Windows Update fails quietly. The user sees a spinning circle for an hour, a percentage that never moves, or an error code that means nothing to them, and then a reminder that the laptop is out of compliance.
Almost every update problem is fixed by the same short sequence, and the rest are explained by the logs. Here is the order that works, plus the management-side checks when the update is being pushed by WSUS or Intune.
Is it stuck, or just slow?
Feature updates take a long time on older hardware and can sit at one percentage for twenty minutes while doing real work. Before you interrupt, check the disk activity light or Task Manager. If the disk is busy, leave it. Forcing a power-off during the install phase is how you end up with a machine that will not boot.
If Settings > Windows Update shows an error, write down the code. A few come up constantly: 0x80070002 and 0x80070003 (missing files in the update cache), 0x800f081f and 0x80073712 (component store corruption), 0x8024402c and 0x80072EE2 (cannot reach the update server or the proxy blocks it), and 0x80070070 (disk full). The last one is the easiest and the most often missed.
The standard repair sequence
Run these in order. Each step fixes a class of failures and they build on each other. Do not skip to the component reset because it is the dramatic one.
- Free up disk space. Updates need several gigabytes; if the drive is nearly full, clear it first.
- Run the built-in troubleshooter: Settings > System > Troubleshoot > Other troubleshooters > Windows Update.
- From an elevated prompt run DISM /Online /Cleanup-Image /RestoreHealth, then sfc /scannow, and reboot.
- Reset the update components with the commands below. This clears the download cache and forces a fresh detection.
- Reboot and check for updates again. If a specific update fails repeatedly, download it from the Microsoft Update Catalog and install it manually.
net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
ren %systemroot%\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserverRead the logs
When the sequence does not fix it, the logs say why. In Event Viewer under Applications and Services Logs > Microsoft > Windows > WindowsUpdateClient > Operational, Event ID 19 is a successful install, 20 is an install failure with the error code, and 31 or 25 are download and detection failures. The System log has the same failures under the WindowsUpdateClient source.
The detailed client log is in ETL format and needs converting. Run the command below and it produces a readable WindowsUpdate.log on the desktop. Search it for the error code and for the words FAILED or Exit code. For servicing failures (the 0x800f codes), C:\Windows\Logs\CBS\CBS.log names the missing or corrupt package.
Get-WindowsUpdateLogWSUS, Intune and Windows Update for Business
If the laptop is managed, check what it is being told to do before you fight the client. Settings > Windows Update will say Some settings are managed by your organization; open View configured update policies to see the source. A machine still pointing at a WSUS server that was decommissioned, or that is only reachable in the office, will show cannot reach the update server errors forever. The policy lives under Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify intranet Microsoft update service location, or in the equivalent Intune setting.
For Intune and Windows Update for Business, look at the device's update ring and the Windows update reports in the Intune admin center, and at the deadline and grace period settings. A deadline that has passed forces restarts users describe as "my laptop rebooted on its own." Delivery Optimization and proxy settings matter too: an update stuck at a download percentage on many machines at once is usually a proxy or a content filter blocking the Microsoft update endpoints.
Last resort: in-place upgrade repair
When the component store is too damaged for DISM to repair, or a feature update fails at the same point every time, an in-place upgrade fixes it without losing anything. Download the Windows installation media or the Installation Assistant from Microsoft, run setup, and choose Keep personal files and apps. It reinstalls Windows underneath the user's apps and data and takes about an hour. It also brings the machine up to the current feature version in one pass.
Back up first, make sure the laptop is plugged in, and check that the disk has room. If in-place upgrade also fails, the drive is usually the cause, and the next step is hardware diagnostics rather than more update repair. RackLedge handles patch management for clients where nobody wants to be doing this by hand, which is most of them.
Frequently asked questions
Can I turn the machine off if the update has been at the same percentage for an hour?
Only if the disk has been idle for a long time and you have no other option. Wait at least an hour of no disk activity first. If it will not boot afterwards, the recovery environment can uninstall the last quality or feature update.
Why does the same update keep installing and failing?
Usually a corrupt component store or a driver that the update replaces and cannot. Run DISM and SFC, check CBS.log for the package name, and try installing the update manually from the Microsoft Update Catalog.
Should we pause updates on machines that keep failing?
Pause only while you fix the cause. A machine that cannot update is a machine that is missing security patches, and the problem gets worse the longer it waits.
Takeaway
Free the disk, run the troubleshooter, repair the component store, reset the update components, and read the WindowsUpdateClient events and CBS.log if it still fails. Check the management source before blaming the client, and use an in-place upgrade when the store is beyond repair. That sequence resolves the large majority of stuck update tickets.