Windows Update not working in Windows 11 can leave your system exposed to security risks and missing critical patches. Whether you’re a home user or an IT administrator managing multiple devices, a stalled update is more than an inconvenience—it’s a genuine security concern.
In this guide, we’ll walk through practical, step-by-step solutions to get Windows Update running smoothly again. From checking services and clearing corrupted caches to running built-in troubleshooters, you’ll find fixes that work for beginners and advanced users alike.
Introduction
Windows Update is one of the most important background services in Windows 11. It delivers security patches, driver updates, feature releases, and quality fixes that keep your device stable and protected. When it stops working, the symptoms are usually obvious: the update process hangs at a certain percentage, error codes such as 0x80070057 or 0x800f081f appear, the “Check for updates” button does nothing, or the Settings app freezes entirely when you open the update page.
This guide covers How to Fix Windows Update Not Working in Windows 11 in practical, step-by-step detail. The same methods work whether you are a beginner who just wants the update button to respond again, or an IT administrator repairing a fleet of managed workstations. You will learn how to reset the update components, repair corrupted system files, adjust network and group policy settings, and re-register the service endpoints that Windows 11 relies on. Most repairs take between 15 and 45 minutes per machine, depending on how many components need attention and how much disk scanning is required.
Before you begin, it helps to understand that Windows Update is not a single program. It is a chain of services, scheduled tasks, DLLs, registry keys, and a download cache. If any link in that chain breaks, the entire update pipeline can fail. Because of this, the fix is usually a sequence of resets and repairs rather than one magic button. Work through the steps in order, and restart the machine between major changes so that services reload cleanly.
Prerequisites
Gather the following before you start. Missing a prerequisite is the most common reason an update repair appears to fail halfway through.
- An administrator account on the Windows 11 device. Standard users cannot restart services or edit protected registry keys.
- At least 20 GB of free space on the system drive. Windows Update needs room to stage downloads and extract packages.
- A stable internet connection, preferably wired Ethernet during long repair sessions. Wi-Fi drops can corrupt a partially downloaded update.
- Access to Windows Terminal or Command Prompt running as Administrator. Both are available from the Start menu right-click menu.
- Your Windows 11 edition and build number, found under Settings > System > About. This matters when you later compare against update catalog entries.
- A verified software compatibility check with your hardware architecture. Always verify software compatibility with your hardware architecture (ARM64 vs x86) before installing third-party repair tools or update packages, because ARM64 devices cannot run x86 kernel drivers and many “update fixer” utilities ship only x86 binaries.
- A recent backup or restore point. Creating a manual restore point takes one minute and can save hours if a registry change goes wrong.
For IT administrators working across many machines, also confirm that the device is not blocked by an existing WSUS or Intune update ring policy. A device that is correctly repaired will still appear broken if policy forbids it from contacting Microsoft Update.
Preparation
Preparation is where most successful repairs are won. Keeping your operating system updated before installation prevents dependency conflicts, but when the update mechanism itself is broken you must first stabilize the environment manually.
Start by creating a restore point. Open Start, type “Create a restore point”, open the System Properties dialog, select your system drive, and click Create. Give it a name such as “Before WU repair” so you can identify it later.
Next, document the current state. Run winver to note the build, and open Settings > Windows Update > Update history to capture the last successful update and the first failing one. This history tells you whether the problem is recent (likely a single bad patch or corrupted download) or long-standing (likely a service or policy issue).
Then pause the update queue. In Settings > Windows Update, choose “Pause updates” for one week. This stops Windows from competing with your repair work, since the service will otherwise keep retrying downloads while you are trying to clear the cache.
Finally, disconnect any third-party antivirus filtering that inspects HTTPS traffic. Some security suites intercept the Windows Update endpoints and break certificate validation. Temporarily disabling them during repair is safe and reversible, but re-enable them afterwards and confirm the update still works with protection on.
Installation Steps
The following six steps form the core of the repair. Treat them as a pipeline: complete each one, restart if instructed, and only then move on.
Step 1: Review prerequisites and compatibility
Confirm every item from the Prerequisites section is satisfied. Open an elevated Windows Terminal, run systeminfo, and check the “System Type” line. If it reports “ARM64-based PC”, all scripts and tools you download must be ARM64 builds. Running an x86 system-file checker or driver installer on an ARM64 device can produce misleading errors and occasionally render the update stack unusable.
Also verify that your system drive has enough free space and that the device clock is correct. A date or time that is off by more than a few minutes causes TLS failures against Microsoft’s update servers, which in turn generates generic download errors.
Step 2: Prepare the environment
Stop the services that lock the update cache. In an elevated terminal, run the following commands one at a time:
- net stop wuauserv — stops the Windows Update service.
