Windows Update troubleshooting

If you run into problems when using Windows Update, start with the following steps:

Run the built-in Windows Update troubleshooter to fix common issues. Navigate to Settings > Update & Security > Troubleshoot > Windows Update.

Install the most recent Servicing Stack Update (SSU) that matches your version of Windows from the Microsoft Update Catalog. See Servicing stack updates for more details on servicing stack updates.

Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system:

Advanced users can also refer to the log generated by Windows Update for further investigation.

You might encounter the following scenarios when using Windows Update.

Why am I offered an older update?

The update that is offered to a device depends on several factors. The following are some of the most common attributes:

• OS Build
• OS Branch
• OS Locale
• OS Architecture
• Device update management configuration

If the update you’re offered isn’t the most current available, it might be because your device is being managed by a WSUS server, and you’re being offered the updates available on that server. It’s also possible, if your device is part of a deployment group, that your admin is intentionally slowing the rollout of updates. Since the deployment is slow and measured to begin with, all devices will not receive the update on the same day.

My device is frozen at scan. Why?

The Settings UI communicates with the Update Orchestrator service that in turn communicates with to Windows Update service. If these services stop unexpectedly, then you might see this behavior. In such cases, follow these steps:

Close the Settings app and reopen it.

Start Services.msc and check if the following services are running:

• Update State Orchestrator
• Windows Update

Feature updates are not being offered while other updates are

Devices running Windows 10, version 1709 through Windows 10, version 1803 that are configured to update from Windows Update (including Windows Update for Business) are able to install servicing and definition updates but are never offered feature updates.

Checking the WindowsUpdate.log reveals the following error:

The 0x80070426 error code translates to:

Microsoft Account Sign In Assistant (MSA or wlidsvc) is the service in question. The DCAT Flighting service (ServiceId: 855E8A7C-ECB4-4CA3-B045-1DFA50104289) relies on MSA to get the global device ID for the device. Without the MSA service running, the global device ID won’t be generated and sent by the client and the search for feature updates never completes successfully.

To resolve this issue, reset the MSA service to the default StartType of «manual.»

Issues related to HTTP/Proxy

Windows Update uses WinHttp with Partial Range requests (RFC 7233) to download updates and applications from Windows Update servers or on-premises WSUS servers. Therefore proxy servers on the network must support HTTP RANGE requests. If a proxy was configured in Internet Explorer (User level) but not in WinHTTP (System level), connections to Windows Update will fail.

To fix this issue, configure a proxy in WinHTTP by using the following netsh command:

You can also import the proxy settings from Internet Explorer by using the following command: netsh winhttp import proxy source=ie

If downloads through a proxy server fail with a 0x80d05001 DO_E_HTTP_BLOCKSIZE_MISMATCH error, or if you notice high CPU usage while updates are downloading, check the proxy configuration to permit HTTP RANGE requests to run.

You might choose to apply a rule to permit HTTP RANGE requests for the following URLs:

*.download.windowsupdate.com
*.dl.delivery.mp.microsoft.com *.delivery.mp.microsoft.com

If you can’t allow RANGE requests, you’ll be downloading more content than needed in updates (as delta patching will not work).

The update is not applicable to your computer

The most common reasons for this error are described in the following table:

