow. 1. Record the Patch ID and dependency ID, affected computer, server and agent builds, failure time and full error. For a metadata download failure, include the requested JSON URL and the serving server or Distribution Server response. 2. If the download succeeded but decryption failed, collect the affected agent logs, the recorded `officemeta.exe` helper presence and result, and whether the expected dependency JSON became available. Do not run an undocumented helper command or substitute another JSON file. 3. Share the bundle and stage-specific evidence with Support if the failure persists. A successful allowlisting test does not establish that decryption succeeded. ## Related - [Office Patch Download Whitelisting](https://www.manageengine.com/products/desktop-central/help/patch-management/troubleshooting/office-patch-download-whitelisting.html) - [Microsoft 365 (Office 365) Patch Deployment](https://www.manageengine.com/products/desktop-central/help/patch-management/office-365-patch-deployment.html)