"We Couldn't Connect to the Update Service" in Windows 11 & 10: Every Fix

"We couldn't connect to the update service. We'll try again later, or you can check now" means Windows Update could not reach Microsoft's update servers. Work through these in order: check the PC's date and time, restart the router and PC, turn off any VPN or proxy, run netsh winhttp reset proxy in an administrator Terminal, restart the Windows Update, BITS and Cryptographic services, and if it still fails, reset the update components. Here is the cause most guides miss: on PCs that were once used at work or school, a leftover policy can point Windows Update at a company server that no longer exists. The browser works perfectly, but Windows Update keeps knocking on a door that is gone. This page shows how to spot and remove it, and every other cause in order of likelihood.

Ethan bought a refurbished laptop that had been a company machine in its first life. The internet worked, email worked, streaming worked, but Windows Update showed "We couldn't connect to the update service" every single day for two weeks. He restarted the router, ran the troubleshooter, even reset the network. Nothing. At Jake's shop the fix took four minutes: a registry key left by the old company told Windows to get updates from a server called WSUS01 on a network the laptop would never see again. Jake deleted the key, restarted the update service, and forty updates started downloading. That story is why this page checks for leftover policies early, not as an afterthought.

None of these fixes risk your files. The update component reset deletes only downloaded update files, which Windows fetches again. Work top to bottom and stop when updates start downloading; most PCs are fixed in the first four steps.

What the error means, and every cause in one table

Windows Update talks to Microsoft's servers through its own connection stack (WinHTTP), not through your browser. That is why a browser can load every website while Windows Update still cannot connect. The causes, roughly from most to least common:

Quick checks first (five minutes)

1. Check again. Open Settings > Windows Update and click Check for updates. Microsoft's service occasionally has short outages; the message literally says "we'll try again later" for that reason.
2. Restart the PC. Use Restart, not Shut down; Fast Startup means Shut down does not fully reset Windows.
3. Restart the router. Unplug it for 30 seconds, plug it back in, and wait until the internet light is steady.
4. Try another connection. Use a phone hotspot or another Wi-Fi network for one check. If updates work there, the problem is your home or office network, not Windows.
5. Check you are not on a captive portal. Hotel, cafe and campus Wi-Fi often needs a sign-in page before anything but the browser works. Our guide to Wi-Fi login pages helps when that page will not appear.

Fix the date, time and time zone

Windows Update uses encrypted connections that check certificates, and certificates are only valid for certain dates. If the PC's clock is wrong by more than a few minutes, especially on a PC whose CMOS battery has died or that was off for months, the connection fails and you see this error, often with code 0x80072f8f.

1. Open Settings > Time & language > Date & time.
2. Turn on Set time automatically and Set time zone automatically, or choose the correct time zone by hand.
3. Click Sync now under Additional settings.
4. Check for updates again.

If Sync now fails too, run w32tm /resync in an administrator Terminal. If the clock resets to an old date every time the PC is unplugged, the motherboard's coin battery needs replacing, a cheap job for any repair shop.

Also check the time zone and the year, not just the hour. A PC set to the right time in the wrong year, which happens after a dead battery resets the clock to the manufacturer's default date, fails every certificate check while looking almost right at a glance in the taskbar. Hover over the clock or open Date & time to see the full date. Dual-boot PCs with Linux can also drift by several hours, because the two systems store the hardware clock differently; syncing in Windows after each switch fixes that.

Turn off VPN, proxy apps and "secure DNS" tools

VPNs route traffic through another server, and some VPN servers block or throttle Microsoft's update addresses, or the VPN's own firewall blocks the update service. Disconnect the VPN, check for updates, and reconnect afterward. The same goes for:

• Browser-independent proxy apps and "ad blocking" system services.
• Parental control apps that filter all traffic.
• Corporate security agents left over from a previous employer.
• Network "optimizer" utilities.

If updates work with the VPN off, look in the VPN app for split tunneling and exclude Windows Update, or simply update while disconnected.

