How to Download & Install KB Updates from Microsoft Catalog

To manually install a specific Windows update, download the matching MSU file for your exact build from the Microsoft Update Catalog at catalog.update.microsoft.com, then double-click it and restart when prompted. That's the direct answer. The part almost nobody tells you: Windows Update showing "You're up to date" does not mean every fix Microsoft has shipped is on your PC — staggered rollouts and compatibility holds routinely leave individual KBs sitting unoffered to specific machines for weeks or months, which is exactly why "just download this KB number and install it yourself" keeps showing up as advice on tech blogs, forums, and support threads.

Why you'd ever need to install one update by hand

Jake runs a small phone and laptop repair shop, and a few years back a customer dropped off a work laptop that could not stay connected to the office VPN. Every fifteen minutes the connection would drop or the internet would go "limited." Jake found a forum post naming an exact update that was supposed to fix it, and the customer wanted to know why his laptop hadn't gotten it automatically. Jake didn't have an answer, so he asked Ethan.

"Windows Update doesn't send everything to everyone at once," Ethan told him. "Microsoft rolls updates out in waves, holds some back for machines with known driver conflicts, and sometimes a fix for a specific bug just isn't in your queue yet, even though it exists and is public. If you know the KB number, you can go get it yourself instead of waiting."

That's the whole reason this skill matters. Tech sites, IT forums, and Microsoft's own support pages regularly point people at a specific KB number as the fix for a specific problem — a VPN bug, a printing bug, a Wi-Fi driver conflict, a Bluetooth issue. Knowing how to actually get that update onto your PC, safely, without waiting for Windows Update to decide you're ready for it, is a genuinely useful skill that has nothing to do with any one bug.

Find out exactly which KB you need before you download anything

Before you download anything, you need two pieces of information: the KB number itself, and your exact Windows build number. Both matter, and skipping either one is the single most common reason a manual install fails.

Getting the KB number

You'll usually be handed a KB number by whatever led you here — a forum thread, a Microsoft support article, a tech blog naming the fix for your exact symptom. It looks like "KB" followed by seven digits, for example KB5101650. Write it down exactly; there's no fuzzy matching on the catalog search.

Getting your build number

Press Win + R to open the Run box — a small dialog that lets you launch a program or system tool by typing its name instead of hunting through menus — and type winver, then press Enter. A window pops up showing your Windows version (like "Version 25H2") and your exact build number (like 26200.8875). You need both, because two PCs can be on the same version but different builds, and a KB built for one build will not apply cleanly to the other.

Should you even chase this one down, or just wait?

Not every KB is worth manually installing the moment you hear about it. If the bug is cosmetic, or something you can work around for a week, it's often faster to let the next scheduled Patch Tuesday bring it to you automatically than to troubleshoot a manual install that goes sideways. Chase it yourself when the problem is actively costing you time or money right now, when it's a security fix, or when a support thread has told you Windows Update has been sitting on it for an unusually long time.

If you're not sure how urgent it is, check Settings > Windows Update > Update history first. Sometimes the fix you're chasing has already quietly arrived inside a newer cumulative update you already installed, under a different KB number entirely, and you don't need to do anything at all.

Method 1 — Microsoft Update Catalog (the one most people need)

This is the method behind the Quick Answer box, and it covers the situation almost everyone lands on this page for: you have a KB number, you have one PC, and you want the update on it now instead of waiting for Windows Update to offer it.

On Windows 11

Open a browser and go to catalog.update.microsoft.com. Type the KB number into the search box and press Enter. You'll get a results table listing every version of that update — for different Windows versions, different architectures (x64, ARM64), and sometimes different languages of the same fix. Find the row that matches your build and architecture, and click Download. A small popup window opens with a direct link; click that link, and the file — an MSU, or occasionally a smaller update packaged as an EXE — saves to your Downloads folder.

Open File Explorer, go to Downloads, and double-click the file. The Windows Update Standalone Installer opens and asks you to confirm. Click Yes, let it apply, and restart when prompted. That's the entire process.

On Windows 10

These steps are the same on Windows 10 as Windows 11 — catalog.update.microsoft.com, search, download, double-click, restart. The one difference worth knowing: if your Windows 10 device is past end of support and not enrolled in Extended Security Updates, the catalog will still let you search for and download older KBs, but Microsoft is no longer issuing new security KBs for un-enrolled 22H2 machines going forward. A manually installed KB from before your support window ended will apply fine; a brand-new one released after your support lapsed may not exist to find in the first place.

