Windows Update common errors and mitigation

Try our Virtual Agent - It can help you quickly identify and fix common Windows Update issues

The following table provides information about common errors you might run into with Windows Update, and gives the steps to help you mitigate them.

Applies to:   Windows 10, Windows 11

0x8024402F

Message Description Mitigation
WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS External .cab file processing completed with some errors This error can be caused by the Lightspeed Rocket for web filtering software.
Add the IP addresses of devices you want to get updates to the exceptions list of Lightspeed Rocket.

0x80242006

Message Description Mitigation
WU_E_UH_INVALIDMETADATA A handler operation couldn't be completed because the update contains invalid metadata. Rename the software redistribution folder and try to download the updates again:
Rename the following folders to *.BAK:
-%systemroot%\system32\catroot2

Type the following commands at a command prompt. Press ENTER after you type each command.
Ren %systemroot%\SoftwareDistribution\DataStore DataStore.bak
Ren %systemroot%\SoftwareDistribution\Download Download.bak
Ren %systemroot%\system32\catroot2 catroot2.bak

0x80070BC9

Message Description Mitigation
ERROR_FAIL_REBOOT_REQUIRED The requested operation failed. Restart the system to roll back changes made. Ensure that you don't have any policies that control the start behavior of the Windows Installer service. This service should be managed by the operating system. The default Startup type of the Windows Installer service is Manual.

0x80200053

Message Description Mitigation
BG_E_VALIDATION_FAILED NA Ensure that there are no firewalls that filter downloads. Such filtering could lead to incorrect responses being received by the Windows Update client.

0x80072EFD or 0x80072EFE or 0x80D02002

Message Description Mitigation
TIME_OUT_ERRORS The operation timed out Make sure there are no firewall rules or proxies that block Microsoft download URLs.
Take a network monitor trace to understand better. <Refer to Firewall Troubleshooting scenario>

0X8007000D

Message Description Mitigation
ERROR_INVALID_DATA Indicates data that isn't valid was downloaded or corruption occurred. Attempt to redownload the update and start installation.

0x8024A10A

Message Description Mitigation
USO_E_SERVICE_SHUTTING_DOWN Indicates that the Windows Update Service is shutting down. This error can occur after a long period of time of inactivity. The system fails to respond, leading to the service being idle and causing the service to shut down. Ensure that the system remains active and the connections remain established to complete the installation.

0x80240020

Message Description Mitigation
WU_E_NO_INTERACTIVE_USER Operation didn't complete because no interactive user is signed in. Sign in to the device to start the installation and allow the device to restart.

0x80242014

Message Description Mitigation
WU_E_UH_POSTREBOOTSTILLPENDING The post-restart operation for the update is still in progress. Some Windows updates require the device to be restarted. Restart the device to complete update installation.

0x80246017

Message Description Mitigation
WU_E_DM_UNAUTHORIZED_LOCAL_USER The download failed because the local user was denied authorization to download the content. Ensure that the user attempting to download and install updates has been provided with sufficient privileges to install updates (Local Administrator).

0x8024000B

Message Description Mitigation
WU_E_CALL_CANCELLED Operation was canceled. The operation was canceled by the user or service. You might also receive this error when we're unable to filter the results.

0x8024000E

Message Description Mitigation
WU_E_XML_INVALID Windows Update Agent found information in the update's XML data that isn't valid. Certain drivers contain more metadata information in Update.xml, which Orchestrator can interpret as data that isn't valid. Ensure that you have the latest Windows Update Agent installed on the device.

0x8024D009

Message Description Mitigation
WU_E_SETUP_SKIP_UPDATE An update to the Windows Update Agent was skipped due to a directive in the Wuident.cab file. You might encounter this error when WSUS isn't sending the self-update to the clients.

For more information to resolve the issue, review KB920659.

0x80244007

Message Description Mitigation
WU_E_PT_SOAPCLIENT_SOAPFAULT SOAP client failed because there was a SOAP fault for reasons of WU_E_PT_SOAP_* error codes. This issue occurs because Windows can't renew the cookies for Windows Update.

For more information to resolve the issue, see 0x80244007 error when Windows tries to scan for updates on a WSUS server.

0x80070422

Message Description Mitigation
ERROR_SERVICE_DISABLED This issue occurs when the Windows Update service stops working or isn't running. Check if the Windows Update service is running.

0x800f0821

Message Description Mitigation
CBS_E_ABORT; client abort, IDABORT returned by ICbsUIHandler method except Error() CBS transaction timeout exceeded. A servicing operation is taking a long time to complete. The servicing stack watchdog timer expires. Extending the timeout will mitigate the issue. Increase the resources on the device. If a virtual machine, increase virtual CPU and memory to speed up operations. Make sure the device has installed the update in KB4493473 or later.