"Secure DNS" tools deserve a separate mention. Apps that force all DNS lookups through an encrypted resolver, and some browser-independent DNS-over-HTTPS clients, can fail in a way that only system services notice. Windows 11 has its own encrypted DNS option in the network's DNS settings; if you turned on DNS over HTTPS with a resolver that is unreachable or filtered, set it back to Off or to a well-known resolver, and check for updates again.

Reset the WinHTTP proxy (the hidden proxy)

Windows has two proxy settings: the one in Settings, which browsers use, and a separate WinHTTP proxy, which Windows Update and other system services use. A VPN, an old company setup or a tweak tool can set the WinHTTP proxy and never clear it. Your browser works, but Windows Update tries to go through a proxy that is not there.

1. Right-click Start and open Terminal (Admin).
2. Run netsh winhttp show proxy. If it says Direct access (no proxy server), this is not your problem.
3. If it lists a proxy server you do not use, run netsh winhttp reset proxy.
4. Also open Settings > Network & internet > Proxy. Turn off Use a proxy server under Manual proxy setup unless you need one, and leave Automatically detect settings on.
5. Restart and check for updates.

If your network genuinely requires a proxy, such as some school and office networks, run netsh winhttp import proxy source=ie instead, which copies your browser's proxy into WinHTTP so both match.

Remove a leftover work or school update policy

This is Ethan's story, and it is common on refurbished business laptops, PCs bought from a company, and home PCs that were once connected to a school account. Companies point Windows Update at their own update server (WSUS) or control it with policies. When the PC leaves the company, the setting can remain.

Check for it

• Settings > Windows Update shows Some update settings are managed by your organization or *Some settings are managed by your organization. Click View configured update policies to see what is set.
• In Terminal, run reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate. If you see WUServer or WUStatusServer with an address like http://wsus01.contoso.local:8530, that is the leftover setting.
• Also check reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU for UseWUServer set to 1.

Remove it (home PCs that you own)

1. First check Settings > Accounts > Access work or school. If an old work or school account is listed and you no longer belong to that organization, click it and Disconnect. That often removes the policies itself.
2. If the policies remain, open Terminal (Admin) and back up the key: reg export HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate "%USERPROFILE%\Desktop\wu-policy-backup.reg".
3. Delete it: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /f.
4. Restart the update service: net stop wuauserv then net start wuauserv, or simply restart the PC.
5. Check for updates. The "managed by your organization" message should be gone.

Do not do this on a PC that still belongs to an employer or school. There, the policy is intentional and the update server is IT's responsibility; tell IT about the error instead. On a PC you own outright, removing a dead company's update policy is exactly what Microsoft's own support staff recommend for this situation.

Restart the Windows Update services

Windows Update depends on several services. If one has stopped, or is stuck, updates cannot start.

1. Press Windows + R, type services.msc, and press Enter.
2. Find Windows Update, right-click it and choose Restart (or Start if it is stopped).
3. Do the same for Background Intelligent Transfer Service, Cryptographic Services, and Update Orchestrator Service.
4. Check that their Startup type is not Disabled. Windows Update and BITS are normally Manual (Trigger Start) or Manual; Cryptographic Services is Automatic.

If Windows Update is Disabled and you cannot change it, a "stop updates" tool or a script has locked it. Our guide to error 0x80070005 covers permission problems on update services in detail.

Run the Windows Update troubleshooter

On Windows 11, open Settings > System > Troubleshoot > Other troubleshooters and click Run next to Windows Update. On current Windows 11 versions this opens the Get Help app, which runs the same automated checks: it restarts services, clears some cache files and resets certain settings. On Windows 10, it is under Settings > Update & Security > Troubleshoot > Additional troubleshooters.

The troubleshooter is worth one run because it is quick and safe, but it does not check WinHTTP proxies or leftover policies, which is why it so often reports "Troubleshooting couldn't identify the problem" while the error continues.

