Windows Update Stuck or Failing? Fix Windows Update with a Free PowerShell Script

Windows Update stuck or failing? This free PowerShell script safely resets the update components so you can fix Windows Update without reinstalling Windows. Below you’ll find step-by-step instructions, the full script, manual commands, and fixes for common error codes.

Explore more: Guides and Tutorials

Windows Update stuck again?

You click Check for updates and nothing happens. Or the progress bar sits at 0% for hours. Or you get an error code such as 0x80070002 and no explanation.

This is one of the most common Windows problems, and it is usually fixable without reinstalling Windows. In most cases the update cache is corrupted or an update service has stopped. Resetting those components gives Windows Update a clean start.

This guide gives you a free PowerShell script that does the reset safely, explains every step it takes, and shows you the manual commands if you prefer to do it yourself.

Why Windows Update gets stuck

Windows downloads updates into a cache folder called SoftwareDistribution and keeps signature data in a folder called catroot2. If a download is interrupted, the disk fills up, or a system file is damaged, these folders can end up in a bad state. The update services then keep retrying the same broken download.

Common causes:

• A corrupted update cache (SoftwareDistribution or catroot2)
• A required service (Windows Update, BITS, Cryptographic Services) stopped or disabled
• Low free disk space (updates often need 10 GB or more)
• A pending restart that was never completed
• Damaged Windows system files
• Proxy, VPN or policy settings blocking the update servers

Signs you need to reset Windows Update

• “Checking for updates” never finishes
• Downloads stay at 0% or a fixed percentage
• The same update fails again and again
• Error codes such as 0x80070002, 0x80070422, 0x80073712 or 0x8024402C
• The Windows Update page is blank or the “Check for updates” button does nothing

What this script does

The script is called Repair-WindowsUpdate. It works in two stages.

Stage 1: checks only (changes nothing). It reports:

• Whether a restart is pending
• How much free space your system drive has
• The state of the update services
• Whether update policies (work, school or tweak tools) override Windows Update
• The most recent Windows Update errors from the event log

Stage 2: repair (only when you add -Execute). It then:

1. Sets any disabled update service back to Manual
2. Stops the update services
3. Clears stuck BITS download jobs
4. Renames the SoftwareDistribution and catroot2 folders so Windows rebuilds them (nothing is deleted; the old copies are kept as .bak folders)
5. Restarts the services
6. Starts a fresh update scan
7. Optionally runs DISM and SFC to repair damaged system files (-DeepRepair)

Because the old folders are renamed rather than deleted, you can undo the change if something unexpected happens.

Before you start

• Save your work and plug in your laptop. The repair itself takes a minute or two, and the optional deep repair can take 15 to 40 minutes.
• You need an Administrator PowerShell window.
• Your update history list will look empty afterwards. Installed updates stay installed.
• The script is provided as is, without warranty. Always run the check-only mode first.

How to use the script to fix windows update

Step 1. Open PowerShell as Administrator. Right-click the Start button and choose Terminal (Admin) or Windows PowerShell (Admin).

Step 2. Paste the script. Copy the full script from the section below and paste it into the window, then press Enter. Nothing runs yet. It only loads the Repair-WindowsUpdate command.

Step 3. Run the check first.

Repair-WindowsUpdate

Read the output. It lists problems such as a pending restart, low disk space or disabled services, and shows the latest update error codes.

Step 4. Apply the repair.

Repair-WindowsUpdate -Execute

Step 5. If it still fails, run the deep repair.

Repair-WindowsUpdate -Execute -DeepRepair

Step 6. Restart your PC, then open Settings > Windows Update > Check for updates.

The script to fix Windows Update

Copy the whole block, including the last line.

# =====================================================================
# Repair-WindowsUpdate
# Fixes stuck, failing or endlessly "pending" Windows Update.
#
# HOW TO USE
#   1. Open PowerShell as Administrator
#   2. Paste this whole script once (it only defines the function)
#   3. Run:
#        Repair-WindowsUpdate                       -> check only, changes NOTHING
#        Repair-WindowsUpdate -Execute              -> reset update components
#        Repair-WindowsUpdate -Execute -DeepRepair  -> also DISM + SFC (slow, 15-40 min)
#
# WHAT IT DOES (with -Execute)
#   - Stops the update services (wuauserv, bits, cryptsvc, msiserver, usosvc)
#   - Clears stuck BITS download jobs
#   - RENAMES (does not delete) C:\Windows\SoftwareDistribution and catroot2
#     so Windows rebuilds them; the old copies are kept as *.bak_<time>
#   - Sets any DISABLED update service back to Manual
#   - Restarts the services and triggers a new update scan
#   - -DeepRepair: DISM /RestoreHealth and sfc /scannow
#
# NOTES
#   - Your update HISTORY list resets after this (installed updates stay installed)
#   - The .bak folders can be deleted later to free space (often 1-5 GB)
#   - Provided as is, without warranty. Use at your own risk.
# =====================================================================
function Repair-WindowsUpdate {
    [CmdletBinding()]
    param(
        [switch]$Execute,
        [switch]$DeepRepair
    )

