Windows Update troubleshooting: logs, DISM, sfc and resets

Start DC01 and SRV01, and take a snapshot of SRV01 (“Before update lab”). Work as SAATLAB\adm.rahul in PowerShell as administrator on SRV01.

1Build WindowsUpdate.log and search it

On SRV01:

Get-WindowsUpdateLog -LogPath C:\Lab\WindowsUpdate.log
Select-String -Path C:\Lab\WindowsUpdate.log -Pattern 'FATAL|Exit code = 0x8' | Select-Object -Last 3 Line

You’ll see something like this:

Line
----
2026/10/20 09:14:22.1180123 1288  3410  Agent           * END * Finding updates CallerId = UpdateOrchestrator  Exit code = 0x00000000
2026/10/20 09:14:25.4421907 1288  3410  DownloadManager BITS job {7c1e...} completed successfully
2026/10/20 09:16:02.0094415 1288  3410  Handler         Exit code = 0x00000000

Exit code 0x00000000 means success. When a scan or download fails, this is where you’ll see the real code (for example 0x8024402c for a proxy problem) next to the component that failed.

✅ Checkpoint: C:\Lab\WindowsUpdate.log exists and you can search it for exit codes.

2Check component store health

On SRV01:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth

You’ll see something like this:

Deployment Image Servicing and Management tool
Version: 10.0.26100.1

Image Version: 10.0.26100.NNNN

No component store corruption detected.
The operation completed successfully.

[==========================100.0%==========================]
No component store corruption detected.
The operation completed successfully.

CheckHealth only reads a flag from earlier scans, so it takes seconds. ScanHealth checks every package and takes several minutes. If either reports corruption, the next command is /RestoreHealth.

✅ Checkpoint: Both DISM checks report no component store corruption.

3Verify system files with sfc

On SRV01:

sfc /scannow

You’ll see something like this:

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

sfc checks protected system files against the copies in the component store and replaces bad ones. Its details go into CBS.log, tagged [SR].

✅ Checkpoint: sfc reports no integrity violations.

4Analyse and clean up the component store

On SRV01:

DISM /Online /Cleanup-Image /AnalyzeComponentStore

You’ll see something like this:

Component Store (WinSxS) information:

Windows Explorer Reported Size of Component Store : 8.12 GB
Actual Size of Component Store : 7.86 GB
    Shared with Windows : 5.71 GB
    Backups and Disabled Features : 2.02 GB
    Cache and Temporary Data :  134.55 MB

Date of Last Cleanup : 2026-10-12 03:10:41
Number of Reclaimable Packages : 3
Component Store Cleanup Recommended : Yes

The operation completed successfully.

Clean up superseded components:

DISM /Online /Cleanup-Image /StartComponentCleanup

WinSxS looks huge in Explorer because most of it is shared with Windows through hard links. “Actual Size” is the real number. Cleanup removes old versions of updated components, which frees space for the next update.

Never delete files from WinSxS by hand.

✅ Checkpoint: AnalyzeComponentStore shows the real store size, and StartComponentCleanup completes.

5Reset Windows Update components

Stop the services, rename the caches, start again and run a fresh scan:

$svc = 'wuauserv', 'bits', 'cryptsvc'
Stop-Service $svc -Force
Rename-Item C:\Windows\SoftwareDistribution SoftwareDistribution.old
Rename-Item C:\Windows\System32\catroot2 catroot2.old
Start-Service $svc
$searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher()
$result = $searcher.Search("IsInstalled=0 and Type='Software'")
"Updates found: $($result.Updates.Count)"

You’ll see something like this:

Updates found: 0

Windows recreates both folders on the next scan. Update history in Settings may look empty after this, because that list lives in SoftwareDistribution; the installed updates themselves are untouched (check with Get-HotFix). Delete the .old folders after a week of good updates.

✅ Checkpoint: The services restart, the caches are recreated and a fresh scan completes.