Reset Windows Update components (the full reset)

When the error persists, the update cache may be corrupt. This reset stops the services, renames the folders where Windows keeps downloaded updates and update signatures, and starts the services again. Windows rebuilds both folders automatically. Open Terminal (Admin) and run these lines one at a time:

net stop wuauserv
net stop bits
net stop cryptsvc
ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
ren %systemroot%\System32\catroot2 catroot2.old
net start cryptsvc
net start bits
net start wuauserv

In PowerShell, use Rename-Item or run the lines in Command Prompt if ren complains about the path. If a rename fails with "Access is denied", a service restarted itself; run the stop commands again, then the rename straight away. Restart the PC and check for updates. Your update history may look empty afterward, which is normal; the installed updates are still installed. Once updates work, you can delete the .old folders to free space.

Flush DNS and try a different DNS server

If the PC cannot look up Microsoft's update addresses, you see this error, sometimes with code 0x80072ee7. Run these in Terminal (Admin):

ipconfig /flushdns
netsh winsock reset
netsh int ip reset

Restart the PC. If that does not help, set a public DNS server for your connection: Settings > Network & internet > Wi-Fi or Ethernet > your network's properties > DNS server assignment > Edit, choose Manual, turn on IPv4, and enter a well-known resolver such as 1.1.1.1 or 8.8.8.8, with a second address such as 1.0.0.1 or 8.8.4.4. Check for updates. If it works, your internet provider's or router's DNS was the problem; you can keep the public DNS or return to Automatic later.

Blocked by the hosts file, Pi-hole or a DNS filter

"Privacy" and "debloat" tools sometimes add Microsoft addresses to the Windows hosts file, and home network blockers such as Pi-hole, AdGuard Home or router-level filters may block them through blocklists. Windows Update needs to reach addresses including:

• *.update.microsoft.com and *.windowsupdate.com
• *.delivery.mp.microsoft.com (downloads)
• ctldl.windowsupdate.com (certificate lists)
• *.dl.delivery.mp.microsoft.com and tsfe.trafficshaping.dsp.mp.microsoft.com

Hosts file: open Notepad as administrator, open C:\Windows\System32\drivers\etc\hosts, and delete any line containing microsoft.com or windowsupdate.com. Save and restart. Network blockers: check the blocker's query log while clicking Check for updates, and allowlist the blocked Microsoft update addresses. Telemetry blocklists sometimes include update addresses by mistake.

Third-party firewalls and antivirus

Security suites with their own firewall can block the update service after an update of their own, or when a rule gets corrupted. Temporarily pause the suite's firewall (not just the antivirus) and check for updates. If updates then work, update the security suite, reset its firewall rules, or add an allow rule for svchost.exe running the Windows Update service. If pausing is not possible, uninstall it with the vendor's removal tool, check for updates with Microsoft Defender active, and reinstall a current version afterward.

Windows Defender Firewall itself rarely causes this, but if you or a tool changed its rules heavily, restoring defaults is safe. Our guide to resetting Windows Firewall walks through it.

Error codes you may see with this message

Sometimes Windows shows a code below the message or in update history. Each points to a cause:

Codes that are not about connecting, such as 0x800f0922 or 0x80073712, have their own fixes; see our guides to 0x800f0922 and 0x80073712.

Secure connection checks: TLS inspection and old certificates

Some security products and office firewalls inspect encrypted traffic by replacing websites' certificates with their own. Browsers accept this because the product installs its certificate in Windows, but Windows Update checks Microsoft's certificates strictly and may refuse the substituted one, producing 0x80072f8f. If you use web filtering with "HTTPS scanning" or "SSL inspection", exclude Microsoft's update addresses from inspection. On PCs that have not updated for a very long time, the certificate lists themselves can be out of date; resetting the update components and connecting directly, without filtering, usually lets Windows refresh them through ctldl.windowsupdate.com.

Repair system files with DISM and SFC

If several Windows features misbehave, not just updates, repair the system image. In Terminal (Admin):

1. Run DISM /Online /Cleanup-Image /RestoreHealth and wait; it can take 10 to 30 minutes and may pause at 20 or 62 percent.
2. Run sfc /scannow.
3. Restart and check for updates.