Method 2 — Command line with wusa or DISM (for scripting, or when double-clicking won't work)

Some environments block double-clicking downloaded executables outright, and some updates come as a CAB file instead of an MSU, which won't open by double-clicking at all. For both cases, the command line is the way in.

For an MSU file, open Command Prompt as administrator and run wusa.exe "C:\path\to\file.msu" /quiet /norestart — the quiet flag suppresses the confirmation popup, and norestart stops it from rebooting your PC out from under you mid-task, which matters if you're doing this on a shop machine while a customer is waiting.

For a CAB file, or for applying an update to an offline Windows image (a copy of Windows that isn't currently running, such as one being prepared for deployment), use DISM instead: DISM /Online /Add-Package /PackagePath:"C:\path\to\file.cab". Swap /Online for /Image:C:\path\to\mounted\image if you're servicing an offline image rather than the running system.

Method 3 — Installing without an internet connection

Jake's shop occasionally gets laptops in that have no working network adapter at all — that's often the actual reason they're in the shop. You can still get an update onto a machine like this: download the correct MSU or CAB on a working PC, copy it to a USB drive, plug the drive into the offline machine, and run it locally with wusa.exe or DISM exactly as described above. There is nothing update-specific about being offline; it only matters for the download step, not the install step.

Method 4 — Windows Update Assistant (a different tool, for a different job)

It's worth being clear about what this tool is not for. The Windows Update Assistant, downloaded from Microsoft's own site, pushes your PC to the latest feature version — for example moving a 24H2 machine to 25H2. It does not let you target a single KB number. If someone told you to "get KB5101650," the Update Assistant is the wrong tool; that's a catalog job. Save the Assistant for when you're behind on the version itself, not chasing a single fix.

Method 5 — Group Policy and WSUS (managed and business PCs)

On a Windows 11 Pro, Enterprise, or Education PC, gpedit.msc — the Local Group Policy Editor, a control panel for enterprise-style settings that ships with Pro and above but not Home — lets an administrator defer, pause, or target specific updates for a whole fleet of machines through Windows Server Update Services (WSUS). This is IT-department territory, not something Jake needs for one customer laptop, so we won't walk through the full WSUS setup here. If you're on Windows 11 Home, gpedit.msc doesn't exist on your PC at all — the equivalent settings live in the registry instead, which is a deeper topic than a single KB install warrants.

Method 6 — Third-party "update fixer" tools (and why we don't recommend them)

"There are tools that promise to scan your PC and install whatever's missing automatically," Jake said once, half-hopeful. "Why not just use one of those?"

"Because you'd be trusting a third party to decide what gets installed on your computer, and Microsoft already gives you a free, official way to do exactly this," Ethan said. "It's the worst trade in this whole list — you're handing over control for something that takes five extra minutes to do properly."

Which method should you actually use?

Confirming the update actually installed

Once you've restarted, go to Settings > Windows Update > Update history. Your KB should be listed near the top with today's date next to it. If you'd rather check from the command line, PowerShell's Get-HotFix cmdlet lists installed updates by KB number, which is faster if you're checking several machines in Jake's shop back-to-back.

If the KB you installed doesn't show up in history at all, it likely didn't apply — go back and recheck that the file you downloaded actually matched your build number from winver, not just your Windows version.

When it doesn't go smoothly

"This update does not apply to your computer"

This is the installer telling you the file doesn't match your edition, build, or architecture. Recheck winver and the architecture column on the catalog page — 64-bit systems need the x64 file, not x86, and ARM devices need the ARM64 file.

Not enough disk space

Windows needs working room beyond the update file itself to stage and apply the changes, and on an older laptop with a nearly full drive, the installer will simply report that it can't proceed. Freeing a few gigabytes with Disk Cleanup or Storage Sense before trying again solves this more often than anything more technical does.

The installer hangs or the progress bar never moves

Give it real time — some cumulative updates genuinely take twenty or thirty minutes on older hardware, especially at the "Working on updates" restart screen. If it's been over an hour with the disk activity light dark, that's a stall worth force-restarting for, not before.

The PC seems to skip the restart entirely

On laptops with Fast Startup or Modern Standby enabled, a normal shutdown hibernates the session rather than fully restarting it, so the update can appear to have been skipped when it wasn't given the chance to finish. If you're not sure it applied, use Restart from the Start menu specifically, not Shut down, and check Update history afterward.

