How to Roll Back or Uninstall a Windows Update on One PC or Across a Fleet

Updated: November 2026. Steps and commands checked against Microsoft Learn and Microsoft Support for Windows 11 24H2, 25H2 and 26H2 on 11 November 2026.

An update installs overnight, and by morning a printer, an app or a whole PC has stopped working. The way back depends on what kind of update it was, because a cumulative update, a version upgrade and a driver each come off differently. This guide covers how to roll back Windows update installs on one PC and across a fleet, sorted by the kind of update you're removing.

TL;DR

• One PC. Open Settings > Windows Update > Update history > Uninstall updates, or remove the cumulative update with DISM.
• Won't boot. Use Uninstall Updates in the Windows Recovery Environment, with the BitLocker recovery key ready.
• Version change. Go back undoes a full upgrade within 10 days by default, or up to 60 if you set it.
• Fleet. Check for a Known Issue Rollback, pause, then uninstall with Intune, WSUS or a script.
• After. The device lacks that month's security fixes until you install the fixed update.

Before You Roll Back a Windows Update

Four checks come first, and they take less time than a reimage.

1. Look the update up on Microsoft's release health pages. A listed issue may already have a Known Issue Rollback or a workaround.
2. Find the exact KB in Update history, with Get-HotFix or with DISM /Online /Get-Packages /Format:Table. Skip wmic qfe, because WMIC is gone from Windows 11 24H2 and later.
3. Have the BitLocker recovery key ready in case the PC ends up in the recovery environment.
4. Plan for the gap, because removing a cumulative update removes that month's security fixes too.

Microsoft's support page adds one step for Windows 11: before you remove a security update, try reinstalling your current version of Windows. That option keeps files, apps and settings, and our repair install guide walks through it.

When uninstalling a Windows 11 update starts trending, read the KB page before the headline. In January 2026, KB5074109 broke Azure Virtual Desktop sign-ins and made apps hang when saving to OneDrive. Microsoft fixed both with out-of-band updates on 17 and 24 January. In August 2026, games could hang or crash after KB5121003, yet Microsoft found Windows updates didn't cause it: RGB-lighting drivers such as inpoutx64 did. Our November known issues roundup tracks this month's list.

Which Updates Can Be Uninstalled

The removal path depends on the type of update. Every cell comes from Microsoft's pages unless the row says otherwise.

A Windows 11 cumulative update can come off, with one catch. Microsoft ships it combined with the servicing stack update, which is permanent. Microsoft's KB5060842 page says wusa /uninstall on that package "will not work because the combined package contains the SSU." Remove the LCU by its package name with DISM instead. The November 2026 KB page drops that note, so test the DISM route on a 25H2 or 26H2 virtual machine first.

One command closes the door for good. After DISM /Online /Cleanup-Image /StartComponentCleanup /ResetBase, Microsoft says installed updates can't be uninstalled, so don't run it on a machine you might need to roll back.

Our drivers guide shows how to roll back a driver. The flow below adds the second question: one PC or a fleet.

How to Uninstall a Windows Update in Settings

On a working Windows 11 PC, open Settings > Windows Update > Update history, scroll to Related settings and select Uninstall updates. Find the KB that matches the day the problem started, select Uninstall, then restart if Windows asks. If the update isn't listed, the errors table at the end explains why.

On Windows 10, the path is Settings > Update & Security > Windows Update > View your update history > Uninstall updates. Windows 10 support ended on 14 October 2025, and our Windows 10 end-of-life guide covers what that means for patching.

This September 2026 walkthrough from the Memory channel covers the Settings route, the recovery route for a PC that won't boot, and why an update can be missing. Its creator also pitches a tool of their own, which nothing here needs.

How to Uninstall a Windows Update With DISM or wusa

Use DISM for cumulative updates, and keep wusa for standalone packages.

Remove a Cumulative Update With DISM

Open an elevated Command Prompt and list the packages. The cumulative update usually shows up as a Package_for_RollupFix entry with the build number in its name, a convention admins rely on that Microsoft doesn't document.

code
DISM /Online /Get-Packages | findstr RollupFix
DISM /Online /Remove-Package /PackageName:<package name>

Copy the full name and restart when DISM finishes. /Remove-Package takes .cab packages only, so even an update you installed from the Microsoft Update Catalog comes off by its installed package name, not the .msu file.