DISM normally downloads repair files through Windows Update, so if the update connection is the problem it may also fail. In that case, mount a current Windows ISO and point DISM at it with /Source: and /LimitAccess, or go straight to the in-place repair below.

Find the real cause in the logs

When the obvious fixes fail, the logs usually name the cause. Open Event Viewer, go to Applications and Services Logs > Microsoft > Windows > WindowsUpdateClient > Operational, and look for recent errors with codes. For a full log, run Get-WindowsUpdateLog in PowerShell; it writes WindowsUpdate.log to your desktop. Search it for "FATAL", "proxy", "WUServer" or the error code. A line showing an internal server address such as wsus01 confirms a leftover policy, and a line mentioning a proxy confirms the WinHTTP setting.

Look at the time stamps too. If the errors begin on a specific date, think about what changed that day: a new router, a VPN install, a security suite update, or a tweak tool. That date is often the single most useful clue, because it points to the change you need to undo. Settings > Windows Update > Update history also lists the last successful update, which gives you the window in which the problem began.

Is it Microsoft's side? How to tell

Occasionally the update service really is having a problem. Signs that the fault is not on your PC: the error started suddenly on several PCs in different homes at the same time, it appeared on Patch Tuesday (the second Tuesday of the month) when demand peaks, and other Microsoft services such as the Store are also slow. Check the Windows release health page on Microsoft's site and the Microsoft 365 or Xbox status pages, which report wider outages. If others report the same thing, wait a few hours and check again; nothing on your PC needs fixing. If only your PC is affected, and it has been more than a day, the problem is local, and the steps on this page apply.

A related case is a brand-new feature update being rolled out in stages. Windows may show "We couldn't connect" briefly while it negotiates which update your PC is eligible for. That clears by itself within a day or two and is not worth resetting anything over.

Network adapter drivers, IPv6 and power saving

An outdated or buggy network driver can drop connections in a way browsers recover from quietly but Windows Update does not. Signs include Wi-Fi that disconnects briefly, slow first page loads, and errors 0x80072efe or 0x80072ee2.

• Update the driver from the PC or adapter maker's website, especially for Wi-Fi cards. Device Manager's "Search automatically" rarely finds the newest version.
• Turn off adapter power saving for testing: Device Manager > Network adapters > your adapter > Properties > Power Management, clear Allow the computer to turn off this device to save power.
• Test without IPv6: some routers and providers have broken IPv6 that browsers fall back from quickly. In ncpa.cpl, open your adapter's Properties, clear Internet Protocol Version 6 (TCP/IPv6), check for updates, and turn it back on afterward whether it helped or not. If it did help, the router's IPv6 settings or firmware need attention.
• Try a cable: an Ethernet connection rules out Wi-Fi problems in one step. Our guide to connecting to Wi-Fi covers wireless troubleshooting more fully.

Delivery Optimization: the download service behind updates

Windows Update downloads through a service called Delivery Optimization (DoSvc), which can also share update pieces between PCs. Some "speed up" and "stop data use" tools disable it, and when it is disabled, update downloads fail or never start, sometimes with this error. Open services.msc, find Delivery Optimization, and make sure its Startup type is Automatic (Delayed Start) or Manual, not Disabled. If you want to stop PCs sharing with the internet, do that the supported way: Settings > Windows Update > Advanced options > Delivery Optimization, and turn off Allow downloads from other devices, or set it to devices on your local network only. Updates still download directly from Microsoft.

Rule out other software with a clean boot

If you suspect some installed program but cannot tell which, a clean boot starts Windows with only Microsoft's services.

1. Press Windows + R, type msconfig, and press Enter.
2. On the Services tab, check Hide all Microsoft services, then click Disable all.
3. Open Task Manager's Startup apps page and disable every startup item.
4. Restart and check for updates.
5. If updates work, re-enable services in small groups and restart each time until the error returns; the last group contains the culprit.
6. When finished, return to msconfig and choose Normal startup.

A clean boot leaves Microsoft Defender running, so your PC stays protected during the test.

