Windows 11 updates failing — stuck at a percentage, showing error codes, or rolling back automatically — is frustrating precisely because Windows Update doesn’t always explain why it failed. Understanding the error code makes troubleshooting specific rather than guesswork. For a broader walkthrough, our Complete Guide to Fixing Windows, Browser, and Software Errors is a good next read.
Find your error code first: Settings → Windows Update → Update history → look at the failed update entry — it should show a code like 0x80070005, 0x80073712, or similar. If no code is visible: Event Viewer → Windows Logs → Setup → look for “error” entries from the update period. Once you have the code, use the table below to identify the cause.
Most common error codes and what they mean
| Error Code | Cause | Fix |
| 0x80070005 | Access denied — permissions issue | Run Windows Update troubleshooter; check antivirus |
| 0x80073712 | Component Store corruption | DISM /RestoreHealth; then SFC /scannow |
| 0x8007000D | Invalid data / corrupted update file | Clear SoftwareDistribution folder |
| 0x800F0922 | Not enough disk space or VPN blocking update | Free at least 20 GB on C:; disconnect VPN |
| 0x80072EFE | Network connection interrupted | Check internet connection; retry on stable network |
| 0xC1900101 | Driver incompatibility (very common) | Update problematic driver; check hardware compatibility |
| 0x80240034 | Windows Update database issue | Full Windows Update component reset |
| 0x800705B4 | Timeout — update took too long | Retry; clear cache; check antivirus overhead |
Fix 1: Windows Update troubleshooter (try this first)
Settings → System → Troubleshoot → Other troubleshooters → Windows Update → Run. The troubleshooter checks for stopped services, corrupted download cache, and common configuration errors. It resolves many update failures automatically — running it takes 2 minutes and is always worth doing before manual steps.
Fix 2: Clear the update cache
Corrupted download files from previous update attempts are the most common cause of repeated update failures. Clearing the cache forces Windows to re-download clean files.
Administrator Command Prompt:
net stop wuauserv
net stop bits
rd /s /q C:WindowsSoftwareDistributionDownload
net start wuauserv
net start bits
After running: go back to Settings → Windows Update → Check for updates. Windows downloads fresh files and retries the failed update.
Fix 3: DISM and SFC for component store corruption
Error 0x80073712 specifically indicates corruption in the Windows Component Store — the repository of system files that updates deploy from. Fixing the component store before retrying the update is essential; otherwise the update will fail again for the same reason.
Administrator Command Prompt (run in this order):
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow
DISM repairs the component store by downloading clean files from Microsoft (requires internet). SFC then repairs individual files using the now-healthy component store as its source. Restart after both complete, then retry the update.
Fix 4: Driver incompatibility (error 0xC1900101)
Error 0xC1900101 means a driver crashed during the update process, causing the update to roll back. This is the most common cause of failed feature updates (major annual Windows upgrades). Windows logs which driver failed in the C:$WINDOWS.~BTSourcesRollback folder — look for setuperr.log which names the problematic driver.
Common incompatible driver categories:
- Antivirus kernel drivers (older security software)
- VPN client drivers
- Storage controller drivers (older NVMe or RAID drivers)
- Older third-party NIC drivers
Temporarily uninstalling the problematic software before running the update, then reinstalling after, often resolves 0xC1900101 failures. After identifying the driver from setuperr.log: update that driver first, then retry the update.
Fix 5: Disk space
Windows updates need staging space to extract files before installation — typically 5-20 GB for cumulative updates and 20+ GB for feature updates. Settings → System → Storage → check available space on C:. If under 20 GB free: run Disk Cleanup (search “Disk Cleanup” → run as administrator → “Clean up system files” → check “Windows Update Cleanup” and “Temporary files”).
Also check: Settings → System → Storage → “Temporary files” → review and remove items Windows identifies as safe to delete.