In PowerShell, Get-WindowsPackage -Online lists the same packages and Remove-WindowsPackage -Online -PackageName <name> -NoRestart removes one. Our list of PowerShell commands has more one-liners like these.

When wusa Still Works

Microsoft still documents wusa.exe /uninstall /kb:<number>. Its /warnrestart and /forcerestart switches only take effect alongside /quiet, so plan the restart yourself. It can't remove the combined monthly package, so keep it for standalone updates.

Leave out /quiet. Microsoft lists quiet wusa uninstalls as deprecated. They fail with event ID 8 in the Setup event log, under Event Viewer > Windows Logs > Setup. Our CMD commands reference covers wusa next to the other built-in tools.

How to Uninstall an Update When Windows Won't Start

After repeated failed boots, Windows opens the recovery environment by itself. You can also hold Shift and select Restart, or use Settings > System > Recovery > Advanced startup. Our Windows Recovery Environment guide covers each way in.

From there, go to Troubleshoot > Advanced options > Uninstall Updates and pick Uninstall latest quality update. On an encrypted drive, WinRE tools can ask for the key, so look up the BitLocker recovery key before you start.

If that fails, or the bad update isn't the latest one, run DISM from the WinRE Command Prompt against the offline Windows image. The Windows drive often gets a different letter in WinRE, so check it with dir first.

code
dir D:\
Dism /Image:D:\ /Get-Packages
Dism /Image:D:\ /Remove-Package /PackageName:<package name>

D: is only an example, so treat this as a starting point to test first.

Windows 11 24H2 and later add Quick machine recovery: when a device keeps failing to boot, WinRE goes online and checks Windows Update for a remediation. It's on by default for Home and unmanaged Pro, and off on Enterprise, Education and managed Pro until you turn it on.

If none of that works, boot into Safe Mode and try the Settings route there, or fall back to System Restore.

How to Go Back to an Earlier Version of Windows 11

A full feature upgrade comes off with Go back, in Settings > System > Recovery. Your personal files stay, but apps, drivers and settings changed after the upgrade are removed.

The window is 10 days by default. Admins can set it from 2 to 60 days with DISM, and a value outside that range falls back to 10. Once the window passes, Go back is gone.

code
DISM /Online /Get-OSUninstallWindow
DISM /Online /Set-OSUninstallWindow /Value:60
DISM /Online /Initiate-OSUninstall

Set a longer window soon after the upgrade, before the default 10 days run out. Our guide to the Windows.old folder explains how cleanup affects it.

One naming clash. If an upgrade failed and Windows put the old version back by itself, that's a failed install, and our guide to error 0xC1900101 covers it.

Undo a 25H2 or 26H2 Enablement Package

25H2 (KB5054156) and 26H2 (KB5121794) arrive as enablement packages, small switches that turn on features the monthly updates already shipped. 25H2 installs on 24H2, and 26H2 installs on 24H2 or 25H2.

Microsoft documents no removal path for either package, and Learn says Intune's ring Uninstall won't succeed for a feature update applied this way. Pureinfotech reported on 31 August 2026 that the 26H2 package shows under Uninstall updates, and removing it returns the PC to its previous version. That was four weeks before 26H2's general release on 29 September, so treat it as a field note and test it on one device first.

In r/Intune, an admin planning a 25H2 rollout asked how to get back to 24H2 from Intune. Early replies pointed to the ring rollback and DISM /Online /Initiate-OSUninstall, until a later one quoted the enablement-package limit from Learn.

How to Roll Back a Windows Update Across a Fleet

On a fleet, the order matters more than the tool.

1. Check for a Known Issue Rollback, which switches off the broken change and leaves the update installed.
2. Pause the update so no more devices take it.
3. Uninstall it from devices that have it, pilot ring first.
4. Verify the package and the problem are gone.
5. Reinstall the fixed update when Microsoft ships it.

In February 2026, an r/sysadmin admin reported hundreds of machines blue- or black-screening after KB5074109. Replies split three ways: reimage, recover offline from WinRE or WinPE, or block the KB centrally and push an uninstall script. Boot failures aren't among the known issues on that KB page, so read it as one company's experience.

Check for a Known Issue Rollback First

A Known Issue Rollback (KIR) switches off one specific change from a nonsecurity update and leaves the rest of the release in place. It never covers security fixes. Microsoft deploys it automatically to non-enterprise devices through Windows Update. For managed devices, it lists each KIR in the KB article and on release health, with a policy .msi to download.