Test with a new user account

Most update settings are machine-wide, but some proxy settings and helper apps live in your user profile. A quick test: open Settings > Accounts > Other users, add a local account with administrator rights, sign in to it, and check for updates. If updates work there, something in your own profile is interfering, most often a per-user proxy, a startup app or a VPN client that starts automatically. Remove or reconfigure it in your profile, then delete the test account. If the error appears in the new account too, the cause is machine-wide, and the policy, services and cache steps are the right ones.

Check update status from PowerShell

A few commands give a clear picture without clicking through Settings. In Terminal (Admin):

• Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 lists the most recently installed updates and their dates.
• Get-Service wuauserv, bits, cryptsvc, dosvc, usosvc shows whether each update-related service is running and how it starts.
• netsh winhttp show proxy shows the hidden proxy.
• Test-NetConnection fe2.update.microsoft.com -Port 443 checks that the PC can reach an update server on the secure port; TcpTestSucceeded : True means the network path is open.

If the connection test fails while websites load in the browser, a firewall, filter or proxy between the PC and Microsoft is blocking the update service specifically, which narrows the search to the sections above on proxies and blocked addresses.

Undo a recent change with System Restore

If the error started right after you installed a program, ran a tweak tool or changed network settings, a restore point from before that change can undo it in one step. Press Windows + R, type rstrui, choose a restore point dated before the problem began, and follow the prompts. System Restore changes system settings, drivers and installed programs, not your documents or photos. If no restore points exist, System Protection was off; turn it on under System Properties > System Protection for next time, so a future mistake can be undone just as easily.

What not to do

• Do not download "Windows Update fixer" tools from search ads. Many bundle adware, and the genuine fixes are all on this page.
• Do not disable Windows Update to stop the error message. It hides the symptom and leaves the PC without security fixes.
• Do not delete random registry keys. Only remove the WindowsUpdate policy key described above, and only after backing it up.
• Do not reset the whole PC first. A reset removes your apps and takes hours; the connection is almost always fixable in minutes.
• Do not turn off Microsoft Defender or SmartScreen to "unblock" updates; they are not the cause of this error.

Which fix for which situation

Install updates manually while you fix it

If you need a particular update urgently, such as a security fix, you can install it without Windows Update. Find its KB number, search for it in the Microsoft Update Catalog at catalog.update.microsoft.com, download the package that matches your version and architecture, and double-click it. Check your version first with winver. Our guide to Update Catalog problems helps if the catalog will not load. Manual installs are a stopgap; fix the connection so future updates arrive on their own.

Pick the right file. Cumulative updates are listed separately for Windows 11 versions such as 24H2 and 25H2, and for x64 and Arm64 PCs. Installing the wrong one fails with "The update is not applicable to your computer", which is harmless but wastes time. Monthly cumulative updates include all earlier fixes, so you only need the newest one, plus any servicing stack or setup update the catalog lists alongside it.

Last resort: in-place repair keeping files and apps

If nothing above works, an in-place repair reinstalls Windows over itself, keeping your files, apps and most settings, and replaces every update component.

1. On Windows 11, open Settings > System > Recovery and use Fix problems using Windows Update > Reinstall now where available. Because this needs Windows Update, it may fail with the same error.
2. Otherwise, download the Windows 11 Installation Assistant or ISO from Microsoft's download page on another PC if necessary.
3. Run setup.exe from the mounted ISO, choose Keep personal files and apps, and follow the prompts.

Back up important files first, as with any major repair. The process takes about an hour and leaves you with a fully updated, repaired installation.

Windows 10 after end of support

Windows 10 reached end of support in October 2025. PCs enrolled in Extended Security Updates (ESU) still receive monthly security updates, and every fix on this page applies to them. PCs not enrolled may still check for updates and see definitions for Microsoft Defender, but no new security updates. If a Windows 10 PC shows this error, fix it the same way; then check Settings > Update & Security for the ESU enrollment option or plan the move to Windows 11.