Fix 6: Full Windows Update component reset
When the troubleshooter and cache clear don’t resolve persistent failures: a complete reset of all update infrastructure services:
net stop wuauserv && net stop cryptSvc && net stop bits && net stop msiserver
ren C:WindowsSoftwareDistribution SoftwareDistribution.old
ren C:WindowsSystem32catroot2 catroot2.old
net start wuauserv && net start cryptSvc && net start bits && net start msiserver
This renames the update database folders (Windows recreates them fresh) and restarts all related services. More thorough than just clearing the download cache — it resets the entire update state database.
Fix 7: Manual update via Microsoft Update Catalog
For a specific update that keeps failing through Windows Update: install it manually. Note the KB number from Update history → go to catalog.update.microsoft.com → search the KB number → download the .msu file for your architecture (x64 for most machines) → run it. This bypasses the Windows Update Agent’s download and queueing mechanism, which occasionally gets stuck on specific updates.
Our guide on slow Windows updates covers the performance side of update problems including the HDD vs SSD bottleneck and delivery optimization settings. For update issues after a specific error that points to disk problems, our disk health guide covers the SMART diagnostics and disk checking approach. Microsoft’s Windows Update error code documentation maintains a comprehensive database of error codes with specific resolution steps — particularly useful for less-common codes not covered above.
Update rollback after apparent success
An update that installs, restarts, then automatically rolls back during “Undoing Changes” on second restart is a different failure mode from an update that fails to install. Rollback after restart means:
- The update files installed correctly
- But during first-boot configuration (applying settings, migrating registry, updating drivers), something failed
- Windows detected the failure and rolled back to protect stability
The rollback log is in C:WindowsLogsCBS — look for CBS.log entries from the failed restart period. Also check C:$WINDOWS.~BTSourcesRollbacksetupact.log for feature updates. These logs name the specific component that failed during post-install configuration — usually a driver, service, or registry migration that the update couldn’t complete.
Antivirus and update interference
Real-time antivirus scanning can interfere with update installation in two ways: holding file locks that prevent update files from writing correctly, and occasionally quarantining update-related executables that look suspicious to behavioural scanning.
Temporarily disable real-time protection before running a failed update: right-click the antivirus icon → Disable protection → specify 1 hour → attempt the update. Re-enable immediately after. For corporate antivirus products that can’t be temporarily disabled: submit a support ticket to IT to exclude Windows Update processes from real-time scanning during the update window.
VPN blocking Windows Update
Error 0x800F0922 often indicates that Windows Update can’t reach Microsoft’s update servers — one common cause is a VPN that routes update traffic through an exit node that Microsoft’s update CDN rejects. Disconnect any VPN → retry the update. If it succeeds without VPN: the VPN’s routing or exit IP was blocking the update traffic.
For work VPNs where disconnecting isn’t practical: Always-On VPN configurations can include split tunneling rules that exclude Windows Update traffic from the tunnel, allowing updates to reach Microsoft’s servers directly.
Windows 11 version compatibility
Feature updates (major annual upgrades like 22H2, 23H2) have specific hardware requirements. A machine that barely met Windows 11’s minimum specs may fail feature updates due to: insufficient RAM during the update process (Windows needs more RAM mid-update than at normal operation), specific CPU instructions required by the new version, or storage health issues that become critical during the intensive update process.
Check whether your machine meets the new version’s requirements at microsoft.com/windows/windows-11-specifications. If hardware is marginal: ensuring the machine has only essential applications running during the update and has adequate free disk space gives the best chance of success.
Using the Windows 11 Update Assistant
For feature updates that consistently fail through Settings → Windows Update: the Windows 11 Installation Assistant (downloadable from microsoft.com/windows/windows-11) is an alternative installation path. It runs the upgrade process through a different mechanism than Windows Update — useful when Windows Update’s installation pipeline is broken but the hardware and software are otherwise compatible.
The Installation Assistant downloads and installs the current Windows 11 version directly, bypassing the Windows Update Agent and its associated caching and queuing. It’s the most reliable path for feature updates that fail repeatedly through normal Windows Update.
