Fix Windows 10 Security Patch Failing to Install

Windows 10 security updates are essential. They patch newly discovered vulnerabilities, close security holes, and keep your PC protected from malware and hacking attempts. But sometimes Windows 10 security patches fail to install, get stuck at a certain percentage, or show error codes like 0x80070002, 0x80073712, 0x800f0922, or 0x800f081f.

If you see messages such as “Security update failed to install”, “Some updates were not installed”, or Windows Update keeps retrying the same security patch, follow this guide. We’ll start with simple checks and move on to advanced fixes that resolve most Windows 10 security patch installation failures.

Why Security Patches Fail on Windows 10

Security updates for Windows 10 may fail to install for several reasons, including corrupted files, insufficient disk space, driver conflicts, slow internet, service issues, or system file corruption.

• Corrupted Update Files: Downloaded files can become damaged, preventing installation.
• Insufficient Disk Space: Not enough room on your drive can halt updates, especially during installation.
• Driver Conflicts: Outdated or incompatible device drivers can interfere with the update process.
• System File Corruption: Damaged system files can cause update mechanisms to fail.
• Windows Update Service Issues: The service itself might be stopped or malfunctioning.
• SoftwareDistribution Folder Overload: Cached update data can cause conflicts.
• Extended Security Updates (ESU) Bug: A specific bug in late 2025 temporarily blocked enrollment for paid extended support.
• MSMQ Permissions: Recent changes to Microsoft Message Queuing (MSMQ) security can block updates in managed environments.

Before You Start: Quick Checks to fix Windows Update

Complete these basic steps first. They alone fix the problem in many cases.

1. Check your internet connection

Security patches are usually small, but they still need a stable connection.

• Avoid public Wi‑Fi or unstable mobile hotspots.
• If possible, use a wired (Ethernet) connection.
• Pause any big downloads or streaming while you run Windows Update.

2. Free up disk space

If your C: drive is low on space, security patches may fail to install.

• Open Settings > System > Storage.
• Use Temporary files cleanup to remove:
  • Previous Windows installation files (if any)
  • Delivery Optimization files
  • Temporary files
• Empty the Recycle Bin and delete large files you don’t need.

Try to keep at least 10–15 GB free on the system drive.

3. Temporarily disable third‑party antivirus and VPN

Security suites and VPNs sometimes block Windows Update connections or interfere with the install process.

• Disable or pause your third‑party antivirus and firewall (not Windows Security).
• Disconnect from any VPN.
• Run Windows Update again from Settings > Update & Security > Windows Update.

Re‑enable your security software after the update is complete.

4. Disconnect unnecessary external hardware

USB devices and problematic drivers can sometimes cause update failures.

• Unplug printers, external drives, webcams, game controllers, etc.
• Leave only the keyboard, mouse, and display connected.

Run the Windows Update Troubleshooter

Windows 10 has a built‑in troubleshooter that detects and fixes many common update problems, including failed security patches.

• Press Windows + I to open Settings.
• Go to Update & Security > Troubleshoot.
• Click Additional troubleshooters.
• Select Windows Update, then click Run the troubleshooter.

• Follow the on‑screen instructions and apply any fixes it suggests.
• Restart your PC.
• Go back to Settings > Update & Security > Windows Update and click Check for updates.

If your Windows 10 security update still fails to install, continue to the next method.

Clear the Windows Update Cache (SoftwareDistribution Folder)

A corrupted Windows Update cache is one of the most common reasons Windows 10 security patches fail to install. Clearing it forces Windows to re‑download the update files.

Step 1: Stop Windows Update related services

1. Press Windows + R, type services.msc and press Enter.
2. In the Services window, find and stop these services one by one:
   • Windows Update
   • Background Intelligent Transfer Service (BITS)
   • Cryptographic Services
3. To stop a service, right‑click it and choose Stop.

Step 2: Delete the SoftwareDistribution download folder

1. Press Windows + R, type:

   C:\Windows\SoftwareDistribution
   

   and press Enter.

2. Open the Download folder inside SoftwareDistribution.
3. Press Ctrl + A to select everything, then press Delete.
   • If some files don’t delete, make sure you stopped the services above.

FAQ: Is it safe to delete the SoftwareDistribution folder?
Yes—Windows will recreate it automatically. You’re only removing temporary update files, which often fixes “Windows update failed to install” errors.

<h3″>Step 3: Start the services again

1. Go back to the Services window.
2. Right‑click and Start these services:
   • Windows Update
   • Background Intelligent Transfer Service (BITS)
   • Cryptographic Services

Now, open Settings > Update & Security > Windows Update and click Check for updates. See if the security patch installs successfully.

Verify Date, Time, Region, and Language

Incorrect date, time, or region can cause issues when Windows validates update packages from Microsoft’s servers, especially for security patches.

1. Open Settings (Windows + I).
2. Go to Time & Language > Date & time.
   • Turn on Set time automatically.
   • Turn on Set time zone automatically (or choose the correct time zone).
3. Click Region (or Region & language on older builds).
   • Make sure Country or region is correct.
   • Ensure your Windows display language and language pack are properly installed.
4. Restart your PC and try Windows Update again.

Run System File Checker (SFC) and DISM

Corrupted or missing system files often cause Windows 10 security patches to fail. Using SFC and DISM repairs the Windows component store and important system files.

Step 1: Run System File Checker (SFC)

• Type cmd in the Start menu search.
• Right‑click Command Prompt and choose Run as administrator.
• In the Command Prompt window, type:

  sfc /scannow
  

  and press Enter.

• Wait for the scan to reach 100%. This may take 10–20 minutes.
• When it finishes, restart your PC.

If SFC reports that it found corrupted files but could not fix some of them, proceed with DISM.