Windows 10 PCs that have been offline or unpatched for a long time are the ones most likely to hit certificate errors such as 0x80072f8f, because their trusted certificate lists are old. Fix the date and time, connect without filtering or VPN, and give Windows Update a few attempts; it usually refreshes the lists and then proceeds normally.

"Couldn't connect" vs updates paused or metered

Some messages look similar but mean something else. Updates are paused means someone paused them; click Resume updates. Updates are available, but we won't download them on a metered connection means the network is marked metered; turn off Metered connection in the network's properties, or turn on Download updates over metered connections in Windows Update > Advanced options. Neither is a connection failure, and the fixes above will not change them.

Two more lookalikes: "Your device is missing important security and quality fixes" means updates have not installed for a long time, often because of this very error, and goes away once updates succeed. "This PC doesn't currently meet the minimum system requirements to run Windows 11" is about upgrade eligibility, not connection; it does not stop monthly updates on Windows 10 ESU or on supported Windows 11 versions.

Small offices and shared networks

If several PCs on the same network show the error at the same time, the network is the cause, not each PC. Check the router or firewall for web filtering, DNS filtering or a recently changed security setting, and check whether the internet provider is having problems. On networks with a proxy, make sure the proxy allows Microsoft's update addresses without authentication, because the update service cannot type a password. Delivery Optimization can reduce bandwidth by letting PCs share update downloads with each other on the local network; it is in Windows Update > Advanced options > Delivery Optimization.

Keep the error from coming back

• Keep the PC's time set automatically.
• Avoid "privacy", "debloat" and "stop updates" tools that edit hosts files, services or policies.
• When you buy a used business PC, check Access work or school and the WindowsUpdate policy key on day one.
• Keep VPN and security software current, and use split tunneling for Windows Update if your VPN offers it.
• Do not leave updates paused for months; the longer the gap, the more likely certificate and cache problems become.
• Restart at least weekly so pending updates and service restarts complete.

A monthly glance at Settings > Windows Update on the second Wednesday of each month, the day after Patch Tuesday, is enough to catch problems early. If it says "You're up to date" with a recent date, all is well; if it shows an error, you will catch it while the cause is still fresh in mind.

Microsoft Store and winget errors with the same cause

The Microsoft Store and the winget package manager use many of the same network paths as Windows Update. If the Store shows "Try that again, something went wrong" or downloads stall at the same time as this error, fix Windows Update first; the Store usually recovers on its own. If the Store alone still fails afterward, run wsreset.exe from the Run box to clear its cache, and check for app updates from the Store's Library page. For winget, winget source reset --force in Terminal (Admin) refreshes its sources. Both rely on the correct date and time and an unblocked connection to Microsoft, which the steps above already confirmed.

For IT admins: update connectivity at scale

Endpoints. Allow the Windows Update endpoints through proxies and firewalls without authentication or TLS inspection, including the delivery, certificate trust list and service endpoints. Review them whenever you deploy new filtering.

Retired WSUS. When decommissioning WSUS or moving to Windows Update for Business or Autopatch, remove the WUServer, WUStatusServer and UseWUServer policies in the same change, or devices lose updates entirely. Devices sold or redeployed outside the domain should be wiped or have policies cleared before they leave.

Diagnostics. Get-WindowsUpdateLog, the WindowsUpdateClient Operational log and Intune's update reports identify failing devices. A WinHTTP proxy set by an old script is a frequent cause; netsh winhttp show proxy belongs in any device health check.

"We couldn't connect to the update service": frequently asked questions

Ethan's refurbished laptop has updated itself every month since Jake deleted that one registry key. The lesson he passed on to a friend who bought a similar machine was simple: when the internet works but Windows Update cannot connect, the problem is almost always something telling Windows Update to go somewhere else, a proxy, a policy or a blocked address, rather than a broken PC. Check the clock, the hidden proxy and the policy key first, and save the big resets for the rare cases where those are clean.

Revision note. Written October 2, 2026, rewriting our 2019 fix for Windows 11 with proxy, policy and DNS causes. May your updates always arrive on time.