How to Fix Windows Update Errors, From One PC to a Whole Fleet

Updated: November 2026

Windows Update fails with a cryptic code, retries the same way overnight, and fails again. The code tells you which part of Windows broke, so you can start with the fix that matches it. This guide shows how to fix Windows Update errors in a set order, from one PC to a whole fleet.

TL;DR

• The order. Restart, free up space, run the troubleshooter, clear the update cache, reset the update components, run DISM then SFC, then install the update by hand from the Microsoft Update Catalog.
• Read the code first. 0x8024 points at the update agent, 0x8007 at a Windows file, permission or disk error, 0x800F at the component store, and 0xC19 at a feature update's setup.
• Many PCs, same update. Check Windows release health for a known issue before you touch a single device.
• Know when to stop. If DISM and a repair install both fail, reimage.

Why Windows Update Keeps Failing

Windows Update does four jobs in a row: it scans for updates, downloads them, installs them, and restarts to finish. A failure at any of those stages gets the same generic line in Settings and an error code next to the update's name. So the first thing to find out is which stage broke.

Why It Keeps Failing on the Same Update

Windows retries a failed update from the same starting point: the same cached download, the same local update database, the same drivers. If any of those is damaged, every retry fails the same way, often with the same code. The common causes are a corrupted update cache, too little free space, a driver or security tool that blocks the install, and damage in the component store, the folder of system files Windows patches from. The code tells you which one you're dealing with.

Why It Won't Update at All

When "Check for updates" finds nothing, or stops with an error straight away, the problem sits before the download. The Windows Update service may be stopped or disabled. Updates may be paused, or a policy may point the device at a WSUS server or block Microsoft's servers. If someone paused or blocked updates on purpose, undo the hold first. A Windows 10 PC outside Extended Security Updates shows no error at all; it just stops getting security updates (more on that below).

When the Problem Is Microsoft's

Sometimes the device is fine and the update is the problem. Microsoft lists known issues for every Windows version on its release health dashboard, and it holds feature updates back from devices it expects to fail, which it calls a safeguard hold. If a monthly update fails on several machines at once, check the dashboard before you reset anything.

Read the Error Code First

"We couldn't install this update" is Windows doing Michael Scott: "I declare bankruptcy!" It announces the problem and fixes nothing. The code next to it is where the information lives.

Every code is a 0x followed by eight hex digits. Microsoft's guide to upgrade error codes says to read the last four digits as the actual error, and the digits in front as context about what produced it.

That context is the family. The digits after the leading 8 name a facility, and Microsoft's HRESULT facility table assigns 0x024 to Windows Update, 0x007 to Win32 errors and 0x00F to the Setup API. So 0x8024402C is a Windows Update agent error, number 402C: the proxy or server name couldn't be resolved.

Inside the 0x8024 family, the next digit narrows it further. Per Microsoft's error codes by component, 0x80244 codes come from the protocol talker (the conversation with the update server, so network, proxy or WSUS), 0x80246 from the download manager, 0x80248 from the local data store, and 0x80242 from the handler that runs the installer.

One more shortcut. Some 0x8007 codes are component store errors in disguise: 0x80073712 means the component store is corrupt, so treat it like an 0x800F code and go straight to DISM.

Common Codes and Where to Start

Code names and causes come from Microsoft Learn's error reference, Microsoft's corruption guide and Microsoft Support, checked 3 November 2026.

Check the Update Logs

The code in Settings tells you what failed. The logs tell you at which stage, and often why. Four places cover the stages:

• Update history. Settings > Windows Update > Update history lists each update, whether it installed, and the code if it didn't. Start here to get the KB number.
• Event Viewer. Applications and Services Logs > Microsoft > Windows > WindowsUpdateClient > Operational records every scan, download and install with its result.
• WindowsUpdate.log. Windows writes its update traces as .etl files; Get-WindowsUpdateLog merges them into one readable log on your desktop, as a snapshot you rerun after each attempt.
• CBS.log. %windir%\Logs\CBS\CBS.log records the install stage inside the servicing stack, where 0x800F and component store errors leave their detail.

Microsoft's page on Windows Update log files (updated February 2026) lists each one and when to use it. In WindowsUpdate.log, search for the code from Settings, then read the component name on that line. DownloadManager means the download failed. Handler means the installer did. ProtocolTalker means the conversation with the update server did.

