A stuck Windows Update is one of the most common issues IT admins and end users face. This guide covers every verified method ordered from least to most invasive, so you work through them systematically.
Scenario A — Stuck downloading or installing
What you see: A percentage frozen for 1+ hour in Settings → Windows Update.
Start at: Steps 2 → 3 → 6
Scenario B — Fails and rolls back with an error code
What you see: “We couldn’t complete the updates, undoing changes.”
Start at: Step 10 (error codes), then Steps 5 → 6
Scenario C — Frozen at boot
What you see: “Working on updates…” screen frozen for 2+ hours.
Start at: Step 9 directly
✓ Microsoft Official
| Check | How to verify |
|---|
| Stable internet | Settings → Network & Internet — no VPN active |
| Date and time correct | Settings → Time & Language → enable “Set time automatically” |
| 20 GB+ free disk space | Settings → System → Storage. Feature updates need 20 GB (64-bit) |
| Disable 3rd-party antivirus temporarily | Right-click tray icon → Disable for 15 minutes. Re-enable after update. |
| Disconnect unnecessary USB devices | Driver conflicts can silently block updates |
| Full shutdown then power on | A pending restart from a previous update blocks new ones. Full shutdown → power on (not restart) |
Windows Defender Firewall must be running. If it is disabled, BITS (the update downloader) fails with 0x800706D9. Open services.msc and confirm it is Automatic and Running before proceeding.
✓ Microsoft Official
Always run this first. It automatically detects stopped services, corrupted caches, and misconfigured settings — and fixes most common problems automatically.
Windows Settings — Navigation path
Settings
›
System
›
Troubleshoot
›
Other troubleshooters
›
Windows Update → Run
On Windows 10: Settings → Update & Security → Troubleshoot → Windows Update → Run the troubleshooter
Command Prompt (Administrator) — alternative launch
C:\> msdt.exe /id WindowsUpdateDiagnostic
# Launches the Windows Update Troubleshooter automatically
If the troubleshooter reports “fixed”: Restart and try Windows Update again. In many cases this alone resolves a stuck update.
✓ Microsoft Official — Most guides skip this. Often the root cause on older builds.
The Servicing Stack is the component that installs Windows updates. If it is outdated it can fail to process newer cumulative updates. Since February 2021, Windows 10 v2004 and later bundle the SSU inside the monthly cumulative update — so this mainly applies to older builds and Windows Server.
How: Go to
catalog.update.microsoft.com, search “Servicing Stack Update” + your Windows version, download for your architecture, and install it
before retrying the cumulative update.
Command Prompt — identify your Windows version and architecture
C:\> systeminfo | findstr /B /C:"OS" /C:"System Type"
OS Name: Microsoft Windows 11 Pro
OS Version: 10.0.26100 N/A Build 26100
System Type: x64-based PC
✓ Microsoft Official
Run DISM first to repair the Windows image store, then SFC to fix protected system files. Always in this order — running SFC first when the image is corrupt just replicates the corruption.
Command Prompt (Administrator) — Run as Admin required
# Step 1: Repair the Windows image (downloads from Windows Update — needs internet)
C:\> DISM /Online /Cleanup-Image /RestoreHealth
[==========================100.0%==========================]
The restore operation completed successfully.
# Step 2: Repair protected system files using the now-repaired image
C:\> sfc /scannow
Beginning system scan. This process will take some time.
Windows Resource Protection found corrupt files and successfully repaired them.
# Step 3: Schedule disk error repair on next reboot
C:\> chkdsk C: /f /r
Would you like to schedule this volume to be checked the next time the system restarts? (Y/N)
Y
This volume will be checked the next time the system restarts.
No internet for DISM? Mount a Windows ISO and use: DISM /Online /Cleanup-Image /RestoreHealth /Source:wim:D:\sources\install.wim:1 /LimitAccess
After all three commands, restart the PC and try Windows Update again.
✓ Microsoft Official
Stops all Windows Update services, clears the download cache, re-registers all BITS and Windows Update DLLs, then restarts the services clean. Documented by Microsoft in KB971058 and multiple support articles.
Open Command Prompt as Administrator (right-click Start → Terminal (Admin)). Run each block in sequence — do not skip steps.