With Group Policy, install the .msi and copy its .admx and .adml files to the Central Store if you use one. Under Computer Configuration > Administrative Templates, find the KB's rollback policy for your Windows version and set it to Disabled. Yes, Disabled: you're disabling the change. It takes effect after the GPO applies and the device restarts. Our Group Policy Editor guide covers the console.

Without a GPO, Intune deploys the KIR by ADMX ingestion, through a custom profile with two OMA-URI string settings. The first holds the whole ADMX file, and the second is set to <disabled/>.

code
./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/KIR/Policy/<ADMX Policy Name>
./Device/Vendor/MSFT/Policy/Config/KIR~Policy~KnownIssueRollback~<Parent Category>/<ADMX Policy Name>

Target the profile by OS build with applicability rules. Microsoft gives a KIR policy a lifespan of months, so remove it once the fixed update is installed.

Pause the Update in Intune or Autopatch

Pausing stops the spread. It doesn't remove anything already installed.

In an Intune update ring, Pause blocks feature or quality updates for up to 35 days, and Extend resets the clock. Devices get the pause at their next check-in, so a device may install a scheduled update first. Our Intune vs RMM review compares these controls with an RMM's.

Autopatch pauses per release, which revokes the release's approval for new devices and doesn't roll back those that installed it. The pause can take up to eight hours to reach devices. Learn advises against custom update rings on Autopatch-managed devices, so plan their uninstall as a script.

Uninstall With Intune Update Rings

The ring Uninstall action has more rules than the button suggests.

Warn users before you press it, because those restarts don't wait.

Remove or Decline the Update in WSUS

WSUS has two options that sound alike. Approved for removal uninstalls an installed update, but only one whose details show it as removable, and UUP updates aren't. Set a deadline in the past, and devices remove it at their next contact.

Decline stops WSUS offering the update, and you can reinstate it later. Decline it for machines that don't have it yet, and approve removal for those that do. Our WSUS guide covers the console.

Script the Removal With an RMM

For devices outside Intune and WSUS, script it: pilot ring first, restart in a maintenance window, collect the output, then go in waves. This sketch uses Microsoft's documented cmdlets, the RollupFix naming convention and KB5074109's 24H2 build as the example. Swap in the bad build and test it first.

powershell
$build = '26100.7623'
$pkg = Get-WindowsPackage -Online | Where-Object { $_.PackageName -like "*RollupFix*$build*" }
if ($pkg) {
  Remove-WindowsPackage -Online -PackageName $pkg.PackageName -NoRestart
  "Removed $($pkg.PackageName)"
} else { "No RollupFix package for $build on $env:COMPUTERNAME" }

For the wider pattern of scripted fixes, see our guide to automated remediation.

OpenFrame, open AI-native infrastructure for IT and security, can run the DISM check or the removal as a script across devices and collect the output in one place. Mingo runs IT operations and Fae resolves support requests. OpenFrame costs $1 per device per month, with a 14-day free trial. Flamingo builds OpenFrame, so read this mention with that in mind.

Stop the Update From Reinstalling

Older guides send you to wushowhide.diagcab to hide an update. It's an MSDT troubleshooting package, Microsoft announced MSDT's deprecation in January 2023, and Microsoft no longer documents the tool. The supported routes are a pause on the PC, a decline in WSUS, or a ring or Autopatch pause.

Our guide to pause Windows Update covers the single-PC limits. PSWindowsUpdate, which other guides also suggest, is a community-maintained module, last updated in July 2024.

After the Rollback

A rolled-back device is an unpatched device. Log it as an exception with the KB, the reason and a review date, so it shows up in your patch compliance reports.

Then watch release health. Once Microsoft ships the fix in the latest update, install it, remove the KIR policy, end the pause and put the device back in its ring. Our Patch Tuesday schedule shows when the next release lands.

Rollback Errors and What They Mean

If the trouble is an update that won't install, our guide to fix update errors picks up from there. If DISM reports component store corruption, run DISM /Online /Cleanup-Image /RestoreHealth before you retry the removal. Microsoft Learn says it scans the store for corruption and repairs it automatically.

Roll Back, Then Patch Again

Match the method to the update: Settings or DISM for a cumulative update, Go back for a full upgrade, and a pilot test before you touch an enablement package. On a fleet, check for a KIR, pause, uninstall in waves, then reinstall the fix. Every rollback leaves a security gap until that fix lands, so log it and close it. For the process around all of this, read our guide to Windows patch management.