To pull install failures without clicking through Event Viewer, filter the same log on event ID 20, the installation failure event. This works locally, and it's the line you'd push to a group of devices to compare them:

powershell
Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-WindowsUpdateClient/Operational'
    Id      = 20
} -MaxEvents 10 | Format-List TimeCreated, Message

Two more logs for specific cases. When updates download but never install, or never ask for a restart, the Update Orchestrator's UpdateSessionOrchestration .etl files in C:\ProgramData\USOShared\Logs hold the answer. When a feature update rolls back, SetupDiag and the Panther logs do, and the 0xC1900101 guide in the table above walks through both.

Fix Windows Update Errors in This Order

Each step below costs more time than the one before it. Run them in order, retry the update after each one, and stop as soon as it installs. The times are rough, for one PC.

Step 1: Restart and Retry (About 5 Minutes)

Many updates need a restart to finish, and a restart also frees files another process may be holding. Use Restart, not Shut down: with Fast Startup on, a shutdown doesn't fully restart Windows, and Microsoft documents updates that won't install because of it. Then go to Settings > Windows Update > Check for updates. Stop here if it installs.

Step 2: Free Up Disk Space (About 10 Minutes)

Microsoft asks for at least 16 GB free to upgrade a 32-bit system and 20 GB for a 64-bit one, and monthly updates still need working room. Run Disk Cleanup with "Clean up system files", or let Storage Sense clear temporary files. Codes 0x80070070 (disk full) and 0x800F0922 point straight at this step. On a device with a small drive, Microsoft suggests plugging in a USB drive for the update.

Step 3: Run the Windows Update Troubleshooter (About 10 Minutes)

On Windows 11, go to Start > Settings > System > Troubleshoot > Other troubleshooters and select Run next to Windows Update. It opens in the Get Help app, runs its checks and resets what it can. On Windows 10, the path is Settings > Update & Security > Troubleshoot > Additional troubleshooters > Windows Update. Both paths come from Microsoft's Windows Update troubleshooting page, updated 24 September 2026.

Older guides launch the troubleshooter with msdt.exe. Microsoft's deprecated features list marks MSDT as deprecated, so use the Settings path. And if the troubleshooter says it fixed something, retry the update before you believe it.

Britec09's walkthrough covers the built-in fixes from the easiest to the command-line ones, with no third-party tools:

Step 4: Check Date, Time and the Network (About 5 Minutes)

Microsoft notes that a wrong date or time can interfere with Windows Update. In Settings > Time & language > Date & time, turn on "Set time automatically" and select Sync now. Then drop the VPN for one attempt and check the proxy. 0x8024402C means the proxy or server name can't be resolved, and 0x80244022 means the update service answered with HTTP 503 (temporarily overloaded), so wait and retry.

Step 5: Unplug Extra Hardware and Update Drivers (About 10 Minutes)

Disconnect docks, external drives and anything else the device doesn't need to boot. If you've added hardware, get its driver from the manufacturer's site. This step matters most for feature updates, where a 0xC19 code often means a driver stopped Setup.

Step 6: Pause Third-Party Security Software (About 10 Minutes)

Microsoft suggests temporarily removing third-party antivirus or security software when an upgrade fails, then reinstalling it once the device is up to date. On a managed device, do it from your security console with a time limit, run the update, and put the protection back straight after.

Step 7: Clear the Update Cache (About 10 Minutes)

Corrupted files in the update cache cause errors that no amount of retrying fixes. Stop the Windows Update service, empty C:\Windows\SoftwareDistribution, and start the service again. The commands, in Command Prompt and PowerShell, are in the cache section below.

Step 8: Reset Windows Update Components (About 15 Minutes)

Clearing the cache handles downloaded files. A full reset also renames the local update database and catroot2, the store of update signatures, which needs the Cryptographic service stopped too. Run this from an elevated Command Prompt, one line at a time:

cmd
net stop bits
net stop wuauserv
net stop cryptsvc
ren %systemroot%\SoftwareDistribution SoftwareDistribution.bak
ren %systemroot%\System32\catroot2 catroot2.bak
net start cryptsvc
net start bits
net start wuauserv

If a .bak folder from an earlier reset already exists, the rename fails, so delete the old one first. The PowerShell version adds a timestamp to get around that:

powershell
$stamp    = Get-Date -Format 'yyyyMMdd-HHmm'
$services = 'bits', 'wuauserv', 'cryptsvc'
Stop-Service -Name $services -Force
Rename-Item "$env:windir\SoftwareDistribution" "SoftwareDistribution.$stamp.bak"
Rename-Item "$env:windir\System32\catroot2" "catroot2.$stamp.bak"
Start-Service -Name $services

Restart the PC afterwards, then check for updates. If a rename fails with access denied, a service restarted on its own; stop it again and repeat. Microsoft's full manual reset goes further: it clears the BITS queue, resets the services' security descriptors and re-registers DLLs. It warns that the descriptor step overwrites the services' permissions, so keep that part for when the short reset fails.