    $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
               ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
    if (-not $isAdmin) {
        Write-Host "Please run PowerShell as Administrator." -ForegroundColor Red
        return
    }

    $stamp = Get-Date -Format 'yyyyMMdd_HHmmss'
    $svcNames = 'wuauserv', 'bits', 'cryptsvc', 'msiserver', 'usosvc'

    function Say([string]$t) { Write-Host "`n=== $t ===" -ForegroundColor Cyan }
    function Do-Step([string]$Desc, [scriptblock]$Action) {
        if ($Execute) {
            Write-Host "  DO   $Desc" -ForegroundColor Yellow
            try { & $Action } catch { Write-Warning "Failed: $Desc -> $($_.Exception.Message)" }
        } else {
            Write-Host "  [dry] $Desc" -ForegroundColor Gray
        }
    }

    Write-Host ("Mode: {0}" -f $(if ($Execute) { 'EXECUTE - changes will be made' } else { 'CHECK ONLY - no changes' })) `
        -ForegroundColor $(if ($Execute) { 'Yellow' } else { 'Green' })

    # ---------- 1. Diagnostics (read-only) ----------
    Say '1. Diagnostics'

    $os = Get-CimInstance Win32_OperatingSystem
    Write-Host "  Windows: $($os.Caption) build $($os.BuildNumber)"

    $pending = (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending') -or
               (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired')
    if ($pending) { Write-Host "  [WARN] A restart is pending. Restart first, then retry Windows Update." -ForegroundColor Yellow }
    else { Write-Host "  [OK]   No pending restart" -ForegroundColor Green }

    $sys = Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='$($env:SystemDrive)'"
    $freeGB = [math]::Round($sys.FreeSpace / 1GB, 1)
    if ($freeGB -lt 10) { Write-Host "  [WARN] Only $freeGB GB free on $($env:SystemDrive). Updates usually need 10+ GB." -ForegroundColor Yellow }
    else { Write-Host "  [OK]   $freeGB GB free on $($env:SystemDrive)" -ForegroundColor Green }

    foreach ($n in $svcNames) {
        $s = Get-Service -Name $n -ErrorAction SilentlyContinue
        if ($s) {
            $flag = if ($s.StartType -eq 'Disabled') { '[WARN]' } else { '[OK]  ' }
            $col  = if ($s.StartType -eq 'Disabled') { 'Yellow' } else { 'Green' }
            Write-Host ("  {0} service {1,-10} status={2}, start type={3}" -f $flag, $n, $s.Status, $s.StartType) -ForegroundColor $col
        }
    }

    $pol = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -ErrorAction SilentlyContinue
    if ($pol -and ($pol.WUServer -or $pol.DisableWindowsUpdateAccess -or $pol.DoNotConnectToWindowsUpdateInternetLocations)) {
        Write-Host "  [WARN] Update POLICIES are set (work/school or a tweak tool). This script does not remove them:" -ForegroundColor Yellow
        if ($pol.WUServer) { Write-Host "         WUServer = $($pol.WUServer)" }
        if ($pol.DisableWindowsUpdateAccess) { Write-Host "         DisableWindowsUpdateAccess = $($pol.DisableWindowsUpdateAccess)" }
        if ($pol.DoNotConnectToWindowsUpdateInternetLocations) { Write-Host "         DoNotConnectToWindowsUpdateInternetLocations = $($pol.DoNotConnectToWindowsUpdateInternetLocations)" }
    } else { Write-Host "  [OK]   No update policy overrides found" -ForegroundColor Green }

    Write-Host "`n  Recent Windows Update errors (error codes help identify the cause):"
    try {
        $ev = Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-WindowsUpdateClient/Operational'; Level = 2 } -MaxEvents 5 -ErrorAction Stop
        foreach ($e in $ev) {
            $msg = ($e.Message -split "`r?`n")[0]
            if ($msg.Length -gt 110) { $msg = $msg.Substring(0, 110) + '...' }
            Write-Host ("   {0}  {1}" -f $e.TimeCreated.ToString('yyyy-MM-dd HH:mm'), $msg)
        }
    } catch { Write-Host "   None found." }

    # ---------- 2. Repair steps ----------
    Say '2. Repair steps'

    foreach ($n in $svcNames) {
        $s = Get-Service -Name $n -ErrorAction SilentlyContinue
        if ($s -and $s.StartType -eq 'Disabled') {
            Do-Step "Set service $n from Disabled to Manual" { Set-Service -Name $n -StartupType Manual }
        }
    }

    foreach ($n in $svcNames) {
        Do-Step "Stop service $n" { Stop-Service -Name $n -Force -ErrorAction SilentlyContinue }
    }