Command Prompt (Administrator) — Windows Update Component Reset
# ── STEP 1: Stop all Windows Update services ─────────────────────────
C:\> net stop wuauserv
The Windows Update service was stopped successfully.
C:\> net stop bits
The Background Intelligent Transfer Service was stopped successfully.
C:\> net stop cryptsvc
The Cryptographic Services service was stopped successfully.
C:\> net stop msiserver
The Windows Installer service was stopped successfully.
# ── STEP 2: Rename update cache folders (reversible) ─────────────────
C:\> ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
C:\> ren C:\Windows\System32\catroot2 catroot2.old
# ── STEP 3: Re-register Windows Update and BITS DLLs ────────────────
C:\> regsvr32.exe /s atl.dll & regsvr32.exe /s urlmon.dll & regsvr32.exe /s mshtml.dll
C:\> regsvr32.exe /s shdocvw.dll & regsvr32.exe /s browseui.dll & regsvr32.exe /s jscript.dll
C:\> regsvr32.exe /s vbscript.dll & regsvr32.exe /s msxml.dll & regsvr32.exe /s msxml3.dll
C:\> regsvr32.exe /s msxml6.dll & regsvr32.exe /s actxprxy.dll & regsvr32.exe /s softpub.dll
C:\> regsvr32.exe /s wintrust.dll & regsvr32.exe /s dssenh.dll & regsvr32.exe /s rsaenh.dll
C:\> regsvr32.exe /s gpkcsp.dll & regsvr32.exe /s sccbase.dll & regsvr32.exe /s slbcsp.dll
C:\> regsvr32.exe /s cryptdlg.dll & regsvr32.exe /s oleaut32.dll & regsvr32.exe /s ole32.dll
C:\> regsvr32.exe /s shell32.dll & regsvr32.exe /s wuapi.dll & regsvr32.exe /s wuaueng.dll
C:\> regsvr32.exe /s wucltui.dll & regsvr32.exe /s wups.dll & regsvr32.exe /s wups2.dll
C:\> regsvr32.exe /s wuweb.dll & regsvr32.exe /s qmgr.dll & regsvr32.exe /s qmgrprxy.dll
C:\> regsvr32.exe /s wucltux.dll & regsvr32.exe /s muweb.dll & regsvr32.exe /s wuwebv.dll
# ── STEP 4: Restart services ─────────────────────────────────────────
C:\> net start wuauserv
The Windows Update service was started successfully.
C:\> net start cryptsvc & net start bits & net start msiserver
Services started successfully.
# ── STEP 5 (optional): Reset BITS download queue ─────────────────────
C:\> bitsadmin /reset /allusers
0 out of 0 jobs cancelled.
Restart after running this script, then go to Settings → Windows Update. The SoftwareDistribution rename forces a clean re-download; the catroot2 rename rebuilds the signature database. Both are reversible — rename .old back to the original name if needed.
✓ Microsoft Official
If one specific update keeps failing, bypass the Windows Update client entirely and install it manually from the catalog.
Command Prompt (Administrator)
# 1. Find KB: Settings → Windows Update → Update history
# 2. Download from catalog.update.microsoft.com (match OS + architecture x64/ARM64)
# 3. Install silently:
C:\> wusa.exe "C:\Downloads\windows11.0-kb5039212-x64.msu" /install /quiet /norestart
The update was installed successfully.
# Remove /norestart to reboot immediately after install
✓ Microsoft Official
A third-party app or startup service can silently block Windows Update. Clean boot starts Windows with only Microsoft services running. If updates succeed in clean boot, a third-party app is the culprit.
── In System Configuration ────────────────────────────────────
1. Services tab → “Hide all Microsoft services” → “Disable all”
2. Startup tab → “Open Task Manager” → Disable all startup items
3. Close Task Manager → OK → Restart
── After restart (clean boot) ───────────────────────────────────
4. Try Windows Update — if it works, a disabled service is the culprit
5. Re-enable one group at a time to identify the cause
6. Undo: msconfig → General → Normal startup → Restart
Always undo the clean boot after testing. Leaving the machine in clean boot state prevents security tools and other critical services from loading.
