Microsoft’s monthly Patch Tuesday releases and cumulative updates are essential for security and stability, but the experience can grind to a halt when Windows throws the dreaded “Windows Update service not running” error. The message signals that background update components—wuauserv, BITS, Cryptographic Services—aren’t cooperating, leaving your system vulnerable. This guide covers every proven fix, from the built-in Windows Update troubleshooter to command-line repair tools and last-resort WinRE interventions.

What “Windows Update service not running” really means

Windows Update relies on several services that must be in a specific state: running and set to start automatically (or manually triggered by the system). The core service is wuauserv (Windows Update). When it stops or its dependencies break, the Settings app shows the error. Behind the scenes, it means Windows cannot scan for, download, or stage updates. The root cause often traces back to corrupted service registrations, permission changes, malware, or a Windows Update storehouse (the SoftwareDistribution folder) that has become damaged.

The key services involved:
- wuauserv – Windows Update
- bits – Background Intelligent Transfer Service
- cryptsvc – Cryptographic Services
- trustedinstaller – Windows Modules Installer

All four must be running, and wuauserv depends on RPC (remote procedure call) and DCOM Server Process Launcher, which must also be operational. A single misconfiguration triggers the failure.

Start with the Windows Update Troubleshooter

Microsoft’s own automated troubleshooter still works on Windows 10 and 11. To launch it fast:

  1. Press Win + I to open Settings.
  2. Navigate to System > Troubleshoot > Other troubleshooters.
  3. Find “Windows Update” and click Run.

The troubleshooter checks service status, clears temporary files, and resets the BITS queue. Sometimes it resolves the issue without further intervention. If it reports that it fixed something, restart your PC before trying Windows Update again.

If the troubleshooter isn’t available (it was deprecated from modern versions but still accessible via the link), you can download the latest version from Microsoft’s download page.

Manual service reset: the three-step command

When the troubleshooter fails, the next line of defense is manually stopping, registering, and starting the affected services. Open an elevated Command Prompt (right-click Start > Terminal (Admin) or type cmd in search, right-click and choose Run as Administrator) and run these commands in sequence:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver

After stopping, re-register the services:

sc config wuauserv start= auto
sc config bits start= auto
sc config cryptsvc start= auto
sc config trustedinstaller start= demand

Now restart the services:

net start wuauserv
net start cryptSvc
net start bits
net start msiserver

If any service fails to start, note the error code. Common culprits are access denied (permissions) or dependencies not started. Ensure RPC and DCOM services are running by checking services.msc and setting them to Automatic.

Reset the Windows Update storehouse

Corrupted update files in SoftwareDistribution and Catroot2 folders are frequent offenders. Resetting them forces Windows to rebuild the update database from scratch. Run these commands from the same elevated command prompt:

net stop wuauserv
net stop bits
ren C:\\Windows\\SoftwareDistribution SoftwareDistribution.old
ren C:\\Windows\\System32\\catroot2 Catroot2.old
net start wuauserv
net start bits

After a reboot, Windows recreates both folders. Your update history will be cleared, but no installed updates are harmed. Check for updates again.

Deploy DISM and SFC for system-level corruption

If the error persists, underlying system file or image corruption may be the true cause. Run the System File Checker first:

sfc /scannow

If SFC completes but reports “Windows Resource Protection found corrupt files and was unable to fix some of them,” or if the update error continues, use the Deployment Image Servicing and Management tool:

DISM /Online /Cleanup-Image /RestoreHealth

This command downloads clean copies of system files from Windows Update (or a specified source) to repair the component store. Note that DISM itself can fail if Windows Update is completely broken. In that case, use the Windows installation media or a recovery drive as the source:

DISM /Online /Cleanup-Image /RestoreHealth /Source:D:\\sources\\sxs /LimitAccess

Replace D: with the drive letter of your inserted USB or mounted ISO.

