Fix Windows Update errors by using the DISM or System Update Readiness tool

Original product version: В Windows 10, version 1809 and later versions, Windows 8.1, Windows Server 2012 R2, Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1
Original KB number: В 947821

Symptom

Windows updates and service packs may fail to install if there are corruption errors. For example, an update might not install if a system file is damaged. The DISM or System Update Readiness tool may help you to fix some Windows corruption errors.

This article is intended for Support agents and IT professionals. If you are home users and looking for more information about fixing Windows update errors, see Fix Windows Update errors.

Resolution for Windows 8.1, Windows 10 and Windows Server 2012 R2

To resolve this problem, use the inbox Deployment Image Servicing and Management (DISM) tool. Then, install the Windows update or service pack again.

Open an elevated command prompt. To do this, open Start menu or Start screen, type Command Prompt, right-select Command Prompt, and then select Run as administrator. If you are prompted for an administrator password or for a confirmation, type the password, or select Allow.

Type the following command, and then press Enter. It may take several minutes for the command operation to be completed.

When you run this command, DISM uses Windows Update to provide the files that are required to fix corruptions. However, if your Windows Update client is already broken, use a running Windows installation as the repair source, or use a Windows side-by-side folder from a network share or from a removable media, such as the Windows DVD, as the source of the files. To do this, run the following command instead:

Replace the C:\RepairSource\Windows placeholder with the location of your repair source. For more information about using the DISM tool to repair Windows, reference Repair a Windows Image.

Type the sfc /scannow command and press Enter. It may take several minutes for the command operation to be completed.

Close the command prompt, and then run Windows Update again.

DISM creates a log file (%windir%/Logs/CBS/CBS.log) that captures any issues that the tool found or fixed. %windir% is the folder in which Windows is installed. For example, the %windir% folder is C:\Windows.

Resolution for Windows 7 Service Pack 1 (SP1) and Windows Server 2008 R2 SP1

To resolve this problem, use the System Update Readiness tool. Then, install the Windows update or service pack again.

Download the System Update Readiness tool.

select the download link in the following table that corresponds to the version of Windows that is running on your computer. For more information about how to find the version of Windows that you installed, see Find out if your computer is running the 32-bit or 64-bit version of Windows.

This tool is updated regularly, we recommend that you always download the latest version. This tool is not available in every supported language. Check the link below to see if it is available in your language.

Operating system	Download link
x86-based (32-bit) versions of Windows 7 SP1	Download the package now.
x64-based (64-bit) versions of Windows 7 SP1	Download the package now.
x64-based (64-bit) versions of Windows Server 2008 R2 SP1	Download the package now.
Itanium-based versions of Windows Server 2008 R2 SP1	Download the package now.

Install and run the tool.

Select Download on the Download Center webpage, then do one of the following:

• To install the tool immediately, select Open or Run, and then follow the instructions on your screen.
• To install the tool later, select Save, and then download the installation file to your computer. When you’re ready to install the tool, double-select the file.

In the Windows Update Standalone Installer dialog box, select Yes.

When the tool is being installed, it automatically runs. Although it typically takes less than 15 minutes to run, it might take much longer on some computers. Even if the progress bar seems to stop, the scan is still running, so don’t select Cancel.

When you see Installation complete, select Close.

Reinstall the update or service pack you were trying to install previously.

To manually fix corruption errors that the tool detects but can’t be fixed, see How to fix errors that are found in the CheckSUR log file.

Resolution — Download the package from Microsoft Update Catalog directly

You can also try to directly download the update package from Microsoft Update Catalog, and then install the update package manually.

For example, you may have problems when you try to install updates from Windows Update. In this situation, you can download the update package and try to install the update manually. To do this, follow these steps:

Open Microsoft Update Catalog in Internet Explorer.

In the search box, input the update number that you want to download. In this example, input 3006137. Then, select Search.

Find the update that applies to your operating system appropriately in the search results, and then select Add to add the update to your basket.

Select view basket to open your basket.

Select Download to download the update in your basket.

Select Browse to choose a location for the update you are downloading, and then select Continue.

Select Close after the download process is done. Then, you can find a folder that contains the update package in the location that you specified.

Open the folder, and then double-select the update package to install the update.