✓ Microsoft Official
Boot recovery — follow in order
1Wait 2–3 hours for major feature updates before assuming truly stuck.
2Force shutdown — hold power button 10 seconds. Power on again.
3After 2–3 failed boots, Windows enters Automatic Repair automatically.
4In Automatic Repair: Troubleshoot → Advanced options → Uninstall Updates → Uninstall latest quality update. Try feature update if quality update doesn’t help.
5Once back in Windows, run Steps 5 and 6, then retry the update.
✓ Microsoft Official
| Error Code | Meaning | Primary Fix |
|---|
| 0x80070002 | File not found — required update file missing or corrupt | DISM + SFC (Step 5), then reset components (Step 6) |
| 0x80070003 | Path not found — same root cause as 0x80070002 | Reset Update components (Step 6) |
| 0x80070005 | Access denied — permissions issue on update files | Check antivirus; run DISM and SFC; reset components |
| 0x80070422 | Windows Update service disabled | services.msc → set to Automatic → net start wuauserv |
| 0x800706D9 | Windows Defender Firewall not running — blocks BITS downloads | services.msc → Windows Defender Firewall → Automatic → Start |
| 0x8024402C | Cannot connect to Windows Update — proxy or network issue | netsh winhttp show proxy then netsh winhttp import proxy source=ie |
| 0x8024402D | Server load-shedding — transient, server-side only | Wait 30–60 minutes and retry. Microsoft confirms this self-resolves. |
| 0x80240034 | Windows Update engine issue | Reset components (Step 6); verify date/time; check proxy |
| 0x800F0922 | Feature update failed — often low disk or VPN blocking | Free 20 GB+; disconnect VPN; run DISM; try manual catalog install |
| 0xC1900101 | Driver compatibility blocking feature update | Device Manager → update or uninstall flagged drivers (network / graphics first) |
| 0x80070426 | Microsoft Account Sign-in Assistant not running — blocks feature update scans | services.msc → “Microsoft Account Sign-in Assistant” → Manual → Start |
| 0x8007000D | Corrupt update download cache | Reset Update components (Step 6) — renames SoftwareDistribution for a fresh download |
Where to find your error code: Settings → Windows Update → Update history → Failed updates. Or Event Viewer → Windows Logs → System, filter source “WindowsUpdateClient”.
✓ Microsoft Official
Reinstalls Windows over itself, replacing all system files with fresh copies while preserving apps, settings, and data. Very high success rate for persistent update failures.
Back up first. If BitLocker is enabled, have the recovery key ready before starting.
Download setup.exe from microsoft.com/software-download/windows11
C:\Downloads\Win11Setup> setup.exe /auto upgrade /quiet /noreboot
Ready to install: Keeping personal files and apps
Your PC will restart several times. This might take a while.
# Alternatively: mount a Windows ISO → Mount → run setup.exe → Keep personal files and apps
Additional community-validated fixes
Fix the Windows Module Installer (TrustedInstaller) service
If TrustedInstaller is set to Disabled, Windows components and updates cannot install. Widely reported fix across Microsoft Answers and Spiceworks.
C:\> SC config trustedinstaller start=auto
[SC] ChangeServiceConfig SUCCESS
C:\> net start trustedinstaller
The Windows Modules Installer service was started successfully.
Fix WinHTTP proxy on corporate networks (0x8024402C)
Windows Update uses WinHTTP system-level proxy, not the browser proxy. On corporate networks this mismatch silently breaks downloads and is one of the most commonly missed fixes among sysadmins.
C:\> netsh winhttp show proxy
Direct access (no proxy server).
# Import browser proxy to WinHTTP:
C:\> netsh winhttp import proxy source=ie
WinHTTP proxy settings: Proxy Server(s) = proxy.company.com:8080
Quick commands reference
Useful commands
UsoClient StartScan
Force update scan (Win 10/11)
UsoClient StartDownload
Force download pending updates
UsoClient StartInstall
Force install downloaded updates
wuauclt /detectnow
Force update scan (legacy)
Get-WindowsUpdateLog
Generate Windows Update log (PowerShell)
services.msc
Open Services manager
eventvwr.msc
Open Event Viewer (for error codes)
cleanmgr
Disk Cleanup (includes WU cache)
Official Microsoft sources