Tailscale Installer Closes Immediately on Windows Server 2016

When running the Tailscale .exe or .msi installer on Windows Server 2016 Datacenter (64-bit), you may encounter the following symptoms:

• The installer window closes immediately after you double-click it.
• No clear error message appears on screen.
• Event Viewer records an error related to the built-in Administrator account.

This note documents an installation issue caused by the UAC configuration of the built-in Administrator account. This setting is not the cause of every Tailscale installation failure.

Symptoms

The installation window closes immediately after you launch the Tailscale installer.

Open Windows Event Viewer and navigate to Windows Logs → Application. You may see:

Built-in Administrator cannot activate this app.
Microsoft.Windows.Apprep.ChxApp

In the affected environment, the MSI log also contained:

Error 2203
MainEngineThread is returning 2

Error 2203 alone does not prove that the failure is caused by the UAC configuration. It can also be related to the installation files, temporary directories, or access permissions. Check the account SID and event logs for additional evidence.

Check the Current Account

Open Command Prompt or PowerShell and run:

whoami /user

Check the SID in the output.

If the final segment of the SID is 500, for example:

S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-500

You are using the built-in Windows Administrator account.

Even if the account has been renamed, a SID ending in -500 still identifies it as the built-in Administrator account.

Cause

The current account is the built-in Windows Administrator account, and the following security policy is disabled:

User Account Control:
Admin Approval Mode for the Built-in Administrator account

In the affected environment, this configuration prevented the installer from starting correctly.

Solution

Press Win + R and enter:

secpol.msc

Navigate to:

Local Security Policy
→ Security Settings
→ Local Policies
→ Security Options

Find the following policy:

User Account Control:
Admin Approval Mode for the Built-in Administrator account

Set it to:

Enabled

Apply the change, then open Command Prompt as an administrator and run:

gpupdate /force

If the policy does not take effect immediately, restart the server.

Verification

After restarting the server or refreshing Group Policy, run the Tailscale installer again.

In the affected environment, enabling this policy allowed the Tailscale installer to start normally and complete the installation.

Additional Notes

Tailscale supports Windows Server 2016 and later. If the system meets the version requirements, an installer that closes immediately does not mean that Windows Server 2016 is no longer supported.

If the issue persists after changing this policy, also check:

• Whether the installer is running with administrator privileges.
• Whether the Windows Installer service is functioning correctly.
• Whether the system's temporary directory is writable.
• Whether the Windows services required by the Tailscale installer are running.
• Whether the MSI log identifies a more specific step where the installation fails.