If the Windows update or service pack installed successfully, you are finished. If the problem is not fixed, or if System Update Readiness Tool cannot find the cause, contact us for more help.

Description of the common corruption errors

The following table lists the possible error code with Windows Update for your reference:

Code	Error	Description
0x80070002	ERROR_FILE_NOT_FOUND	The system cannot find the file specified.
0x8007000D	ERROR_INVALID_DATA	The data is invalid.
0x800F081F	CBS_E_SOURCE_MISSING	The source for the package or file not found.
0x80073712	ERROR_SXS_COMPONENT_STORE_CORRUPT	The component store is in an inconsistent state.
0x800736CC	ERROR_SXS_FILE_HASH_MISMATCH	A component’s file does not match the verification information present in the component manifest.
0x800705B9	ERROR_XML_PARSE_ERROR	Unable to parse the requested XML data.
0x80070246	ERROR_ILLEGAL_CHARACTER	An invalid character was encountered.
0x8007370D	ERROR_SXS_IDENTITY_PARSE_ERROR	An identity string is malformed.
0x8007370B	ERROR_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME	The name of an attribute in an identity is not within the valid range.
0x8007370A	ERROR_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE	The value of an attribute in an identity is not within the valid range.
0x80070057	ERROR_INVALID_PARAMETER	The parameter is incorrect.
0x800B0100	TRUST_E_NOSIGNATURE	No signature was present in the subject.
0x80092003	CRYPT_E_FILE_ERROR	An error occurred while Windows Update reads or writes to a file.
0x800B0101	CERT_E_EXPIRED	A required certificate is not within its validity period when verifying against the current system clock or the time stamp in the signed file.
0x8007371B	ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE	One or more required members of the transaction are not present.
0x80070490	ERROR_NOT_FOUND	Windows could not search for new updates.
0x800f0984	PSFX_E_MATCHING_BINARY_MISSING	Matching component directory exist but binary missing
0x800f0986	PSFX_E_APPLY_FORWARD_DELTA_FAILED	Applying forward delta failed
0x800f0982	PSFX_E_MATCHING_COMPONENT_NOT_FOUND	Can’t identify matching component for hydration

What does the System Update Readiness tool do

Verify the integrity of resources

The System Update Readiness tool verifies the integrity of the following resources:

• Files that are located in the following directories:
  • %SYSTEMROOT%\Servicing\Packages
  • %SYSTEMROOT%\WinSxS\Manifests
• Registry data that is located under the following registry subkeys:
  • HKEY_LOCAL_MACHINE\Components
  • HKEY_LOCAL_MACHINE\Schema
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing

This list may be updated at any time.

When the System Update Readiness tool detects incorrect manifests, Cabinets, or registry data, it may replace the incorrect data with a corrected version.

Logging

The System Update Readiness tool creates a log file that captures any issues that the tool found or fixed. The log file is located here:

How to fix errors that are found in the CheckSUR log file

To manually fix corruption errors that the System Update Readiness tool detects but can’t fix, follow these steps:

%SYSTEMROOT% is an environment variable that saves the folder in which Windows is installed. For example, generally the %SYSTEMROOT% folder is C:\Windows.

Identify the packages that the tool can’t fix. For example, you may find the following in the log file:

In this case, the package that is corrupted is KB958690.

Copy the package (.msu) to the %SYSTEMROOT%\CheckSUR\packages directory. By default, this directory doesn’t exist and you need to create the directory.

Windows Update troubleshooting

If you run into problems when using Windows Update, start with the following steps:

Run the built-in Windows Update troubleshooter to fix common issues. Navigate to Settings > Update & Security > Troubleshoot > Windows Update.

Install the most recent Servicing Stack Update (SSU) that matches your version of Windows from the Microsoft Update Catalog. See Servicing stack updates for more details on servicing stack updates.

Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system:

Advanced users can also refer to the log generated by Windows Update for further investigation.

You might encounter the following scenarios when using Windows Update.

Why am I offered an older update?