Step 9: Run DISM, Then SFC (20 to 40 Minutes)

This is the step for 0x800F codes, 0x80073712 and corrupt-file errors like 0x80070570. From an elevated prompt:

cmd
DISM.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannow

DISM goes first because it repairs the component store, and SFC copies its replacement files from that store. If DISM fails with 0x800F081F, it couldn't reach repair files, so point /Source at a matching Windows install and add /LimitAccess. Our DISM RestoreHealth guide covers that fix, the pause at 62.3% and offline repairs.

Step 10: Install the Update by Hand (About 15 Minutes)

Take the KB number from Update history, search for it in the Microsoft Update Catalog, and download the package for your Windows version and architecture (x64 or Arm64). Run the .msu file. A manual install skips the agent's scan and download, so it works around 0x8024 problems. It doesn't work around component store damage, because the install still runs through the servicing stack.

Step 11: Try a Clean Boot (About 20 Minutes)

A clean boot starts Windows with only Microsoft services, which rules out a third-party program in the way. Open msconfig, go to the Services tab, select "Hide all Microsoft services", then "Disable all". Turn off startup apps in Task Manager, restart and install the update. Undo both changes afterwards.

Step 12: Run an In-Place Repair (1 to 2 Hours)

An in-place repair reinstalls Windows over itself and keeps files and apps. On Windows 11, Settings > System > Recovery > "Fix problems using Windows Update" does it with the current version, and an ISO-based repair install suits managed devices. Our guide to repair Windows 11 walks through both. If this fails too, skip to when to stop and reimage.

How to Clear the Windows Update Cache

The cache lives in C:\Windows\SoftwareDistribution. Its Download folder holds the update files Windows has fetched, and its DataStore folder holds the local database of what's been scanned and installed. Clear it, and Windows downloads fresh copies and rebuilds the database on the next scan.

Clearing it is safe with the services stopped. Installed updates stay installed. The update history list in Settings can come back shorter, because that list reads from the database you just cleared. Delete the folder only after stopping the service: files the service has open won't delete, and you end up with a half-cleared cache.

The full clear, from an elevated Command Prompt (Microsoft's version stops only wuauserv; stopping BITS as well releases files it's still downloading):

cmd
net stop wuauserv
net stop bits
rd /s /q %systemroot%\SoftwareDistribution
net start bits
net start wuauserv

The lighter option empties only the Download folder and keeps the database. In PowerShell:

powershell
Stop-Service -Name wuauserv, bits -Force
Remove-Item "$env:windir\SoftwareDistribution\Download\*" -Recurse -Force
Start-Service -Name bits, wuauserv

Prefer clicking? Open services.msc, stop Windows Update, delete the contents of C:\Windows\SoftwareDistribution, and start the service again. That's Microsoft's own cache step, and it lands in the same place.

How to Force Windows Update

Forcing an update means telling Windows to check now instead of on its own schedule. Pick the method by what you need:

• One PC, any update. Settings > Windows Update > Check for updates is the supported trigger, and it's the one to retry after each fix above.
• One specific KB. Download it from the Microsoft Update Catalog and run it, as in step 10.
• A feature update. The Windows 11 Installation Assistant installs the latest version on an eligible PC, though Microsoft recommends waiting until Windows Update offers it.
• A fleet on Intune. An expedite policy, part of Intune's Windows quality update policies, pushes a specific security update faster than your update rings would, while restarts and deadlines still follow the rings.

From PowerShell, the common route is PSWindowsUpdate. It's a community module on the PowerShell Gallery, not a Microsoft tool, and version 2.2.1.5 was last published in July 2024. Run it from an elevated session:

powershell
Install-Module -Name PSWindowsUpdate -Scope CurrentUser
Get-WindowsUpdate
Install-WindowsUpdate -KBArticleID KBxxxxxxx -AcceptAll

It also ships a Reset-WUComponents cmdlet, if you'd rather not paste the reset from step 8.

