Fix Windows Update problems on Windows Server

Windows Update is how security fixes reach your server, so a server that stopped updating is a server at risk. The fixes below follow Microsoft's own troubleshooting order, from quick checks to a full reset. They work on Windows Server 2016 to 2025, with or without the desktop.

Before you start

• Take a snapshot (Windows VPS plans include free snapshots) or a backup.
• Sign in over Remote Desktop as administrator.
• Note the error code from Settings › Windows Update › Update history, or from SConfig's install screen. It tells you which fix to start with.

Step 1: Check the basics

Get-Volume -DriveLetter C
Get-Date

• Free space: cumulative updates need several gigabytes on C:. If the disk is nearly full, free space or extend C: first.
• Time: a wrong clock breaks the signature checks of updates. Correct the time zone and time in Settings › Time & language.
• Restart pending? Restart once and try again; many failures clear after a pending restart.

Step 2: Install updates with SConfig

SConfig is the server's own configuration tool. Open PowerShell as administrator and type SConfig:

1. Type 6 (Install updates), then 1 for All quality updates.
2. When the list appears, type A to install all of them.
3. Restart when asked.

Verify: after the restart, running option 6 again finds no more quality updates.

Step 3: Repair the component store with DISM and SFC

Error codes such as 0x80073712, 0x800f081f, 0x800f0831 or 0x80070002 point to damaged or missing system files. Repair them in an elevated Command Prompt:

DISM.exe /Online /Cleanup-image /Restorehealth
sfc /scannow

DISM downloads clean files from Windows Update, which takes a while; then sfc checks the protected system files. Both write their results to C:\Windows\Logs\CBS\CBS.log.

Verify: DISM ends with "The restore operation completed successfully", and sfc reports that it found no integrity violations or repaired them. Then run Step 2 again.

Step 4: Reset the Windows Update cache

If updates still fail or stay stuck at downloading, reset the update agent. Microsoft's short reset stops the service, deletes its download cache and starts it again:

net stop wuauserv
rd /s /q %systemroot%\SoftwareDistribution
net start wuauserv

If that is not enough, Microsoft's full manual reset also stops bits and cryptsvc, deletes the qmgr*.dat files and renames SoftwareDistribution\DataStore, SoftwareDistribution\Download and System32\catroot2; follow the steps in the source linked at the end of this guide.

Verify: Step 2 searches, downloads and installs without errors.

Step 5: Choose how updates are installed

In SConfig, type 5 (Update setting) and pick one:

For servers that run programs which must not stop, such as trading platforms, Download only with a fixed monthly maintenance window works well: install, restart, check your programs.

Troubleshooting

The server restarts and shows "Working on updates" for a long time. Wait at least an hour. If it restarts in a loop, roll back to the snapshot you took, then repeat Step 3 before trying again.

DISM fails with 0x800f081f (source missing). DISM could not download the files it needs. Check that the server reaches the internet (proxy, firewall, DNS) and run it again.

An update fails with "not enough space". Free space on C:, for example with Disk Cleanup (cleanmgr) and its Clean up system files button, or extend the disk.

Windows Update is greyed out or says that some settings are managed by your organisation. A local or domain policy controls updates. Check gpedit.msc under Computer Configuration › Administrative Templates › Windows Components › Windows Update.

After an update, Remote Desktop does not connect. See Remote Desktop connection problems; the CredSSP section covers update-related authentication errors.

Next steps

• Keep the rest of the server hardened: secure a new Windows Server.
• Programs that must keep running: Remote Desktop users and sessions.