Step 2: Use DISM to repair Windows image

1. Open Command Prompt (Admin) again.
2. Run these commands one by one, pressing Enter after each:

   DISM /Online /Cleanup-Image /CheckHealth
   DISM /Online /Cleanup-Image /ScanHealth
   DISM /Online /Cleanup-Image /RestoreHealth
   

3. Allow each command to complete; /RestoreHealth can take some time.
4. Restart your computer when done.
5. Open Windows Update and try installing the security patch again.

Switch DNS to Google DNS

Sometimes Windows Update can’t reliably connect to Microsoft’s servers due to DNS or network issues. Changing to a more reliable DNS server can help.

1. Press Windows + R, type ncpa.cpl and press Enter.
2. Right‑click your active Wi‑Fi or Ethernet connection and select Properties.
3. Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
4. Choose Use the following DNS server addresses.
5. Enter:
   • Preferred DNS server: 8.8.8.8
   • Alternate DNS server: 8.8.4.4
6. Check Validate settings upon exit and click OK.
7. Close all windows and restart your PC.

After restart, try running Windows Update again.

Perform a Clean Boot to Avoid Conflicts

Third‑party software and services can conflict with Windows Update, especially deep‑hooking security software, system optimizers, and firewalls.

Performing a clean boot starts Windows with only Microsoft services and basic startup items.

• Press Windows + R, type msconfig and press Enter.
• Go to the Services tab.
• Check Hide all Microsoft services.
• Click Disable all.

• Go to the Startup tab and click Open Task Manager.
• In Task Manager, disable all startup items (right‑click each > Disable).

• Close Task Manager and click OK in System Configuration.
• Restart your PC.

Now try to install the pending security update from Settings > Update & Security > Windows Update.

When finished testing:

• Reopen msconfig and re‑enable your normal services/startup apps, or select Normal startup.

Manually Download and Install the Security Patch

If the same security update keeps failing via Windows Update, manually installing it often works.

Step 1: Find the KB number

1. Go to Settings > Update & Security > Windows Update.
2. Click View update history.
3. Look for the Security Update for Windows 10 that failed and note its KB number (for example, KB5034123).

Step 2: Download from Microsoft Update Catalog

1. Open your browser and go to:
   https://www.catalog.update.microsoft.com
2. In the search box, type the KB number (for example, KB5034123) and press Enter.
3. From the results, find the entry that matches:
   • Your Windows 10 version (e.g., 21H2, 22H2)
   • Your system type (x64‑based systems for most modern PCs)
4. Click Download next to the correct update.
5. In the pop‑up window, click the link to download the .msu file.

Step 3: Install the security update manually

1. After the download completes, locate the .msu file (usually in Downloads).
2. Double‑click it and follow the on‑screen instructions.
3. Restart your computer when prompted.
4. Open Windows Update again and confirm the security patch shows as Installed.

Reset Windows Update Components via Command Prompt

If security patches repeatedly fail even after clearing the cache, perform a more complete reset of Windows Update components.

1. Open Command Prompt as administrator (search cmd, right‑click, Run as administrator).
2. Run these commands one by one, pressing Enter after each:

   net stop wuauserv
   net stop cryptSvc
   net stop bits
   net stop msiserver
   
   ren C:\\Windows\\SoftwareDistribution SoftwareDistribution.old
   ren C:\\Windows\\System32\\catroot2 catroot2.old
   
   net start wuauserv
   net start cryptSvc
   net start bits
   net start msiserver
   

3. Close Command Prompt and restart your PC.
4. Go to Settings > Update & Security > Windows Update and click Check for updates.

This procedure fully resets the update database and catalogs, which often resolves stubborn Windows 10 security update failures.

How to Prevent Future Security Patch Failures

Once you fix the problem, follow these tips to reduce the chance of security updates failing again:

• Keep at least 10–15 GB free on your system drive.
• Don’t force‑shutdown your PC while updates are downloading or installing.
• Avoid using aggressive “tune‑up” or “registry cleaner” tools that can damage the update components.
• Keep important drivers (chipset, storage, network) up to date from your PC or motherboard manufacturer.
• Run SFC and DISM if you notice system instability.
• Install updates regularly instead of letting them pile up for months.

Frequently Asked Questions

Is it safe to delete the SoftwareDistribution folder?
Yes—Windows will recreate it automatically. You’re only deleting temporary update files and logs. This often fixes cases where a Windows 10 security patch fails to install repeatedly.
Will running SFC and DISM remove my personal files?
No—running SFC and DISM is safe for your personal data. These tools only scan and repair corrupted or missing Windows system files and the component store. They do not touch your documents, pictures, or installed apps, and they often resolve situations where a Windows 10 security update fails to install due to system file damage.

Is it safe to reset Windows Update components manually?
Yes—resetting Windows Update components with commands that stop services, rename SoftwareDistribution and Catroot2, and restart services is considered safe. This process only resets the update database and related services. It does not remove your personal files or programs, and it can fix stubborn Windows 10 security patch failures when other basic fixes don’t work.

Can I manually download a failed security patch from Microsoft Update Catalog?
Yes—manually downloading the specific KB from the Microsoft Update Catalog is a safe and supported method. As long as you choose the correct update that matches your Windows 10 version and system type (x64 for most PCs), installing it via the downloaded .msu file can successfully complete a security update that repeatedly fails through Windows Update.

Is it risky to use a clean boot while installing security updates?
No—a clean boot is not risky when done correctly. It simply starts Windows 10 with only essential Microsoft services and disables third‑party startup items temporarily. This helps you identify if another program is blocking Windows Update. After testing and installing your security patches, you can easily revert to normal startup without losing any data or installed applications.