- net stop bits — stops the Background Intelligent Transfer Service that downloads packages.
- net stop cryptsvc — stops the Cryptographic Services that verify signatures.
- net stop msiserver — stops the Windows Installer service, which update packages sometimes use.
With the services stopped, rename the download and distribution folders so Windows rebuilds them from scratch:
- Rename C:\Windows\SoftwareDistribution to SoftwareDistribution.old.
- Rename C:\Windows\System32\catroot2 to catroot2.old.
If a folder refuses to rename, a service has not fully stopped. Close the Settings app, wait thirty seconds, and retry. Do not delete the folders; renaming keeps them recoverable.
Step 3: Configure core settings
Reset the Background Intelligent Transfer Service queue and the Windows Update security descriptors. Run bitsadmin /reset /allusers in the elevated terminal to clear any stuck transfer jobs. Then re-register the core update DLLs so Windows can rebuild its COM registrations.
Open Notepad, paste the following commands, and save the file as reregister.bat on your desktop. Then run it as Administrator:
- regsvr32 /s atl.dll
- regsvr32 /s urlmon.dll
- regsvr32 /s mshtml.dll
- regsvr32 /s shdocvw.dll
- regsvr32 /s browseui.dll
- regsvr32 /s jscript.dll
- regsvr32 /s vbscript.dll
- regsvr32 /s scrrun.dll
- regsvr32 /s msxml.dll
- regsvr32 /s wuapi.dll
- regsvr32 /s wuaueng.dll
- regsvr32 /s wups.dll
- regsvr32 /s wups2.dll
Each line should complete silently when using the /s flag. If you see an error mentioning a missing file, note which DLL failed; that often points to a specific corrupted component you will repair with SFC in the troubleshooting section.
Step 4: Run the main installation procedure
With services stopped, cache cleared, and DLLs re-registered, restart the services in the reverse order:
- net start cryptsvc
- net start bits
- net start wuauserv
- net start msiserver
Now restart the computer. This forces Windows to rebuild the SoftwareDistribution folder with a fresh manifest. After the reboot, open Settings > Windows Update and click “Check for updates”. If the update begins downloading normally, the repair has worked. If it fails with a new error code, proceed to Step 5 and then to Troubleshooting.
Optionally, run the built-in Windows Update troubleshooter in parallel. Go to Settings > System > Troubleshoot > Other troubleshooters, and run the Windows Update troubleshooter. It applies a subset of the same fixes automatically and can catch policy-level problems your manual steps missed.
Step 5: Verify the installation
Verification matters as much as repair. Confirm all four services are running by typing sc query wuauserv, sc query bits, sc query cryptsvc, and sc query msiserver. Each should report “RUNNING”.
Check that the SoftwareDistribution folder was recreated with fresh content and that no .old folder remains locked. Then open Update history and confirm the pending update either installs successfully or produces a new, specific error code rather than the original generic failure.
For administrators, also confirm the device reports correctly to your management console. In Intune or WSUS, the device should show a recent “last scan” time within the last hour. A device that updates fine locally but never reports back usually has a policy or certificate issue rather than a broken update engine.
Step 6: Configure post-install options
Finish by tuning the update experience so the problem is less likely to recur. Set active hours so updates do not install during working periods. Enable “Get the latest updates as soon as they’re available” only if you can tolerate occasional early-release bugs; most production machines should leave this off.
If a specific driver or quality update caused the original failure, use the show-or-hide tool or your management console to defer that single update while allowing others. Finally, re-enable any antivirus filtering you disabled earlier and run one more “Check for updates” to prove the full path works with security software active.
Post-Installation
After the repair, keep the machine healthy with a short maintenance routine. Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth once a month; these repair the component store that updates depend on. Clear the Delivery Optimization cache occasionally, since it can grow to several gigabytes on busy machines.
Revisit your architecture and compatibility notes whenever you install new software. Always verify software compatibility with your hardware architecture (ARM64 vs x86) before adding utilities, and keep your browser and management agents current, because stale agents sometimes block update endpoints. Keeping your operating system updated before installation prevents dependency conflicts, so never skip a monthly patch cycle just because one update failed in the past.
Document what fixed the issue. Note the error code, the steps that resolved it, and the date. If the same error returns on the same hardware, the documentation turns a 45-minute investigation into a five-minute fix.
Troubleshooting
If updates still fail after the six steps, work through the following checks in order.
System file corruption. Run sfc /scannow followed by DISM /Online /Cleanup-Image /RestoreHealth . SFC repairs individual protected files;.
You now have a complete workflow for How to Fix Windows Update Not Working in Windows 11. Keep your system updated, monitor resource usage, and revisit this guide when software versions change.
Next steps: harden your server firewall, set up automated backups, and explore related tutorials linked above.