Cause	Explanation	Resolution
Update is superseded	As updates for a component are released, the updated component will supersede an older component that is already on the system. When this occurs, the previous update is marked as superseded. If the update that you’re trying to install already has a newer version of the payload on your system, you might receive this error message.	Check that the package that you are installing contains newer versions of the binaries. Or, check that the package is superseded by another new package.
Update is already installed	If the update that you’re trying to install was previously installed, for example, by another update that carried the same payload, you may encounter this error message.	Verify that the package that you are trying to install was not previously installed.
Wrong update for architecture	Updates are published by CPU architecture. If the update that you’re trying to install does not match the architecture for your CPU, you may encounter this error message.	Verify that the package that you’re trying to install matches the Windows version that you are using. The Windows version information can be found in the «Applies To» section of the article for each update. For example, Windows Server 2012-only updates cannot be installed on Windows Server 2012 R2-based computers. Also, verify that the package that you are installing matches the processor architecture of the Windows version that you are using. For example, an x86-based update cannot be installed on x64-based installations of Windows.
Missing prerequisite update	Some updates require a prerequisite update before they can be applied to a system. If you are missing a prerequisite update, you may encounter this error message. For example, KB 2919355 must be installed on Windows 8.1 and Windows Server 2012 R2 computers before many of the updates that were released after April 2014 can be installed.	Check the related articles about the package in the Microsoft Knowledge Base (KB) to make sure that you have the prerequisite updates installed. For example, if you encounter the error message on Windows 8.1 or Windows Server 2012 R2, you may have to install the April 2014 update 2919355 as a prerequisite and one or more pre-requisite servicing updates (KB 2919442 and KB 3173424). To determine if these prerequisite updates are installed, run the following PowerShell command: get-hotfix KB3173424,KB2919355, KB2919442 . If the updates are installed, the command will return the installed date in the InstalledOn section of the output.

Issues related to firewall configuration

Error that you might see in Windows Update logs:

Go to Services.msc and ensure that Windows Firewall Service is enabled. Stopping the service associated with Windows Firewall with Advanced Security is not supported by Microsoft. For more information, see I need to disable Windows Firewall.

Issues arising from configuration of conflicting policies

Windows Update provides a wide range configuration policy to control the behavior of the Windows Update service in a managed environment. While these policies let you configure the settings at a granular level, misconfiguration or setting conflicting policies may lead to unexpected behaviors.

Device cannot access update files

Ensure that devices can reach necessary Windows Update endpoints through the firewall. For example, for Windows 10, version 2004, the following protocols must be able to reach these respective endpoints:

Protocol	Endpoint URL
TLS 1.2	*.prod.do.dsp.mp.microsoft.com
HTTP	emdl.ws.microsoft.com
HTTP	*.dl.delivery.mp.microsoft.com
HTTP	*.windowsupdate.com
HTTPS	*.delivery.mp.microsoft.com
TLS 1.2	*.update.microsoft.com
TLS 1.2	tsfe.trafficshaping.dsp.mp.microsoft.com

Be sure not to use HTTPS for those endpoints that specify HTTP, and vice versa. The connection will fail.

The specific endpoints can vary between Windows 10 versions. See, for example, Windows 10 2004 Enterprise connection endpoints. Similar articles for other Windows 10 versions are available in the table of contents nearby.

Updates aren’t downloading from the intranet endpoint (WSUS or Configuration Manager)

Windows 10 devices can receive updates from a variety of sources, including Windows Update online, a Windows Server Update Services server, and others. To determine the source of Windows Updates currently being used on a device, follow these steps:

1. Start Windows PowerShell as an administrator.
2. Run $MUSM = New-Object -ComObject «Microsoft.Update.ServiceManager».
3. Run $MUSM.Services.

Check the output for the Name and OffersWindowsUPdates parameters, which you can interpret according to this table.

Output	Meaning
— Name: Microsoft Update -OffersWindowsUpdates: True	— The update source is Microsoft Update, which means that updates for other Microsoft products besides the operating system could also be delivered. — Indicates that the client is configured to receive updates for all Microsoft Products (Office, etc.)
— Name: DCat Flighting Prod — OffersWindowsUpdates: True	— Starting with Windows 10 1709, feature updates are always delivered through the DCAT service. — Indicates that the client is configured to receive feature updates from Windows Update.
— Name: Windows Store (DCat Prod) — OffersWindowsUpdates: False	-The update source is Insider Updates for Store Apps. — Indicates that the client will not receive or is not configured to receive these updates.
— Name: Windows Server Update Service — OffersWindowsUpdates: True	— The source is a Windows Server Updates Services server. — The client is configured to receive updates from WSUS.
— Name: Windows Update — OffersWindowsUpdates: True	— The source is Windows Update. — The client is configured to receive updates from Windows Update Online.

