Full Windows Update Repair Script for Stuck or Broken Updates

Best place to run it

Elevated Command Prompt is the right execution context for this page. Because this repair touches protected Windows state, a normal unelevated shell can return misleading access errors or partial results.

Fast repair workflow

1. Start from the exact symptom on this page: Updates download and fail again and again with the same codes or vague messages
2. Run the primary repair line exactly as shown: net stop wuauserv net stop bits net stop cryptsvc net stop msiserver ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 catroot2.old DISM /Online /Cleanup-Image /RestoreHealth sfc /scannow net start msiserver net start cryptsvc net start bits net start wuauserv.
3. This workflow is tuned for this repair, so avoid mixing it with unrelated repair commands too early.
4. Reboot if the servicing stack or protected files were changed, then retry the original Windows action.
5. Escalate only after reading the output, usually toward CBS.log, DISM source repair, or Windows Update-specific repair.

Copyable wrapper script

Use this wrapper when you want the page command inside a clearer script block with start and finish prompts.

Verification commands after the repair

These follow-up commands help you check whether the repair actually changed the Windows state that matters, instead of assuming success from a single line.

What problem this script is trying to solve

It targets Windows Update states that survive a simple reboot or a small service restart and need a wider reset of both the update queue and the servicing stack.

• Updates download and fail again and again with the same codes or vague messages.
• Windows Update sits on preparing, installing, or downloading for too long.
• DISM, SFC, or update history already suggest servicing damage.

How the script works

The script stops core update-related services, renames the update download and catalog folders so Windows rebuilds them, repairs the component store with DISM, runs SFC against protected files, and starts the services again.

When it makes sense to run it

Use it when lighter Windows Update repair steps did not help and you want a more complete reset before trying the update again.

Before you run this command

• Open an elevated Command Prompt or PowerShell window before running net stop wuauserv net stop bits net stop cryptsvc net stop msiserver ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 catroot2.old DISM /Online /Cleanup-Image /RestoreHealth sfc /scannow net start msiserver net start cryptsvc net start bits net start wuauserv.
• Confirm that the symptom really matches this guide, especially if you are seeing signs such as: updates download and fail again and again with the same codes or vague messages.
• Keep any exact DISM, SFC, CBS, or Windows Update error output because those details matter in the next step.

What result to expect

After running net stop wuauserv net stop bits net stop cryptsvc net stop msiserver ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 catroot2.old DISM /Online /Cleanup-Image /RestoreHealth sfc /scannow net start msiserver net start cryptsvc net start bits net start wuauserv, compare the result against the symptom that brought you here. The most useful checkpoint is whether updates download and fail again and again with the same codes or vague messages becomes less frequent, changes form, or produces a clearer error message. A command page is stronger when it helps you verify a real change instead of just assuming the line must have worked.

How to verify that it worked

The best verification step after net stop wuauserv net stop bits net stop cryptsvc net stop msiserver ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 catroot2.old DISM /Online /Cleanup-Image /RestoreHealth sfc /scannow net start msiserver net start cryptsvc net start bits net start wuauserv is to repeat the action that previously triggered the problem. If windows update sits on preparing, installing, or downloading for too long still appears in exactly the same way, the command probably was not the whole answer and you should move to the next targeted check instead of assuming the page is finished.

Why administrator rights matter here

This command changes system integrity and component corruption. Run it in an elevated shell so Windows can apply the repair instead of only returning an access or privilege error.

Before you run it

This script should be run as administrator. Renaming the update cache folders is a normal repair step, but it also removes the current local download cache, so the next update attempt may need to fetch files again.

When this is probably the wrong fix

This is not the right first fix for a single third-party app bug, a browser-only issue, or obvious hardware failure. Use it when the symptom points to Windows image health, recurring update corruption, or protected system files.

What to do if it does not help

If net stop wuauserv net stop bits net stop cryptsvc net stop msiserver ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 catroot2.old DISM /Online /Cleanup-Image /RestoreHealth sfc /scannow net start msiserver net start cryptsvc net start bits net start wuauserv does not improve updates download and fail again and again with the same codes or vague messages, move to the next repair step that matches the same symptom family instead of piling on random commands. The best follow-up depends on whether the failure is mainly about system integrity and component corruption.