A security update is the one kind of Windows update you cannot afford to postpone. It patches vulnerabilities that attackers are actively exploiting in the wild, and every day your laptop sits unpatched is another day those holes stay open. So when the monthly security update downloads, reaches a certain percentage, and then fails or rolls itself back, it deserves your immediate attention.

The good news is that security update failures almost always trace back to a small set of fixable causes: a corrupted update cache, missing disk space, an interfering security program, or a component store that needs repair. This guide walks you through each one in the order a technician would, from the quickest checks to the deeper repairs. You should be protected again by the end of it.

Before diving in, take thirty seconds to confirm the basics: the laptop is plugged into power, connected to a stable network, and has not simply paused updates. Technicians check these first because they resolve a surprising share of “failed” updates with zero real troubleshooting. If the basics check out, the sequence below will find the actual blocker.

Why this happens

  • Corrupted SoftwareDistribution cache: Interrupted downloads leave broken files that block every retry.
  • Insufficient disk space: Security updates need several gigabytes of working room to unpack and install.
  • Antivirus interference: Third-party security suites sometimes lock files the installer needs to replace.
  • Missing servicing stack update: Some cumulative security updates require a prerequisite SSU first.
  • Corrupted system files: Damaged component store files cause the installer to fail integrity checks.
  • Stuck update service: The Windows Update service can wedge into a bad state and refuse to proceed.
  • Metered connection: A metered network can silently prevent the update from finishing its download.
  • Pending restart deadlock: A previous update waiting on a restart can block the new security update from starting.

How to fix it

Work through these in order — diagnose first, then act.

Fix 1: Check the exact failure code

  1. Open Settings > Windows Update > Update history and find the failed security update.
  2. Note the KB number (for example, KB5062553) and any error code shown beside it.
  3. Write both down. The error code determines which fix below matters most.
  4. If no code appears, click the entry anyway; Windows sometimes reveals details on the second look.
  5. Check whether the failure repeats at the same stage each time — consistent failure points indicate a deterministic cause worth investigating.
  6. Note the date of the last successful update; a long gap suggests a deeper issue than a one-off glitch.

Fix 2: Free up disk space

  1. Open Settings > System > Storage and check how much free space remains on the C: drive.
  2. Aim for at least 10 GB free. Security updates stage large temporary files during installation.
  3. Run Disk Cleanup: search for it in Start, select C:, and tick Windows Update Cleanup and Temporary files.
  4. Delete the download staging folder contents only if the update has already failed: open C:\Windows\SoftwareDistribution\Download and remove its contents. Never delete the whole folder.
  5. Empty the Recycle Bin and remove old update backups via Disk Cleanup’s system files option.
  6. If space is critically low, temporarily move large media files to external storage until the update completes.

Fix 3: Run the Windows Update troubleshooter

  1. Go to Settings > System > Troubleshoot > Other troubleshooters.
  2. Click Run next to Windows Update and let it complete.
  3. Apply every fix it recommends, then restart the laptop.
  4. Try the security update again. If it still fails, the troubleshooter at least ruled out the simple causes — see our guide on what to do when the troubleshooter itself misbehaves .
  5. If the troubleshooter reports it could not fix everything, note what it lists — that becomes your next lead.
  6. Restart once more after applying its fixes; some repairs only finalize on boot.

Fix 4: Temporarily disable third-party antivirus

  1. Right-click your antivirus icon in the system tray and choose the temporary disable option, usually 10–15 minutes.
  2. Leave Microsoft Defender running; it is designed to cooperate with Windows Update.
  3. Retry the security update from Settings > Windows Update.
  4. Re-enable your antivirus immediately after, whether the update succeeds or not. Do not browse with protection off any longer than necessary.
  5. Also pause any third-party firewall or system utility that hooks file operations during the install.
  6. After re-enabling protection, run a quick scan to confirm nothing exploited the unprotected window.

Fix 5: Install the update manually from the Update Catalog

  1. Visit the Microsoft Update Catalog and search for the KB number from Fix 1.
  2. Pick the entry matching your Windows version and architecture (almost always x64 for modern laptops).
  3. Download the .msu file and double-click it to install.
  4. This bypasses the Windows Update service entirely, so it works even when the service itself is the problem. Restart when prompted.
  5. If the Catalog lists multiple packages, choose the cumulative update rather than individual patches.
  6. Keep the downloaded .msu file until you confirm the next month’s update installs normally.

Fix 6: Reset the Windows Update components

  1. Open an elevated Command Prompt (search cmd, right-click, Run as administrator).
  2. Stop the services: net stop wuauserv, net stop bits, net stop cryptsvc, net stop msiserver.
  3. Rename the cache folders: ren C:\Windows\SoftwareDistribution SoftwareDistribution.old and ren C:\Windows\System32\catroot2 catroot2.old.
  4. Restart the services with net start versions of the same four commands, then check for updates again.
  5. If a service refuses to stop, restart the laptop and try the sequence again immediately after boot.
  6. After renaming, verify the new SoftwareDistribution folder is created automatically on the next update check.

Fix 7: Repair system files with DISM and SFC

  1. In an elevated Command Prompt, run: DISM /Online /Cleanup-Image /RestoreHealth.
  2. Wait for it to finish; it downloads fresh copies of damaged component store files. For reference on the correct procedure, see Microsoft’s Windows support pages .
  3. Then run sfc /scannow and restart the laptop.
  4. After the restart, retry the security update. Repaired system files resolve a large share of stubborn install failures.
  5. If DISM reports it cannot find source files, rerun it with a Windows ISO mounted as the repair source.
  6. After SFC completes, check its log at C:\Windows\Logs\CBS\CBS.log if you want the full repair details.

Closing

Security updates fail for fixable reasons, and the path above covers them in the order of effort: identify the failure, clear space, remove interference, install manually if needed, and repair the plumbing underneath. Once the update is in, keep an eye on next month’s Patch Tuesday — a healthy update pipeline is your laptop’s cheapest security tool. If updates keep misbehaving, read our guide on what to do when Windows Update rolls back changes . Make a habit of checking Update history monthly even when nothing seems wrong — catching failures early keeps the fixes small. A laptop that installs security updates quietly in the background is a laptop you never have to think about, which is exactly the goal.

Frequently asked questions

Why does my security update keep failing to install?
The most common causes are corrupted update cache files, low disk space, conflicting antivirus software, or system file corruption. Security updates also fail when required servicing stack updates are missing or when a previous update left the system in a partially installed state. Each cause has a distinct fix, so work through them in order.
How do I install a failed security update manually?
Open the Microsoft Update Catalog site, search for the KB number shown in Windows Update history, download the version matching your Windows build and architecture, then run the .msu file. Manual installation bypasses the Windows Update service entirely, so it works even when the built-in updater is broken. Restart after installation completes.
Is it safe to pause security updates while I troubleshoot?
You can pause updates for up to five weeks in Settings, but treat this as a temporary measure only. Security updates close vulnerabilities that malware actively exploits. Keep the pause as short as possible, and unpause as soon as you finish troubleshooting. Never leave updates paused indefinitely.
Will resetting Windows Update components delete my files?
No. Resetting Windows Update components only clears the update cache and re-registers the update services. Your documents, photos, applications, and settings are untouched. It is one of the safest repair procedures in Windows, which is why technicians reach for it so often.