You have a bad setup in the environment

In this example, per the Group Policy set through registry, the system is configured to use WSUS to download updates (note the second line):

From Windows Update logs:

In the above log snippet, we see that the Criteria = «IsHidden = 0 AND DeploymentAction=*» . «*» means there is nothing specified from the server. So, the scan happens but there is no direction to download or install to the agent. So it just scans the update and provides the results.

As shown in the following logs, automatic update runs the scan and finds no update approved for it. So it reports there are no updates to install or download. This is due to an incorrect configuration. The WSUS side should approve the updates for Windows Update so that it fetches the updates and installs them at the specified time according to the policy. Since this scenario doesn’t include Configuration Manager, there’s no way to install unapproved updates. You’re expecting the operational insight agent to do the scan and automatically trigger the download and installation but that won’t happen with this configuration.

High bandwidth usage on Windows 10 by Windows Update

Users might see that Windows 10 is consuming all the bandwidth in the different offices under the system context. This behavior is by design. Components that might consume bandwidth expand beyond Windows Update components.

The following group policies can help mitigate this situation:

Other components that connect to the internet:

Stop Windows Update service

This post explains how to stop Windows update service from command line(CMD). Make sure that you open elevated administrator command prompt to execute this command.

How to stop Windows update service

Do the following

1. Open elevated command prompt
2. Run the below command.

Update service restarts automatically

It’s observed that just stopping the service does not work in some cases and it restarts automatically. In such cases one can disable the service completely by running below command.

Note that these commands to stop or disable service should be run from elevated administrator command prompt. Other wise you will get the following error.

How to start windows update

Neat tip. However, it seems W7 is automatically restarting the Windows Update service every now and then. I’ve changed status to “Manual” under services.msc but the behavior remains. No fun at all.

Hi Carl
FYI everytime you go into windows update it will start the service even though it is set to manual so if you need to look in windows update then stop the service again afterwards.

Run CMD as Admin and “sc config wuauserv start= disabled” will work on Win7Ulti

Please help me to stop the windows update, it is a disaster every time after windows update, totally stupid program, may be next time I should go for apple.

you gott the error because you have’nt run cmd as administrator

Apple is more stupid than the windows.

I cannot get windows update to stop, finish, or go away! How do I get this to stop so I can get back on the computer? It’s a brand new computer, and useless at this point!

Set to disabled and reboot!

Wow thank you for putting this line up here. I needed to restart my windows update and this did the trick

Yes – agreed thanks much appreciated! On a very slow connection so bandwidth is at a premium. This made things much more pleasant.

#Persistent
interval = 600 ; execution interval in seconds
Menu, Tray, Add ; divider line
Menu, Tray, Add, Execute Now, StopService
Menu, Tray, Default, Execute Now
timer_param := -1000 * interval

StopService:
Run %comspec% /c “sc query wuauserv | find “1 STOPPED” & if errorlevel 1 sc stop wuauserv”, , Hide
time = %A_Now%
time += %interval%, seconds
FormatTime, time_string, %time%, Time
Menu, Tray, Tip, Stop Windows Update Service`nNext Execution at %time_string%
SetTimer, StopService, %timer_param%
return

Hi! even thou i star cmd as admin i still get the “error 5 access denied. can someone help me?

go to start menu —> type “cmd” in the search box, wait till cmd shows in the results list, right click on “cmd” and select “run as administrator”

You need to run it from elevated command prompt.

otherwise, check your UAC and if it’s off, turn it on in your account settings.

This information is for those who wish to completely disable Windows 10 automatic updates. It is very simple and requires no real expertise.

1. Bring up your task manager.
2. Select the “Services” tab.
3. Scroll down the lefthand side until you see “wuauserv”. (In the description column to the right, you’ll see “Windows Update”.)
4. Right click on “wuauserv”.
5. In the dropdown box that appears, click on “stop”.

This stops all automatic updates from taking over your computer. In order to get future updates, you will have to follow the same steps, but click on “start” to restart it. I prefer simply to go to Microsoft’s website to find the updates, if I want them at all, which I don’t. I’ve struggled with Microsoft’s updates for years, from Windows 7, Windows 8, Windows 8.1, and now Windows 10. All of them have rendered my computer(s) less functional than they were prior to the updates.