An error code you don't recognize

We can't tell you what every possible code on your screen means — there are hundreds, and new ones show up with every update. What we can tell you: write the exact code down, search it together with "Windows update," and if the Update Troubleshooter (Settings > System > Troubleshoot > Other troubleshooters) doesn't clear it, a clean re-download of the file is worth trying before anything more drastic — corrupted downloads produce cryptic errors more often than genuine conflicts do.

Undoing it, if you need to

Go to Settings > Windows Update > Update history > Uninstall updates, find the KB in the list, and click Uninstall. From the command line, wusa /uninstall /kb:5101650 /quiet /norestart does the same thing without the UI. Note that Microsoft limits how long this option stays available — commonly around ten days after install — so if you're going to roll back a bad update, don't sit on the decision for weeks.

If you're still on Windows 10

Windows 10 22H2's free security updates ended on October 14, 2025, and that's genuinely worth knowing before you spend time chasing an individual KB: if the fix you need was released after your support window closed and you're not enrolled in Extended Security Updates, it may not exist for your PC to find in the catalog at all.

If you want to keep receiving new security fixes, ESU enrollment is still open as of this writing. Go to Settings > Windows Update and look for "Enroll now" — it requires being fully on 22H2 and signed in with a Microsoft account, not a local account. Enrollment is free if you turn on Windows Backup to sync your settings, costs 1,000 Microsoft Rewards points, or is a one-time roughly $30 purchase otherwise. Coverage was originally set to expire in October 2026, but Microsoft extended consumer ESU by an additional year in June 2026, so enrolled devices are now covered into October 2027.

Edge cases worth knowing about

Virtual machines take a KB exactly the same way a physical PC does — download inside the VM, install, restart. The only wrinkle is snapshotting the VM before you install, which gives you an instant, clean rollback that's faster than uninstalling the update by hand.

Laptops with a broken or removed keyboard — a common shop repair job — can still be updated with an on-screen keyboard or a USB keyboard plugged in temporarily; nothing about the update process needs the laptop's own keyboard specifically.

Remote Desktop sessions work fine for this too, with one catch: if the KB requires a restart, your remote session will drop when the machine reboots. Don't run this on a machine you can't get back into afterward unless you're confident it'll come back up cleanly, or have a way to check on it physically.

Multi-monitor setups occasionally lose their arrangement after a cumulative update restart — monitors swap positions or one gets set as primary again. It's cosmetic, not a sign the update failed, and a quick trip to Settings > System > Display fixes it.

Dual-boot machines, where two Windows installs share one disk, need the KB installed separately inside each installation you actually boot into and use — installing it in one copy does nothing for the other, even on the same drive.

Domain-joined business PCs sometimes block a manually downloaded MSU from running at all, even for a local administrator, because Group Policy restricts installs to IT-approved channels. If a double-click silently does nothing, that's usually the sign — ask IT to push it through WSUS instead of forcing it locally.

Doing this across more than one PC

Jake's shop runs about fifteen PCs across the counter and the workshop, and downloading the same KB fifteen times separately is a waste of an afternoon. Download the file once, drop it on a shared network folder, and run the same wusa.exe "\\shop-nas\updates\file.msu" /quiet /norestart command on each machine — or wrap it in a short PowerShell loop that reads a list of computer names and pushes the install to each one over the network with Invoke-Command.

Checking which machines already have a KB, without walking around to each one, works the same way: run Get-HotFix in a remote PowerShell session against your list of computer names and pipe the results to Export-Csv. That gives you one spreadsheet showing exactly who has it and who doesn't, in a couple of minutes instead of an afternoon. For a recurring check, a Task Scheduler job that runs a short script every Monday morning and emails you if a named KB is still missing is worth setting up once you've done this by hand more than a couple of times. For a fleet larger than Jake's, WSUS (Method 5 above) is worth the setup time instead.

Before you download anything, check this

The address bar should read catalog.update.microsoft.com, exactly, with a padlock. Any page that looks similar but has an extra word, a different domain ending, or asks you to install a "download manager" before you can get the file is not Microsoft, no matter how convincing the logo looks. This matters more than it sounds like it should — a fake "Windows Update Fixer" is one of the more effective disguises for malware, precisely because the target audience is already primed to trust anything claiming to be a Windows update.