The update that is offered to a device depends on several factors. The following are some of the most common attributes:

• OS Build
• OS Branch
• OS Locale
• OS Architecture
• Device update management configuration

If the update you’re offered isn’t the most current available, it might be because your device is being managed by a WSUS server, and you’re being offered the updates available on that server. It’s also possible, if your device is part of a deployment group, that your admin is intentionally slowing the rollout of updates. Since the deployment is slow and measured to begin with, all devices will not receive the update on the same day.

My device is frozen at scan. Why?

The Settings UI communicates with the Update Orchestrator service that in turn communicates with to Windows Update service. If these services stop unexpectedly, then you might see this behavior. In such cases, follow these steps:

Close the Settings app and reopen it.

Start Services.msc and check if the following services are running:

• Update State Orchestrator
• Windows Update

Feature updates are not being offered while other updates are

Devices running Windows 10, version 1709 through Windows 10, version 1803 that are configured to update from Windows Update (including Windows Update for Business) are able to install servicing and definition updates but are never offered feature updates.

Checking the WindowsUpdate.log reveals the following error:

The 0x80070426 error code translates to:

Microsoft Account Sign In Assistant (MSA or wlidsvc) is the service in question. The DCAT Flighting service (ServiceId: 855E8A7C-ECB4-4CA3-B045-1DFA50104289) relies on MSA to get the global device ID for the device. Without the MSA service running, the global device ID won’t be generated and sent by the client and the search for feature updates never completes successfully.

To resolve this issue, reset the MSA service to the default StartType of «manual.»

Issues related to HTTP/Proxy

Windows Update uses WinHttp with Partial Range requests (RFC 7233) to download updates and applications from Windows Update servers or on-premises WSUS servers. Therefore proxy servers on the network must support HTTP RANGE requests. If a proxy was configured in Internet Explorer (User level) but not in WinHTTP (System level), connections to Windows Update will fail.

To fix this issue, configure a proxy in WinHTTP by using the following netsh command:

You can also import the proxy settings from Internet Explorer by using the following command: netsh winhttp import proxy source=ie

If downloads through a proxy server fail with a 0x80d05001 DO_E_HTTP_BLOCKSIZE_MISMATCH error, or if you notice high CPU usage while updates are downloading, check the proxy configuration to permit HTTP RANGE requests to run.

You might choose to apply a rule to permit HTTP RANGE requests for the following URLs:

*.download.windowsupdate.com
*.dl.delivery.mp.microsoft.com *.delivery.mp.microsoft.com

If you can’t allow RANGE requests, you’ll be downloading more content than needed in updates (as delta patching will not work).

The update is not applicable to your computer

The most common reasons for this error are described in the following table:

Cause	Explanation	Resolution
Update is superseded	As updates for a component are released, the updated component will supersede an older component that is already on the system. When this occurs, the previous update is marked as superseded. If the update that you’re trying to install already has a newer version of the payload on your system, you might receive this error message.	Check that the package that you are installing contains newer versions of the binaries. Or, check that the package is superseded by another new package.
Update is already installed	If the update that you’re trying to install was previously installed, for example, by another update that carried the same payload, you may encounter this error message.	Verify that the package that you are trying to install was not previously installed.
Wrong update for architecture	Updates are published by CPU architecture. If the update that you’re trying to install does not match the architecture for your CPU, you may encounter this error message.	Verify that the package that you’re trying to install matches the Windows version that you are using. The Windows version information can be found in the «Applies To» section of the article for each update. For example, Windows Server 2012-only updates cannot be installed on Windows Server 2012 R2-based computers. Also, verify that the package that you are installing matches the processor architecture of the Windows version that you are using. For example, an x86-based update cannot be installed on x64-based installations of Windows.
Missing prerequisite update	Some updates require a prerequisite update before they can be applied to a system. If you are missing a prerequisite update, you may encounter this error message. For example, KB 2919355 must be installed on Windows 8.1 and Windows Server 2012 R2 computers before many of the updates that were released after April 2014 can be installed.	Check the related articles about the package in the Microsoft Knowledge Base (KB) to make sure that you have the prerequisite updates installed. For example, if you encounter the error message on Windows 8.1 or Windows Server 2012 R2, you may have to install the April 2014 update 2919355 as a prerequisite and one or more pre-requisite servicing updates (KB 2919442 and KB 3173424). To determine if these prerequisite updates are installed, run the following PowerShell command: get-hotfix KB3173424,KB2919355, KB2919442 . If the updates are installed, the command will return the installed date in the InstalledOn section of the output.