0x800f0825

Message Description Mitigation
CBS_E_CANNOT_UNINSTALL; Package can't be uninstalled. Typically this error is due component store corruption caused when a component is in a partially installed state. Repair the component store with the Dism RestoreHealth command or manually repair with a payload from the partially installed component. From an elevated command prompt, run these commands:
Dism.exe /Online /Cleanup-Image /Restorehealth
Sfc.exe /Scannow
Restart the device.

0x800F0920

Message Description Mitigation
CBS_E_HANG_DETECTED; A failure to respond was detected while processing the operation. Subsequent error logged after getting 0x800f0821 A servicing operation is taking a long time to complete. The servicing stack watchdog timer expires and assumes the system has stopped responding. Extending the timeout will mitigate the issue. Increase the resources on the device. If a virtual machine, increase virtual CPU and memory to speed up operations. Make sure the device has installed the update in KB4493473 or later.

0x800f081f

Message Description Mitigation
CBS_E_SOURCE_MISSING; source for package or file not found, ResolveSource() unsuccessful Component Store corruption Repair the component store with the Dism RestoreHealth command or manually repair with the payload from the partially installed component. From an elevated command prompt and run these commands:
Dism.exe /Online /Cleanup-Image /Restorehealth
Sfc.exe /Scannow
Restart the device.

0x800f0831

Message Description Mitigation
CBS_E_STORE_CORRUPTION; CBS store is corrupted. Corruption in the Windows Component Store. Repair the component store with Dism RestoreHealth or manually repair with the payload from the partially installed component. From an elevated command prompt and run these commands:
Dism.exe /Online /Cleanup-Image /Restorehealth
Sfc.exe /Scannow
Restart the device.

0x80070005

Message Description Mitigation
E_ACCESSDENIED; General access denied error File system or registry key permissions have been changed and the servicing stack doesn't have the required level of access. This error generally means an access was denied.
Go to %Windir%\logs\CBS, open the last CBS.log and search for , error and match with the timestamp. After finding the error, scroll up and try to determine what caused the access denial. It could be access denied to a file, registry key. Determine what object needs the right permissions and change the permissions as needed.

0x80070570

Message Description Mitigation
ERROR_FILE_CORRUPT; The file or directory is corrupted and unreadable. Component Store corruption Repair the component store with Dism RestoreHealth or manually repair with the payload from the partially installed component. From an elevated command prompt and run these commands:
Dism.exe /Online /Cleanup-Image /Restorehealth
Sfc.exe /Scannow
Restart the device.

0x80070003

Message Description Mitigation
ERROR_PATH_NOT_FOUND; The system can't find the path specified. The servicing stack can't access a specific path. Indicates an invalid path to an executable. Go to %Windir%\logs\CBS, open the last CBS.log, and search for , error. Then match the results with the timestamp.

0x80070020

Message Description Mitigation
ERROR_SHARING_VIOLATION Numerous causes. CBS log analysis required. This error is caused by non-Microsoft filter drivers like antivirus.
1. Perform a clean boot and retry the installation
2. Download the sysinternal tool Process Monitor.
3. Run Procmon.exe. It will start data capture automatically.
4. Install the update package again
5. With the Process Monitor main window in focus, press CTRL + E or select the magnifying glass to stop data capture.
6. Select File > Save > All Events > PML, and choose a path to save the .PML file
7. Go to %windir%\logs\cbs, open the last Cbs.log file, and search for the error. After finding the error line a bit above, you should have the file being accessed during the installation that is giving the sharing violation error
8. In Process Monitor, filter for path and insert the file name (it should be something like "path" "contains" "filename from CBS").
9. Try to stop it or uninstall the process causing the error.

0x80073701

Message Description Mitigation
ERROR_SXS_ASSEMBLY_MISSING; The referenced assembly couldn't be found. Typically, a component store corruption caused when a component is in a partially installed state. Repair the component store with Dism RestoreHealth command or manually repair it with the payload from the partially installed component. From an elevated command prompt, run these commands:
Dism.exe /Online /Cleanup-Image /Restorehealth
Sfc.exe /Scannow
Restart the device.

0x8007371b

Message Description Mitigation
ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE; One or more required members of the transaction aren't present. Component Store corruption. Repair the component store with Dism RestoreHealth command or manually repair it with the payload from the partially installed component. From an elevated command prompt and run these commands:
Dism.exe /Online /Cleanup-Image /Restorehealth
Sfc.exe /Scannow
Restart the device.

0x80072EFE

Message Description Mitigation
WININET_E_CONNECTION_ABORTED; The connection with the server was closed abnormally BITS is unable to transfer the file successfully. Encountered if BITS is broken or if the file being transferred can't be written to the destination folder on the client. This error is caused by connection errors while checking or downloading updates.
From a cmd prompt run: BITSADMIN /LIST /ALLUSERS /VERBOSE
Search for the 0x80072EFE error code. You should see a reference to an HTTP code with a specific file. Using a browser, try to download it manually, making sure you're using your organization's proxy settings. If the download fails, check with your proxy manager to allow for the communication to be sucesfull. Also check with your network team for this specific URL access.