After downloading, right-click the file, choose Properties, and open the Digital Signatures tab. It should show Microsoft Windows or Microsoft Corporation as the signer, with a valid signature. The catalog page also lists the expected file size next to the download link; a file drastically smaller than that usually means the download failed partway through rather than being tampered with — either way, re-download instead of running it.

Frequently asked questions

Do I need to restart after installing a KB manually?

Most cumulative updates need a restart to finish applying. If Windows doesn't prompt you, restart anyway — don't assume it's fully installed just because no popup appeared.

Why does Windows Update say I'm up to date when I'm missing a KB?

Rollouts are staggered by hardware, region, and known compatibility issues. "Up to date" means nothing is currently being offered to your specific PC — not that every KB Microsoft has ever released is installed on it.

Is it safe to download a KB from a site other than the Microsoft Update Catalog?

No — stick to catalog.update.microsoft.com or Windows Update itself. Third-party mirrors for MSU or CAB files are a common way disguised malware gets distributed, and there's no way to verify what a mirror is actually giving you.

What's the difference between an MSU and a CAB file?

An MSU installs by double-clicking, through the Windows Update Standalone Installer. A CAB is the same kind of update packaged for command-line tools like DISM, typically used for offline images or scripted rollouts.

Can I install a Windows 10 KB on Windows 11, or vice versa?

No. Every KB is built for one specific Windows version and build. The installer checks and will refuse, or occasionally fail silently, if it doesn't match.

How do I know which KB actually fixed my problem?

Check your update history right after the fix takes effect and note the most recent KB number and date. If you installed several updates at once, you may not be able to isolate the exact one without removing them individually.

Why did installing a KB break something else?

Cumulative updates touch shared system components, so a fix in one area can occasionally expose a conflict with an old driver, a legacy application, or third-party security software. It's uncommon, but it's exactly why backing up first is worth the ten minutes.

Can I uninstall a KB after installing it?

Yes — Settings > Windows Update > Update history > Uninstall updates, or wusa /uninstall /kb:XXXXXXX from the command line. The rollback option is usually only available for a limited window, commonly around ten days.

Does Windows 11 Home let me hide or defer a specific update?

There's no Group Policy editor on Home, so you can't defer selectively the way Pro can. You can pause all updates for up to five weeks in Windows Update settings, and Microsoft's Show or Hide Updates troubleshooter can hide one specific problem update without pausing everything else.

Is Windows 10 still getting security updates in 2026?

Only for devices enrolled in Extended Security Updates. Free support for 22H2 ended October 14, 2025, and un-enrolled devices no longer get new security KBs, including future fixes for problems like this one.

What does the catalog show if a KB has been superseded?

Older KBs stay listed and downloadable, but the results page doesn't always flag supersession clearly. If a newer cumulative update exists for your version and build, install that instead of an older standalone KB.

Can I install a KB without an internet connection?

Yes — download the file on a connected PC, move it over by USB drive, and install it locally with wusa.exe or DISM on the offline machine. This is the standard approach for air-gapped or bandwidth-limited setups.

Why does the installer say the update doesn't apply to my computer?

The file you downloaded doesn't match your edition, build, or architecture. Recheck the exact build number from winver against the KB's supported builds on the catalog page.

What are optional updates, and should I turn them on?

Settings > Windows Update > Advanced options has a toggle to get some non-security preview and driver updates slightly ahead of general rollout. It can get you a fix earlier without hunting for a KB number, but it also means less-tested updates — worth leaving off on a machine you can't afford downtime on.

Does installing a KB manually use my data if I'm on a metered connection?

Yes — the download is the same size whether it comes through Windows Update or the catalog, and cumulative updates can run several hundred megabytes to a few gigabytes. Downloading on an unmetered connection and transferring the file by USB is worth it on a limited mobile hotspot.

Will installing an old missed KB now also install everything released after it?

No — a single KB only contains what that update covers plus what it was built on top of at release. It doesn't retroactively pull in newer fixes, so check Windows Update again afterward in case you're still behind on more recent updates.

Revision note. Originally published March 31, 2020, this post named one specific update, KB4554364, for one specific VPN bug on Windows 10. That fix has long since been absorbed into the normal run of cumulative updates, and Windows 10 itself has moved into its final support phase, so we've rewritten this around the actual skill underneath the original post: finding, matching, and safely installing any KB yourself, on Windows 11 or 10. If a support thread or a blog just handed you a KB number and told you to go install it, we hope this got you there without any guesswork.