20H2 Feature Update Error 0xc1900223

Question

Running Windows 10 1909. When manually checking for updates it attempts to update to Windows 20H2 but fails at the end of "Getting things ready". For some reason it also attempts to update Windows Subsystem for Linux Update 4.19.128 and fails despite that feature being disabled (I'm not sure if it being disabled makes a difference). The two errors are:

There were problems installing some updates, but we'll try again later.

Feature update to Windows 10, version 20H2 - Error 0xc1900223

Windows Subsystem for Linux Update - 4.19.128 - Error 0x80070643

Microsoft-Windows-WindowsUpdateClient logs (attached with a temporary .log extension - change to .evtx) shows an error Event 31 which states Windows Update failed to download an update. I thought maybe it was a network issue but this happens on multiple machines using various different internet connections (corporate and home networks). Running the Windows Update Troubleshooter results in nothing ("Troubleshooting couldn't identify the problem"). Running sfc /scannow shows no issues with the system. Restarts and re-attempts have no impact. I've also included the output from Get-WindowsUpdateLog (timestamps may be different since I captured these on two different attempts). Any thoughts on root cause and solutions are greatly appreciated.

Answer 1

The error 0xc1900223 may occur if your computer is unable to connect to the Microsoft Update servers or its content delivery network. This can happen if you have earlier blocked a bunch of Microsoft server addresses manually or using a specialized program that writes to the Windows HOSTS file. This error can also occur if you leverage a specialized DNS server to block third-party web addresses.
Check your VPN software and DNS.
Turn off Windows Subsystem for Linux feature.
Upgrade again.
If still no help, using Windows Update Assistant for upgrade.
https://www.microsoft.com/en-US/software-download/windows10

-------------------------------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

@Teemo Tang , thank you for the response. The device is not running through a VPN and is just connected to a home network access point. The issue is reproducible on multiple networks. The Windows Subsystem for Linux feature has always been disabled, which makes that update attempt for WSL a little strange. The device is configured with these CIS L1 Benchmarks. When I remove this configuration it seems to update fine so the issue must be in one or more of these Windows settings. Unfortunately, removing these from all the devices that need updating is not an option. Is there a Windows security setting that prevents Feature Updates?

Running the Windows Update Assistant results in the following error:
This PC can't be upgraded to Windows 10
Your PC settings aren't supported yet on this version of Windows 10. Windows Update will automatically offer this version of Windows 10 when these settings are supported.

Answer 3

I check the benchmarks-used.txt, well… your IT team has a high-level security requirement.
Look at these two configurations:

Your devices has been configured Turn off Automatic Download and Install of updates and Turn off the offer to update to the latest version of Windows, only with these configurations, update is hard to achieving, maybe other configurations which I don’t discover also influence Windows update.
You have found the solution: “When I remove this configuration it seems to update fine”.

-------------------------------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

@Teemo Tang , thanks for the recommendation. I had looked at those as well; however, 18.9.69.3 is the default Windows setting (setting to Disable causes Microsoft Store to automatically download and install updates for Microsoft Store apps) and 18.9.69.4 is recommended by CIS so that OS feature updates can be centrally controlled. This should just remove the offer to users but not prevent the installation altogether. To test, I set both of these to their opposing setting (Enabled and Disabled, respectively) and I am running into the same problem. I've also tried setting them to Not Configured with no change in behavior. Since the error was related to connectivity, I also tried removing all of the network access (2.3.10) and security (2.3.11) related policies but the issue is still present.

Answer 5

I suspect the update installed properly but something on your network is blocking "watson.telemetry.microsoft.com". My pihole was blocking it. I disabled pihole, did 'check for updates' and Windows Update came back 'up to date'. That was what showed up on a brief scan with pihole enabled vs disabled.

So check ad blockers, etc. I might be wrong about that particular thing being the problem, but it all cleared up when I disabled pihole for the check for updates.