    Do-Step "Clear stuck BITS transfer jobs" {
        Get-BitsTransfer -AllUsers -ErrorAction SilentlyContinue | Remove-BitsTransfer -ErrorAction SilentlyContinue
    }

    $folders = @(
        @{ Path = "$env:windir\SoftwareDistribution"; New = "SoftwareDistribution.bak_$stamp" },
        @{ Path = "$env:windir\System32\catroot2";    New = "catroot2.bak_$stamp" }
    )
    foreach ($f in $folders) {
        if (Test-Path -LiteralPath $f.Path) {
            $p = $f.Path; $nn = $f.New
            Do-Step "Rename $p  ->  $nn" { Rename-Item -LiteralPath $p -NewName $nn -ErrorAction Stop }
        }
    }

    foreach ($n in 'cryptsvc', 'bits', 'wuauserv', 'usosvc') {
        $s = Get-Service -Name $n -ErrorAction SilentlyContinue
        if ($s -and $s.StartType -ne 'Disabled') {
            Do-Step "Start service $n" { Start-Service -Name $n -ErrorAction SilentlyContinue }
        }
    }

    if ($DeepRepair) {
        Say '3. Deep repair (slow)'
        Do-Step "DISM /Online /Cleanup-Image /RestoreHealth" { & dism.exe /Online /Cleanup-Image /RestoreHealth }
        Do-Step "sfc /scannow" { & sfc.exe /scannow }
    } else {
        Write-Host "`n  (Tip: add -DeepRepair to also repair Windows system files with DISM and SFC.)" -ForegroundColor DarkGray
    }

    Do-Step "Trigger a new Windows Update scan" { & UsoClient.exe StartScan }

    # ---------- Summary ----------
    Say 'Done'
    if ($Execute) {
        Write-Host "1. RESTART your PC now."
        Write-Host "2. Then open Settings > Windows Update > Check for updates."
        Write-Host "3. If it still fails, note the error code above and run again with -DeepRepair."
        Write-Host "4. Old folders were kept as SoftwareDistribution.bak_$stamp and catroot2.bak_$stamp."
    } else {
        Write-Host "This was a check only. Run  Repair-WindowsUpdate -Execute  to apply the repair." -ForegroundColor Green
    }
}

Write-Host "Loaded. Run:  Repair-WindowsUpdate   (check only)   or   Repair-WindowsUpdate -Execute" -ForegroundColor Cyan

How the script works, command by command

You can read the code above, but here is what the main parts do.

Service reset. Windows Update depends on four services: wuauserv (Windows Update), bits (Background Intelligent Transfer Service), cryptsvc (Cryptographic Services) and msiserver (Windows Installer). The script stops them so their files are no longer in use, then starts them again after the cleanup.

Folder rename. C:\Windows\SoftwareDistribution holds downloaded updates and update history. C:\Windows\System32\catroot2 holds update signature data. Renaming both forces Windows to create fresh copies the next time it checks for updates. The old folders stay on disk as SoftwareDistribution.bak_<time> and catroot2.bak_<time>. Once everything works, you can delete them to free several gigabytes.

DISM and SFC (optional). DISM /Online /Cleanup-Image /RestoreHealth repairs the Windows component store from Microsoft’s servers. sfc /scannow then checks protected system files and replaces damaged ones. These are slow, which is why they only run with -DeepRepair.

Fix Windows update manually (without the script)

If you prefer to run the commands yourself, open Command Prompt as Administrator and run:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserver

Then repair system files:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Restart and check for updates again.

Common Windows Update error codes

The script shows recent error codes. Here is what some of the most common ones usually mean.

These are general guides. The same code can have more than one cause, so use the check-only output to narrow it down.

If it still does not work

• Restart first. A pending restart blocks new updates.
• Free disk space. Aim for at least 10 GB free on your system drive.
• Check update policies. If the script reports policy overrides, your PC may be managed by work or school, or a “tweak” tool may have blocked updates.
• Test your connection. A DNS or proxy problem looks like a Windows Update problem. See our network fixer guide for how to diagnose it.
• Try the Microsoft Update Catalog. You can download a specific update (search by its KB number) and install it manually.
• Use an in-place upgrade. If system files are badly damaged, reinstalling Windows over itself with the Media Creation Tool keeps your files and apps.

Frequently Asked Questions (FAQ)

Conclusion

Most stuck or failing Windows Updates come down to a damaged update cache or a stopped service. The script above checks for those problems first, then resets the update components in a reversible way. Start with the check-only mode, apply the repair if needed, and restart.

If this guide helped, you may also like our other free tools: the PC Health Checker, the Disk Space Analyzer and the Network Fixer.

Disclaimer: Scripts are provided as is, without warranty. Back up important data and use at your own risk.