I use a separate security program in conjunction with Windows firewall and find that there is absolutely no need to upload their security updates.

hi, I am having endless problems with my surface pro3, running win10pro. the overwhelming majority of my time spent on this device is occupied by trying to update and keep in functioning without sending me endless notifications. I am an aspiring Linux user, which so far as I can tell, is superior in every way, however, I am concerned if the security is dependable…? I was wondering what the security program is that you referenced? and would be eager to hear any other suggestions/tips/opinions?

I tried this and got a message that access is denied.

Same problem on my PC. Svchost.exe takes continuously almost 100% processor time.
Stopped wuauserv in the way described above and the processor is free. However after a restart it is running again. Same after stopping it via the command: net stop wuauserv.
Anybody knows how I can stop this wuauserv forever.

You need to disable the service using sc command. Added these commands in the post.

Hi all, a tip for all of those having issues with Windows update, if you go to services.msc and stop the service in the second tab you can select a user to run the service with afterwards.
So you only need to put a valid user and then change the password of that user and voila! it wont ever be able to run again since it will be trying to run with an invalid user… 🙂

I wind up stopping and disabling this service every day or two, yet somehow Windows keeps turning it back to Automatic and running it! (on an older laptop which has to stay at XP)

Just want to say Thank YOU! I got nearly crazy (even more than normal) because my laptop was making so much noise while windows was checking updates for hours. Tried to close it through task manager to no avail but this tip worked as a charm.
I had no problems at all that was until windows installed updates and I could not get into windows anymore. Thanks no thanks. So now I am going to try to see if I can download the updates one by one or so. Thanks again. Love the sound of silence

Surely it would be much easier to use computer management services scroll down to windows update and apply the above directly with the advantage that you can see what you are actually doing.

Thanks for the tip. CPU had been running crazy trying to keep up with the update service. The CPU temp has dropped from 43 degrees Celcius to 35 degrees.

Omg! Thanks you! I was stuck in windows update hell!

Thanks for the info. I made a .bat file to stop, and one to start with this info. Just run as administrator and it works 🙂

I hope the above stop up dates work as my computer is all bet useless

from cmd run
sc queryex wuauserv
take pidnum from result and replace xxx in
taskkill /PID xxx/F and run

This is a good short term (few days) fix but on Windows 10 home edition, update restarts itself after a few days. There is a regedit out there but it doesn’t work for Home edition. The WUSH tool also only works for a few days.

Would be great if there were a way to program this “sc config wuauserv start= disabled” command to re-run itself every 2 days. Does anyone know how to do this?

Just put the command in a batch file, then schedule a task launching it with highest priviledge “when the computer starts”. (^v^)

i am running cmd as administrator but also the following cmd net stop wuauserv is saying invalid what to do then

Erm… I disabled the command using the command prompt (admin), but the file Windows10Upgrade keeps appearing. Help me please!

I can’t stop windows 10 update using service stopping, when I connect to wifi ,service is auto enable how can I stop permanently

Is there any command just to show the windows update is on or off ?

How can I disable windows updates for all the computers on the network?

Unfortunately, Windows 10 Home does not allow users to turn off automatic updates. To do that, you would have to upgrade to the Pro version. Otherwise, you’re looking at a lot of punishing hours spent rolling back updates you didn’t want… I had this issue with an error related to a registry conflict that prioritizes RuntimeBroker and found that this was the case during my research into the cause for the ongoing rollbacks.

I have no access to stop and disable the services. Can anyone tell me what to do in this case?

Hello, I am searching across the internet to find a solution to fix the svchost.exe disk usage, and almost every one of them suggests to disable or turn manual the Windows Update Service. I already did that, but the svchost.exe thing keeps consuming my disk.

If you know how to fix this, please tell me.

Can always services >Windows update
right click, properties, Revoery, and change to no action for all 3… see if that may help.

Thanks, had to get around an invasive group policy to repair bitlocker bde protectors, this was the trick I needed to disable updates so my bitlocker tables could be repaired.
Brent, New Zealand