How to fix Windows Update not installing security updates
Security updates protect Windows from active threats, but they can fail for simple reasons such as corrupted update files, service errors, low disk space, or broken components.
This guide explains how to fix Windows Update not installing security updates with targeted checks that work on Windows 10 and Windows 11.
Why security updates fail in Windows Update
Windows Update depends on several moving parts: the Windows Update service, Background Intelligent Transfer Service, the update cache, system file integrity, and Microsoft’s update servers.
If any one of those layers is damaged or misconfigured, cumulative security patches may download partially, install endlessly, or roll back after a restart.
- Corrupted update cache can block new downloads.
- Stopped services can prevent the installer from running.
- Damaged system files can interrupt package verification.
- Insufficient storage can stop servicing operations.
- Third-party security tools can interfere with patch installation.
Start with the basics
Before changing system files, rule out simple causes.
Reboot the PC, disconnect unnecessary USB devices, and confirm the device has a stable internet connection.
If you are on a metered connection, Windows may delay large updates until the setting is changed.
- Restart Windows and try Windows Update again.
- Check that the clock, date, and time zone are correct.
- Free at least several gigabytes of disk space on the system drive.
- Pause and then resume updates from Settings if the download appears stuck.
Run the Windows Update troubleshooter
Microsoft includes a built-in troubleshooter that can detect common failures in update components and repair them automatically.
This is often the fastest first step when security patches will not install.
- Open Settings.
- Go to System and then Troubleshoot.
- Select Other troubleshooters.
- Run Windows Update.
After the scan finishes, restart the computer and check for updates again.
If the update still fails, continue with manual repairs.
Reset Windows Update components
One of the most effective ways to fix Windows Update not installing security updates is to reset the update cache and related services.
This clears damaged temporary files that can keep security patches from downloading or installing correctly.
Stop the update services
Open an elevated Command Prompt or Windows Terminal and run these commands:
net stop wuauserv net stop bits net stop cryptsvc net stop msiserver
Rename the cache folders
These commands preserve the old files while forcing Windows to create clean folders:
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 catroot2.old
Restart the services
Restart the components with the following commands:
net start wuauserv net start bits net start cryptsvc net start msiserver
Then reboot the PC and check Windows Update again.
This step often resolves repeated installation failures for cumulative security updates and monthly patch Tuesday releases.
Repair system files with SFC and DISM
If Windows system files are damaged, Windows Update may download a patch but fail during installation.
Use System File Checker and DISM to repair the image and restore missing components.
Run System File Checker
Open an elevated Command Prompt and run:
sfc /scannow
Let the scan complete fully.
If it reports repairs, restart and try Windows Update again.
Run DISM
If SFC cannot fix the issue, repair the Windows component store with DISM:
DISM /Online /Cleanup-Image /RestoreHealth
When DISM finishes, run sfc /scannow again.
This two-step repair is especially helpful when update servicing files are missing or corrupted.
Check for conflicting security software
Third-party antivirus and endpoint protection tools can block Microsoft update packages, especially on managed or older systems.
Temporarily disable real-time protection or uninstall the tool if policy allows, then retry the update.
- Pause third-party antivirus protection before installing patches.
- Check for firewall rules that block Microsoft update domains.
- Re-enable protection after the update completes.
If you use Microsoft Defender only, confirm that Tamper Protection is not preventing administrative repair actions required by your environment.
Use the Microsoft Update Catalog
If Windows Update still refuses to install a specific security patch, install it manually from the Microsoft Update Catalog.
This method is useful when a single cumulative update is failing but the rest of the system is healthy.
- Find the KB number in Windows Update history.
- Search that KB in the Microsoft Update Catalog.
- Download the correct package for your version and architecture, such as x64 or ARM64.
- Run the downloaded installer and restart when prompted.
Manual installation bypasses some Windows Update download issues while still applying the security fix.
Review update history and error codes
Windows often records a failure code that points to the underlying cause.
Common examples include 0x800f081f for missing source files, 0x80070002 for file issues, and 0x80073712 for component store corruption.
- Open Settings and review Windows Update history.
- Note the KB number and error code.
- Search the code alongside your Windows version for a more precise fix.
Knowing the exact failure code saves time, especially on systems that repeatedly fail the same security update.
Try a clean boot if updates are blocked by background software
A clean boot starts Windows with minimal startup services.
This helps identify whether a background app, driver utility, or system optimizer is preventing security updates from installing.
- Open System Configuration with
msconfig. - Hide Microsoft services and disable the remaining startup services.
- Restart and run Windows Update.
If the update installs successfully in a clean boot state, re-enable services in groups until you find the conflict.
Fix issues with servicing stack and feature prerequisites
Some security updates rely on recent servicing stack updates or specific prerequisites.
If Windows is far behind, install the latest servicing components first, then retry the security patch.
Systems that have skipped multiple months of updates may need one successful cumulative update before later patches will apply cleanly.
When to use an in-place repair upgrade
If every repair fails, an in-place repair upgrade can refresh Windows without removing files or most apps.
This is one of the safest ways to resolve persistent update corruption on a healthy PC.
- Download the latest Windows ISO from Microsoft.
- Mount the ISO and run setup.exe.
- Choose to keep personal files and apps.
- Finish the repair install, then check for security updates again.
This method replaces damaged Windows components while preserving your current environment.
What to do after the update installs
After security updates install successfully, restart the PC even if Windows does not immediately demand it.
Then confirm the patch appears in update history, verify your antivirus is active again, and create a restore point if your workflow allows it.
- Check that the expected KB number appears in update history.
- Restart to complete servicing and driver reinitialization.
- Re-enable any temporarily disabled security tools.
- Monitor for repeated failures during the next update cycle.
Repeated update failure after these steps may indicate profile corruption, storage problems, or a deeper servicing issue that requires advanced diagnostics or IT support.