Fix Windows Update Agent Corruption in 3 Steps

Why Windows Update Breaks Like This

You click Check for updates, it spins for a few minutes, then throws one of those error codes — 0x80070002, 0x8024401c, 0x80070490, maybe just “Some updates were not installed.” Nine times out of ten, the Windows Update agent or its local store (the folder where update files are kept) has gotten tangled up. This happens after a failed update, a forced shutdown during an update, or even from a bad third-party antivirus tool that deletes files it shouldn't.

I've seen this exact problem on Windows 10 20H2 and up, and on Windows 11. The fix is straightforward, but the order matters — start small, get bigger if you have to.

The 30-Second Fix: Run the Built-in Windows Update Troubleshooter

This one works about 30% of the time. It won't hurt, it's fast, so do it first.

Open Settings (Win + I).
Go to Update & Security (Windows 10) or Windows Update (Windows 11), then click Troubleshoot on the left.
Click Additional troubleshooters.
Find Windows Update in the list and click Run the troubleshooter.
It'll scan and try to fix things like corrupted BITS service or misconfigured proxy settings. Let it finish.
If it says “Fixed,” restart your PC and try Windows Update again. If it says “Not fixed” or doesn't help, move on.

What to expect: The troubleshooter will show a progress bar, then a list of what it found. Sometimes it says nothing is wrong — that's fine, just skip to the next fix.

The 5-Minute Moderate Fix: Reset the Update Store and Cache

This clears out the corrupt update files and forces the agent to rebuild them. It fixes most cases.

Open an admin Command Prompt. Press Win + X, choose Command Prompt (Admin) or Terminal (Admin) in Windows 11.
Copy and paste these commands one at a time, pressing Enter after each:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver

These stop the Windows Update service, Cryptographic service, BITS, and the MSI installer. You'll see a message like “The service is stopping” — wait for it to finish before the next command.

Now rename the two folders that hold the update store and cache:

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old

If you get “Access is denied,” you didn't stop the services. Or some other program is using them. Reboot, then try again.

Restart the services we stopped:

net start wuauserv
net start cryptSvc
net start bits
net start msiserver

Each should say “The service is starting” or “started successfully.”

Close the command prompt and restart your PC. Then check for updates again.

What to expect: The next time you open Windows Update, it'll take a bit longer than usual — it's rebuilding the store from scratch. That's normal. If updates install cleanly now, you're done.

The 15+ Minute Advanced Fix: DISM and SFC to Repair the System Image

If the store reset didn't work, the underlying system files are likely busted. This takes time but is the nuclear option.

Open an admin Command Prompt again.
First, run the System File Checker (SFC). This scans protected system files and replaces corrupt ones from a cache:

sfc /scannow

This takes 10-15 minutes. It'll show a progress bar. If it finds corrupt files, it'll try to fix them. If it says “Windows Resource Protection found corrupt files but was unable to fix some of them,” that's where DISM comes in.

Now run DISM (Deployment Imaging and Servicing Management) to fix the system image. This repairs the source files SFC needs:

DISM /Online /Cleanup-Image /RestoreHealth

This takes 15-30 minutes depending on your internet speed — it downloads fresh files from Microsoft's servers. Don't close the window. You'll see a message like “The restore operation completed successfully” or “The source files could not be downloaded.”

If DISM says it couldn't download files, you need a Windows installation media. Download the Media Creation Tool from Microsoft's site, create a USB or ISO, then mount it (right-click the ISO and choose Mount). Note the drive letter (like D:). Then run this command instead:

DISM /Online /Cleanup-Image /RestoreHealth /Source:D:\sources\install.wim /LimitAccess

Replace D: with your actual drive letter. This uses the local media instead of Microsoft's servers.

Once DISM finishes, run SFC again:

sfc /scannow

It should now find no integrity violations.

Reboot your PC and try Windows Update one more time.

What to expect: Both SFC and DISM can seem to hang at 20% or 40% — that's normal. Let them run. If you reboot during the process, you might have to start over. This fix repairs the system at a deep level, so it's the most reliable but also the slowest.

When None of These Work

If you've done all three steps and Windows Update still throws errors, the corruption might be deeper — like a damaged registry or a failing hard drive. Run chkdsk C: /f from an admin prompt (it'll ask to schedule a scan on next reboot, type Y and reboot). If that finds bad sectors, your drive might be dying. Otherwise, consider an in-place upgrade using the Windows Media Creation Tool — it keeps your files and apps but replaces all system files fresh.

I've used these fixes on hundreds of machines. They work. Just be patient and follow the order.