My windows server will not complete updates.

Question

Neither windows update nor windows defender will complete updates. Windows update reports cannot connect to the update service. Windows defender the app couldn't connect.

I have internet access since I can open and move through a webpage. NIC shows that I do indeed have a connection to the internet. I have refreshed and restarted our local DNS. I tried changing our DNS server to the Google dns server without success.

Answer 1

Hello Brian Allison, thank you for posting in the Microsoft Q&A community.

This behavior typically occurs because standard web browsers run in user context via the WinINet network stack, whereas background system services—including Windows Update, Windows Defender, and BITS (Background Intelligent Transfer Service)—run under the SYSTEM account using WinHTTP. If WinHTTP proxy settings, Windows Defender Firewall services, or WSUS group policy redirections are misconfigured, system-level updates will fail to reach Microsoft endpoints even when internet browsing works.

To resolve this issue, please try the resolution steps:

1. Verify and Reset WinHTTP Proxy Settings

Open an elevated Command Prompt (Run as administrator) and check if a system proxy is configured:

netsh winhttp show proxy

If an unintended proxy server is listed, reset the WinHTTP proxy settings to direct access:

netsh winhttp reset proxy

2. Verify Windows Defender Firewall Service Status

Windows Update requires the Windows Defender Firewall service to be active to handle socket connections. Press Win + R, type services.msc, and press Enter. Ensure that the Windows Defender Firewall service (MpsSvc) is running and set to Automatic.

3. Check WSUS Registry Redirections

If the server was configured via Group Policy to pull updates from an internal WSUS server that is currently unreachable, external updates will fail. Open Registry Editor (regedit.exe) and check the following key path:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

If WUServer exists, check under HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU for the DWORD value UseWUServer. If it is set to 1, temporarily change UseWUServer to 0 and restart the Windows Update service to force the server to check Microsoft directly.

4. Reset Windows Update and BITS Components

Open an elevated PowerShell session and run the following script to reset the update cache:

Stop-Service -Name wuauserv, bits, cryptsvc -Force

Remove-Item -Path "C:\Windows\SoftwareDistribution\*" -Recurse -Force -ErrorAction SilentlyContinue

Remove-Item -Path "C:\Windows\System32\catroot2\*" -Recurse -Force -ErrorAction SilentlyContinue

Start-Service -Name cryptsvc, bits, wuauserv

If the standard steps do not resolve the issue, perform a network stack reset in an elevated Command Prompt and reboot the server:

netsh winsock reset

netsh int ip reset

ipconfig /flushdns

Official Microsoft Documentation:

• Troubleshoot Windows Update download errors: https://learn.microsoft.com/en-us/troubleshoot/windows-server/deployment/troubleshoot-windows-update-download-errors
• How the Windows Update client determines which proxy server to use: https://learn.microsoft.com/en-us/troubleshoot/windows-client/deployment/how-windows-update-client-determines-which-proxy-server-to-use
• Netsh WinHTTP Commands: https://learn.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts

Answer 2

Since web browsing works but Windows Update and Windows Defender both cannot connect, focus on DNS resolution, proxy selection, Windows Update logs, and the Windows Defender Firewall service.

1. Verify whether Windows Update hostnames resolve correctly. Open Command Prompt and run:

      nslookup sls.update.microsoft.com
      nslookup fe2.update.microsoft.com
      nslookup fe3.delivery.mp.microsoft.com
      nslookup au.download.windowsupdate.com
      nslookup sls.update.microsoft.com.nsatc.net
      nslookup fe2.update.microsoft.com.nsatc.net
      nslookup fe3.delivery.dsp.mp.microsoft.com.nsatc.net
      nslookup audownload.windowsupdate.nsatc.net
   

   Expected result: each query returns hostname information with populated Addresses values. If the output shows blank Name, Addresses, or Aliases, the network DNS path is still affected.
2. If DNS resolution is bad, use one of the documented mitigations.
   • Flush the DNS records for those Windows Update hostnames on the DNS servers that serve clients.
   • If that is not immediately possible, connect the server to another network that is not affected.
   • Or temporarily configure the server to use an alternate DNS provider until the network DNS entries are updated.
3. Check Windows Update logs for connection-related errors. Review logs at:

      %windir%\logs\windowsupdate
   

   Connection failures commonly appear with codes such as:
   • 0x80072EE7 or 0x8024402C for DNS resolution failure
   • 0x80072EFD for inability to connect
   • 0x80072F8F for TLS certificate validation failure
   • 0x80240438 for general network failure
4. Verify proxy configuration behavior. Windows Update uses the system proxy path first for update detection through WinHTTP. It can discover a proxy only if:
   • the proxy is manually configured by Netsh, or
   • WPAD is configured through DNS or DHCP.
   If a proxy is configured incorrectly at the system level, Windows Update can fail even when normal browser access works.
5. Make sure the Windows Defender Firewall service is enabled. A disabled Windows Defender Firewall service can cause update downloads to stall at 0% and produce 0x800706D9 in Windows Update logs. In Services.msc, confirm that Windows Defender Firewall is enabled. Stopping that service is not supported.
6. Clear the Windows Update cache. This can remove corrupted cached update files. Note: this deletes the local update cache only.
   • Press Win + R, type services.msc, and press Enter.
   • Stop the Windows Update service.
   • Go to C:\Windows\SoftwareDistribution.
   • Delete the files and folders inside.
   • Start the Windows Update service again.
7. If the server is an Azure VM, network/proxy symptoms that match this issue include scan failures, download failures, and WindowsUpdate.log entries such as Send failed with hr = 80072efd.

If DNS lookups are correct, the next highest-value checks are the system proxy path and whether the Windows Defender Firewall service is disabled.

---

References:

• Isolated ISP DNS issues preventing connections to Windows Update service
• Troubleshoot Windows Update download errors
• How the Windows Update client determines which proxy server to use to connect to the Windows Update website
• Windows Update issues troubleshooting
• Troubleshoot problems updating Windows
• Troubleshoot Windows Update network and proxy issues on Azure VMs