# Fix Windows Update problems on Windows Server

> Get updates installing again on Windows Server: check space and time, repair with DISM and SFC, reset Windows Update and decide when it installs updates.

Difficulty: Intermediate

Windows Update is how security fixes reach your server, so a server that stopped updating is a server at risk. The fixes below follow Microsoft's own troubleshooting order, from quick checks to a full reset. They work on Windows Server 2016 to 2025, with or without the desktop.

## Before you start

- **Take a snapshot** (Windows VPS plans include free snapshots) or a backup.
- Sign in over Remote Desktop as administrator.
- **Note the error code** from **Settings › Windows Update › Update history**, or from SConfig's install screen. It tells you which fix to start with.

## Step 1: Check the basics

```powershell
Get-Volume -DriveLetter C
Get-Date
```

- **Free space:** cumulative updates need several gigabytes on C:. If the disk is nearly full, free space or [extend C:](/guides/extend-windows-disk) first.
- **Time:** a wrong clock breaks the signature checks of updates. Correct the time zone and time in **Settings › Time & language**.
- **Restart pending?** Restart once and try again; many failures clear after a pending restart.

## Step 2: Install updates with SConfig

SConfig is the server's own configuration tool. Open PowerShell as administrator and type `SConfig`:

1. Type `6` (**Install updates**), then `1` for **All quality updates**.
2. When the list appears, type `A` to install all of them.
3. Restart when asked.

**Verify:** after the restart, running option `6` again finds no more quality updates.

## Step 3: Repair the component store with DISM and SFC

Error codes such as `0x80073712`, `0x800f081f`, `0x800f0831` or `0x80070002` point to damaged or missing system files. Repair them in an elevated Command Prompt:

```text
DISM.exe /Online /Cleanup-image /Restorehealth
sfc /scannow
```

DISM downloads clean files from Windows Update, which takes a while; then `sfc` checks the protected system files. Both write their results to `C:\Windows\Logs\CBS\CBS.log`.

**Verify:** DISM ends with "The restore operation completed successfully", and `sfc` reports that it found no integrity violations or repaired them. Then run Step 2 again.

## Step 4: Reset the Windows Update cache

If updates still fail or stay stuck at downloading, reset the update agent. Microsoft's short reset stops the service, deletes its download cache and starts it again:

```text
net stop wuauserv
rd /s /q %systemroot%\SoftwareDistribution
net start wuauserv
```

If that is not enough, Microsoft's full manual reset also stops `bits` and `cryptsvc`, deletes the `qmgr*.dat` files and renames `SoftwareDistribution\DataStore`, `SoftwareDistribution\Download` and `System32\catroot2`; follow the steps in the source linked at the end of this guide.

**Verify:** Step 2 searches, downloads and installs without errors.

## Step 5: Choose how updates are installed

In SConfig, type `5` (**Update setting**) and pick one:

| Setting | What it does |
|---|---|
| `A` Automatic | Checks for and installs updates every day at 3:00 AM server time |
| `D` Download only | Downloads updates and waits for you to install them (the default) |
| `M` Manual | Does not check for updates by itself |

For servers that run programs which must not stop, such as trading platforms, **Download only** with a fixed monthly maintenance window works well: install, restart, check your programs.

## Troubleshooting

**The server restarts and shows "Working on updates" for a long time.** Wait at least an hour. If it restarts in a loop, roll back to the snapshot you took, then repeat Step 3 before trying again.

**DISM fails with `0x800f081f` (source missing).** DISM could not download the files it needs. Check that the server reaches the internet (proxy, firewall, DNS) and run it again.

**An update fails with "not enough space".** Free space on C:, for example with **Disk Cleanup** (`cleanmgr`) and its **Clean up system files** button, or extend the disk.

**Windows Update is greyed out or says that some settings are managed by your organisation.** A local or domain policy controls updates. Check `gpedit.msc` under **Computer Configuration › Administrative Templates › Windows Components › Windows Update**.

**After an update, Remote Desktop does not connect.** See [Remote Desktop connection problems](/guides/rdp-connection-problems); the CredSSP section covers update-related authentication errors.

## Next steps

- Keep the rest of the server hardened: [secure a new Windows Server](/guides/secure-windows-server).
- Programs that must keep running: [Remote Desktop users and sessions](/guides/windows-remote-desktop-users).

## Frequently asked questions

### How do I stop Windows from restarting while I work?

Set updates to Download only or Manual in SConfig, then install them and restart at a time that suits you. Keep installing them every month: security updates matter more than an undisturbed afternoon.

### Is it safe to delete the SoftwareDistribution folder?

Yes, with the Windows Update service stopped. Microsoft lists it as the last-resort reset: Windows downloads what it needs again, and the update history shown in Settings may be emptied.

### How long can Working on updates take?

Large cumulative updates can take a long time on a busy or small server. Give it at least an hour before you intervene, because interrupting an update can damage the installation.

### Should I take a snapshot before updates?

Yes. Windows VPS plans include free snapshots: take one before monthly updates, so you can roll back if an update breaks your software.

---

Source: <https://hyperdc.com/guides/products/fix-windows-update-problems>\
Updated: 2026-10-15