0x80072F8F

Message Description Mitigation
WININET_E_DECODING_FAILED; Content decoding has failed TLS 1.2 isn't configured correctly on the client. This error generally means that the Windows Update Agent was unable to decode the received content. Install and configure TLS 1.2 by installing the update in KB3140245.

0x80072EE2

Message Description Mitigation
WININET_E_TIMEOUT; The operation timed out Unable to scan for updates due to a connectivity issue to Windows Update, Configuration Manager, or WSUS. This error generally means that the Windows Update Agent was unable to connect to the update servers or your own source, such as WSUS, Configuration Manager, or Microsoft Intune.
Check with your network team to ensure that the device can reach the update sources. For more info, see Troubleshoot software update scan failures in Configuration Manager.
If you're using the public Microsoft update servers, check that your device can access the following Windows Update endpoints:
http://windowsupdate.microsoft.com
https://*.windowsupdate.microsoft.com
https://update.microsoft.com
https://*.update.microsoft.com
https://windowsupdate.com
https://*.windowsupdate.com
https://download.windowsupdate.com
https://*.download.windowsupdate.com
https://download.microsoft.com
https://*.download.windowsupdate.com
https://wustat.windows.com
https://*.wustat.windows.com
https://ntservicepack.microsoft.com

0x80240022

Message Description Mitigation
WU_E_ALL_UPDATES_FAILED; Operation failed for all the updates. Multiple root causes for this error. Most common issue is that antivirus software is blocking access to certain folders (like SoftwareDistribution). CBS.log analysis needed to determine the file or folder being protected.

0x8024401B

Message Description Mitigation
WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ; Same as HTTP status 407 - proxy authentication is required. Unable to authenticate through a proxy server. Either the Winhttp proxy or WinInet proxy settings aren't configured correctly. This error generally means that the Windows Update Agent was unable to connect to the update servers or your own update source, such as WSUS, Configuration Manager, or Microsoft Intune, due to a proxy error.
Verify the proxy settings on the client. The Windows Update Agent uses WinHTTP to scan for available updates. When there's a proxy server between the client and the update source, the proxy settings must be configured correctly on the clients to enable them to communicate by using the source's FQDN.
Check with your network and proxy teams to confirm that the device can the update source without the proxy requiring user authentication.

0x80244022

Message Description Mitigation
WU_E_PT_HTTP_STATUS_SERVICE_UNAVAILABLE; Same as HTTP status 503 - the service is temporarily overloaded. Unable to connect to the configured update source. Network troubleshooting needed to resolve the connectivity issue. Check with your network and proxy teams to confirm that the device can the update source without the proxy requiring user authentication.

0x80070490

Message Description Mitigation
ERROR_NOT_FOUND This error occurs during driver installation as part of the update. This issue occurs because details such as the architecture for a driver that's being updated are missing in the registry. Manually add the missing inf file Arch value in the Driver operations registry by following these steps:
1. Open regedit and navigate to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ComponentBasedServicing\DriverOperations\0\2(SequenceID)
2. Review the Identity value to determine the value that is missing.
3. Manually add the missing value referring to the information in the Identity value. For example, Name: Arch; Type: REG_SZ (String Value); Data: amd64.
4. Proceed with installing the failing update.

0x800f0922

Message Description Mitigation
CBS_E_INSTALLERS_FAILED The July cumulative update failed to be installed on Windows Server 2016 In the CBS.log, you may find that updates sometimes roll back when License and Product key tokens fail to be updated. This issue can be resolved by adding write permissions for the "User" and "Network Service" accounts to the C:\Windows\System32\spp\ folder.

0x80070bc9

Message Description Mitigation
ERROR_FAIL_REBOOT_REQUIRED The TrustedInstaller service startup type is set to "Manual" by Group Policy (GPO), which prevented it from starting to complete pending operations. The TrustedInstaller service changes the startup type from Manual to Automatic when it encounters an update that has to process a transaction after a restart. When the value is set back to Manual before the restart, the transaction cannot be applied. This transaction will be pending and block all other update installations.
To fix this issue, change the TrustedInstaller policy to Automatic and restart the computer. If it doesn't work, start the computer to WinRE to revert the pending actions. For example, dism /Image:C:\ /Cleanup-Image /RevertPendingActions. If it doesn't work either, start the computer to WinRE, rename \WinSxS\Pending.xml, and remove the PendingXMLIdentifier from COMPONENTS Hive.

0x800706be

Message Description Mitigation
Failed to install cumulative updates Windows Server 2016 Std failed to install cumulative packages by using the .msu package. No error is returned. When installing the packages with dism.exe, it returned the error 0x800706be. The last cumulative update failed to install and was corrupted. To resolve this issue, navigate to the registry key for the corrupted update package. Change the "current state" value to 000020 hex (32 dec) - resolved, or 000040 hex (64 dec) - staged, or 000070 hex (112 dec) - installed.

Data collection

If you need assistance from Microsoft support, we recommend you collect the information by following the steps mentioned in Gather information by using TSS for deployment-related issues.