Update fails on specific hardware (enterprise)
In enterprise environments: updates failing on specific hardware models usually indicate a driver or firmware incompatibility that Microsoft or the hardware vendor hasn’t resolved yet. Windows Update for Business and WSUS provide tools to defer specific updates for specific hardware groups until compatibility is confirmed.
Check the Windows Health Dashboard (admin.microsoft.com → Health → Windows release health) for known compatibility issues with the failing update. Microsoft documents known issues with update releases and provides safeguard holds — automatic deferrals for machines that would fail a specific update — that prevent the update from being offered until the issue is resolved.
In-place upgrade as a repair tool
When Windows Update consistently fails and DISM/SFC haven’t fully resolved the underlying corruption: an in-place upgrade repairs Windows without deleting applications or files. Download Windows 11 ISO from Microsoft → mount it (double-click or right-click → Mount) → run setup.exe → choose “Upgrade this PC now” → keep personal files and apps. The installation re-copies all Windows system files while preserving user data and installed applications.
This is more thorough than SFC/DISM and resolves corruption that those tools can’t reach. After completing: Windows Update works normally because the system files it depends on have been restored to a clean state.
Windows Update service dependencies
Windows Update depends on several services that must be running. Win+R → services.msc → confirm these services are running and set to Automatic:
- Windows Update (wuauserv)
- Background Intelligent Transfer Service (BITS)
- Cryptographic Services (CryptSvc)
- Windows Update Medic Service (WaaSMedicSvc) — note: this service is protected and can’t be easily stopped or disabled
If any of these are stopped and don’t start: right-click → Properties → check the “Log on” tab — the service account may not have appropriate permissions. The recovery tab should also show “Restart the Service” for first failure actions.
Windows Update failing is one of the more complex problems to diagnose because it can fail at so many different points: download, staging, installation, post-install configuration, or rollback. The error code is the most important piece of information — it identifies which phase failed and directs the fix immediately. Without the error code, troubleshooting is much less targeted. Always start by finding and looking up the code before applying fixes.
One note on update patience: some updates, particularly monthly cumulative updates on HDDs and feature upgrades on any machine, legitimately take 30-120 minutes with extended periods showing no visible progress. An update appearing “stuck” at 40% for 20 minutes is often still actively working. Task Manager → CPU and Disk tabs — if TrustedInstaller is consuming disk I/O: the update is processing. Only truly zero disk activity sustained for 15+ minutes indicates a genuine stall. Forcing a shutdown during an active update is more likely to cause problems than waiting it out.
Windows Update log analysis
For the most detailed update failure diagnosis: Administrator PowerShell → Get-WindowsUpdateLog. This converts the raw ETL trace files into a readable WindowsUpdate.log file on the Desktop. Opening this log and searching for “FAILED” or “error” entries near the timestamp of the failed update shows the exact technical cause — more specific than the Event Viewer entries and more actionable than generic error codes alone.
The log is verbose but the timestamp-filtered search makes it tractable. Providing this log to Microsoft Support or IT administrators dramatically speeds up diagnosis for unusual update failures that don’t match any known error code pattern.
For machines that regularly fail updates: a scheduled maintenance window where the machine is left running overnight — with only Windows Update active and all other applications closed — gives the most reliable update conditions. The absence of competing disk I/O, CPU load, and network bandwidth means the update process has full system resources and is least likely to time out or conflict with other activity. Combining this with the cache clear before the scheduled window gives consistent update success even on machines that previously struggled. If this sounds familiar, Google Chrome Not Updating is worth a look.
If Windows Update continues failing after all these steps and the system is otherwise healthy: the Windows Update service stack may have deeper corruption that only an in-place upgrade or clean install resolves. The in-place upgrade (downloading Windows 11 ISO and running setup.exe → Upgrade) is the recommended path as it preserves all applications and files while replacing all Windows system files with clean copies. A clean install is the nuclear option — completely resolves all update issues but requires reinstalling all applications. Reserve clean install for situations where the in-place upgrade also fails or the machine has accumulated enough configuration debt to warrant starting fresh. Our guide on Windows 11 Slow After Update covers an adjacent issue.