Issues related to firewall configuration

Error that you might see in Windows Update logs:

Go to Services.msc and ensure that Windows Firewall Service is enabled. Stopping the service associated with Windows Firewall with Advanced Security is not supported by Microsoft. For more information, see I need to disable Windows Firewall.

Issues arising from configuration of conflicting policies

Windows Update provides a wide range configuration policy to control the behavior of the Windows Update service in a managed environment. While these policies let you configure the settings at a granular level, misconfiguration or setting conflicting policies may lead to unexpected behaviors.

Device cannot access update files

Ensure that devices can reach necessary Windows Update endpoints through the firewall. For example, for Windows 10, version 2004, the following protocols must be able to reach these respective endpoints:

Protocol	Endpoint URL
TLS 1.2	*.prod.do.dsp.mp.microsoft.com
HTTP	emdl.ws.microsoft.com
HTTP	*.dl.delivery.mp.microsoft.com
HTTP	*.windowsupdate.com
HTTPS	*.delivery.mp.microsoft.com
TLS 1.2	*.update.microsoft.com
TLS 1.2	tsfe.trafficshaping.dsp.mp.microsoft.com

Be sure not to use HTTPS for those endpoints that specify HTTP, and vice versa. The connection will fail.

The specific endpoints can vary between Windows 10 versions. See, for example, Windows 10 2004 Enterprise connection endpoints. Similar articles for other Windows 10 versions are available in the table of contents nearby.

Updates aren’t downloading from the intranet endpoint (WSUS or Configuration Manager)

Windows 10 devices can receive updates from a variety of sources, including Windows Update online, a Windows Server Update Services server, and others. To determine the source of Windows Updates currently being used on a device, follow these steps:

1. Start Windows PowerShell as an administrator.
2. Run $MUSM = New-Object -ComObject «Microsoft.Update.ServiceManager».
3. Run $MUSM.Services.

Check the output for the Name and OffersWindowsUPdates parameters, which you can interpret according to this table.

Output	Meaning
— Name: Microsoft Update -OffersWindowsUpdates: True	— The update source is Microsoft Update, which means that updates for other Microsoft products besides the operating system could also be delivered. — Indicates that the client is configured to receive updates for all Microsoft Products (Office, etc.)
— Name: DCat Flighting Prod — OffersWindowsUpdates: True	— Starting with Windows 10 1709, feature updates are always delivered through the DCAT service. — Indicates that the client is configured to receive feature updates from Windows Update.
— Name: Windows Store (DCat Prod) — OffersWindowsUpdates: False	-The update source is Insider Updates for Store Apps. — Indicates that the client will not receive or is not configured to receive these updates.
— Name: Windows Server Update Service — OffersWindowsUpdates: True	— The source is a Windows Server Updates Services server. — The client is configured to receive updates from WSUS.
— Name: Windows Update — OffersWindowsUpdates: True	— The source is Windows Update. — The client is configured to receive updates from Windows Update Online.

You have a bad setup in the environment

In this example, per the Group Policy set through registry, the system is configured to use WSUS to download updates (note the second line):

From Windows Update logs:

In the above log snippet, we see that the Criteria = «IsHidden = 0 AND DeploymentAction=*» . «*» means there is nothing specified from the server. So, the scan happens but there is no direction to download or install to the agent. So it just scans the update and provides the results.

As shown in the following logs, automatic update runs the scan and finds no update approved for it. So it reports there are no updates to install or download. This is due to an incorrect configuration. The WSUS side should approve the updates for Windows Update so that it fetches the updates and installs them at the specified time according to the policy. Since this scenario doesn’t include Configuration Manager, there’s no way to install unapproved updates. You’re expecting the operational insight agent to do the scan and automatically trigger the download and installation but that won’t happen with this configuration.

High bandwidth usage on Windows 10 by Windows Update

Users might see that Windows 10 is consuming all the bandwidth in the different offices under the system context. This behavior is by design. Components that might consume bandwidth expand beyond Windows Update components.

The following group policies can help mitigate this situation:

Other components that connect to the internet: