Problem Statement

Installing a hotfix update for the FIM Portal fails.

Root Cause

The account executing the installation was not listed in the SharePoint Farm Admin Group

Windows Installer Log

CustomAction CheckSharepointFarmAdministratorWithOpenPermission returned actual error code -1 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (B0:DC) [10:44:37:196]: Note: 1: 1722 2: CheckSharepointFarmAdministratorWithOpenPermission 3: C:\Windows\Installer\MSID5C2.tmp 4: action=ISFARMADMINISTRATORWITHOPENPERMISSION absoluteURL= https://portal/ UILevel=5
MSI (c) (A8:44) [10:44:37:212]: Transforming table Binary.
MSI (c) (A8:44) [10:44:37:212]: Transforming table Binary.
MSI (c) (A8:44) [10:44:37:212]: Note: 1: 2262 2: Binary 3: -2147287038

Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action CheckSharepointFarmAdministratorWithOpenPermission, location: C:\Windows\Installer\MSID5C2.tmp, command: action=ISFARMADMINISTRATORWITHOPENPERMISSION absoluteURL="https://portal" UILevel=5

MSI (s) (B0:DC) [10:44:38:822]: Product: Forefront Identity Manager Service and Portal -- Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action CheckSharepointFarmAdministratorWithOpenPermission, location: C:\Windows\Installer\MSID5C2.tmp, command: action=ISFARMADMINISTRATORWITHOPENPERMISSION absoluteURL="https://portal" UILevel=5

Resolution

Add the FIM Service account to the SharePoint Admin Group