Older guides use wuauclt /detectnow. Since Windows 10, the Update Orchestrator service runs the scan, download and install sequence, and UsoClient StartScan became the command people reach for instead. It has no published documentation and no useful exit code, so it won't tell you whether the scan worked. Trigger the scan from Settings or PowerShell, and confirm the result in Update history.

When Many PCs Fail the Same Update

One failure is a device problem. The same KB failing on twenty devices points somewhere else: the update itself, a policy, or something those devices share. That's the puzzle in this r/msp thread from August 2026, with rollbacks across different customers and one KB showing up on only some of them:

Start with Microsoft. Open release health for the affected Windows version and look for the KB under known issues. If it's listed, the entry gives its status and any workaround, and resetting devices won't change the outcome. Heavy release months make this check worth the minute; our October 2026 Patch Tuesday breakdown shows how much can land at once.

Then find what the failing devices share: the same model, driver, update ring, policy or update server. In the Intune admin center, Reports > Windows Updates shows update status and alerts per device, including a feature update failures report. If the devices get updates from WSUS, check that the update is approved and that the clients report in; our WSUS guide covers both, plus what replaces it.

Then fix it with one script, not one remote session per device. The cache reset from step 8, a DISM run, or hiding a bad driver all run unattended. Collect each device's output, so you can see which ones still fail. OpenFrame runs a script like that across a client's or a team's devices and collects the output, and Mingo, its AI agent, reads endpoint state through osquery; it's $1 per device a month with 10M AI tokens included, with a 14-day free trial. Flamingo builds OpenFrame, which competes with some of the tools mentioned here.

The devices still failing after the script are the ones your patch compliance report keeps flagging month after month. The last section covers when to stop spending time on them.

Windows 10 Devices After End of Support

Windows 10 support ended on 14 October 2025. A Windows 10 PC outside the Extended Security Updates (ESU) program doesn't throw an error when security updates stop. It just stops getting them, which is easy to mistake for an update that won't install.

Start with the version. ESU needs Windows 10, version 22H2, so run winver first; an older build has to reach 22H2 before anything else works.

Then check which program the device belongs to. Home and personal PCs use consumer ESU, which Microsoft extended to 12 October 2027. Enrollment sits in Settings > Update & Security > Windows Update, and it's free if you sync your PC settings, or costs 1,000 Microsoft Rewards points or a one-time purchase. Microsoft's consumer ESU page also says the program isn't offered on devices joined to Active Directory or Entra ID, or enrolled in MDM.

Those devices need commercial ESU: $61 per device for year one through volume licensing, and the price doubles each year ($122, then $244) for up to three years, so coverage can run to October 2028. Year one started in November 2025 and ESU is cumulative, so a device enrolled now pays for year one too (Microsoft's ESU overview, checked 3 November 2026). Each device then needs the ESU key installed and activated with slmgr, after KB5066791 and the licensing preparation package KB5072653. A device that's paid for but never activated looks exactly like one that was never enrolled, so check activation before you troubleshoot updates.

Our upcoming Windows 10 end of life guide covers the move to Windows 11 in full.

When to Stop and Reimage

Every step above costs time, and at some point a reinstall is cheaper than the next hour of log reading. In this r/sysadmin thread, an admin has 20 Windows 11 PCs failing the cumulative update with a corrupt component store. SFC reports fixes that don't stick, DISM can't find repair content, and one reply points out that hunting down the broken package can take longer than a reimage:

Reimage when DISM can't repair the component store even with a known-good source, and an in-place repair either fails or the same error comes back with next month's update. Reimage when a device fails every monthly update and release health shows nothing. And reimage when the user's data is backed up and a fresh build takes less time than another round of troubleshooting.

Keep fixing when the code points away from the device. A 0x8024 error caused by the network, a proxy or a policy will follow the device straight through a reimage, and so will a known issue. A reimage fixes Windows on that disk. It doesn't fix the update server, the policy or Microsoft's update.

If the reinstall then can't write to the drive, that's a partition problem with its own fix.

The Short Version

Read the code, then the log. Fix in order, cheapest first, and retry after every step. When many devices fail the same update, look up before you look down: a known issue on release health can save a morning of resets.

For a single code, start with its own guide in the table above. If you're choosing a tool to run updates and fixes across devices, our roundup of patch management software compares 11 options and who each one fits.