Use a PowerShell script to reset all Windows Update components

For a more thorough cleanup, Microsoft publishes a PowerShell script that automates the entire reset process—stopping services, deleting folders, re-registering DLLs, and restarting components. You can run it from an elevated PowerShell window:

Stop-Service -Name wuauserv,bits,cryptsvc -Force
Start-Sleep -Seconds 5
Remove-Item -Path "$env:systemroot\\SoftwareDistribution" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "$env:systemroot\\System32\\catroot2" -Recurse -Force -ErrorAction SilentlyContinue
Set-Service -Name wuauserv -StartupType Manual
Set-Service -Name bits -StartupType Manual
Set-Service -Name cryptsvc -StartupType Manual
Start-Service -Name wuauserv
Start-Service -Name bits
Start-Service -Name cryptsvc

This script is safe; it merely performs the manual steps in a single sweep. After execution, restart the system.

Turn to WinRE when normal boot fails

When the update error prevents you from even signing in or when the previous steps don’t work inside Windows, Windows Recovery Environment (WinRE) is the fallback. Boot into WinRE by holding Shift while clicking Restart, or boot from a Windows installation USB and select Repair your computer.

Once in WinRE, try these tools in sequence:

1. System Restore

Navigate to Troubleshoot > Advanced Options > System Restore. Choose a restore point dated before the error appeared. This can reverse registry changes, driver installations, or system setting alterations that broke Windows Update.

2. Startup Repair

Under Advanced Options, run Startup Repair. It scans for missing or corrupted system files that affect boot and, sometimes, update services. If it finds issues, it will attempt to fix them automatically.

3. Command Prompt in WinRE

If the above don’t help, open a Command Prompt from Advanced Options. Here you can perform an offline repair of the Windows image using DISM, targeting the OS partition. First, identify the correct drive letters—the Windows installation is usually C:, but in WinRE it might be mapped differently. Use dir C:\\Windows to confirm.

Then run:

DISM /Image:C:\\ /Cleanup-Image /RestoreHealth /Source:D:\\sources\\sxs

Adjust D: to the drive containing your Windows installation media. Alternatively, if you have a recovery drive, you can specify its sources\\sxs path.

After DISM completes, run:

sfc /scannow /offbootdir=C:\\ /offwindir=C:\\Windows

This offline SFC scan verifies all protected system files using the WinRE environment and replaces corrupted ones from the component store.

4. Resetting components from WinRE

You can also manually stop services and rename folders right from the WinRE command prompt, though service manipulation requires understanding that the registry hives are offline. A simpler route: use the same DISM /Image command, which already includes the service restoration. Still, if you prefer, load the SOFTWARE hive and modify service startup types, but that’s an advanced task best left for extreme cases.

Rebuild BCD and boot configuration

In some instances, Windows Update service failure is linked to a corrupt Boot Configuration Data (BCD) store, especially after failed updates that manipulate boot entries. In WinRE, open Command Prompt and run:

bootrec /fixmbr
bootrec /fixboot
bootrec /scanos
bootrec /rebuildbcd

After these commands, restart and see if the update service initialises properly. If the system was stuck in an update boot loop, this often resolves it.

When all else fails: reset or reinstall Windows

If the Windows Update service remains unresponsive, a system reset might be the cleanest path. In WinRE, go to Troubleshoot > Reset this PC, and choose to keep your files. This reinstalls Windows while preserving personal data, but removes apps and drivers. After the reset, Windows Update should function.

As a last resort, a complete clean installation using media creation tool ensures a fresh start. Ensure you back up all data before proceeding.

Preventing “service not running” in the future

Once you’ve conquered the error, adopt these habits to reduce recurrence:
- Keep the system date and time accurate. Signed certificates for update connections rely on correct time.
- Avoid third-party “optimizer” tools that meddle with services.
- Regularly run sfc /scannow after major updates.
- Pause updates manually if you delay them; abrupt power loss during an update leaves services in a bad state.
- Monitor the Event Viewer under Windows Logs > System for service-related errors early.

The state of Windows Update reliability in 2026

As of spring 2026, Windows 11’s servicing model has grown more robust, but the underlying service architecture remains vulnerable. Microsoft’s move toward phased rollouts and cumulative update consolidation has reduced the frequency of such errors, yet they still appear on systems with legacy software, customizations, or that have undergone multiple feature updates. The tools at your disposal—troubleshooters, DISM, SFC, and WinRE—remain essential and unchanged in their core functions, even as Windows evolves. For many enthusiasts, the command prompt remains the ultimate weapon against update gremlins.

If you encounter this error, the progression from simple service restarts to an offline DISM repair will almost always clear it. Bookmark this guide, and you’ll never be left staring at that stubborn red error again.