Windows Update Error 0x80070643: What It Means and How to Fix It (2026 Updated Guide)

Quick answer

Most current 0x80070643 failures in 2026 are caused by a stalled .NET Framework security update — the fix is to install the specific KB manually from the Microsoft Update Catalog. A second, older variant of this error relates to the Windows Recovery Environment (WinRE) and a 2024 security patch (KB5034441) that needs at least 250 MB free in the recovery partition. Before doing anything else, work out which one you have. The two look identical and need different fixes.

Before you start

  • Back up anything you can’t afford to lose. None of the steps below are destructive on a healthy system, but advanced repair is involved if the basic fixes don’t work.
  • You will need administrator rights for almost every step.
  • Do not download a third-party “Windows update repair tool” — they don’t fix this error, and several of the most-promoted ones are flagged by Microsoft Defender. Everything you need is already in Windows.
  • If the affected device is a work or school laptop managed by your employer, jump to the If you are on a work or school device section before changing anything.

What this error means

0x80070643 is the Windows error code ERROR_INSTALL_FAILURE. It is intentionally generic. The Windows Update component throws it whenever an installation has been attempted, has failed, and Windows cannot give you a more specific reason. Treating it as a single problem is the most common mistake in the troubleshooting articles you’ll find on the first page of search results.

In 2026, this error has clustered into two distinct populations:

  1. The .NET Framework variant. Cumulative .NET Framework security updates released through Patch Tuesday — including the March 2026 batch (KB5081276, KB5081277, KB5081278) and several similar updates throughout 2025 — are the largest single source of 0x80070643 failures right now. These updates fail because of corrupted .NET state on the machine, not because of anything Microsoft has broken in the update.

  2. The legacy WinRE variant. A January 2024 security update (KB5034441 on Windows 10 22H2, KB5034440 on Windows 11) needed at least 250 MB free in the Windows Recovery partition. Most home PCs shipped with around 500 MB and had less than 100 MB free, so the update failed. Microsoft confirmed in July 2025 that the corrected version (KB5063523) installs successfully, but the original failed entry can still appear in Update History indefinitely. An old 0x80070643 from 2024 that you keep seeing is not actually a current problem. It is a cosmetic ghost.

If you are seeing this error today on a Windows 11 or Windows 10 PC, work through the disambiguation step first.

Where this error appears

You will encounter 0x80070643 in three places:

  • Settings → Windows Update, with the message “There were some problems installing updates, but we’ll try again later. (0x80070643)”. This is by far the most common location.
  • Update History as a record of a previous failed install — sometimes years old.
  • The Microsoft Update Standalone Installer (.msu files run manually) when you’ve downloaded an update yourself and tried to install it.

The error very rarely affects feature updates (the major version-to-version upgrades like 23H2 → 24H2). Those tend to fail with different codes such as 0x800F0922 or 0xC1900101. If you are stuck on a feature update, this is not your guide.

Common causes

The cause depends on which variant you have. Disambiguate first by opening Settings → Windows Update → Update history and looking at the failed update name and date.

Failed updateLikely variantLikely cause
Anything containing ”.NET Framework” or KB numbers in the KB508xxxx range.NET FrameworkCorrupted .NET runtime, third-party security software interference, broken servicing stack
KB5034441 / KB5034440 (Jan 2024)Legacy WinRERecovery partition smaller than 250 MB, or partition missing entirely
Recent cumulative update (LCU)CumulativeServicing stack corruption, low disk space, antivirus interference
”Windows Defender Definition Update”DefenderDefender’s own update channel briefly drifted out of sync — usually self-resolves

If you can’t find the failed update in history, focus on the .NET Framework variant first. It’s the most common and the fixes are non-destructive.

Fixes to try first

These are the low-risk steps. Work through them in order. Do not skip ahead.

  1. Restart the PC. This sounds insulting, but 0x80070643 from a transient .NET update glitch resolves on reboot in a non-trivial proportion of cases. Restart, then go to Settings → Windows Update → Check for updates.

  2. Run the built-in Windows Update troubleshooter. Go to Settings → System → Troubleshoot → Other troubleshooters, then run Windows Update. Microsoft has actually invested in this tool over the past two years; it now resets the most commonly-broken services automatically. Allow it to apply fixes, then retry the update.

  3. Check Windows Update services. Press Win+R, type services.msc, and press Enter. Find and confirm the following services are running:

    • Windows Update
    • Background Intelligent Transfer Service (BITS)
    • Cryptographic Services

    If any are stopped, right-click and select Start. If any are listed as Disabled, set them to Manual, then start them.

  4. Free up disk space. Windows Update needs roughly 8 GB of free space on the system drive to stage a cumulative update without errors. If you are below that, run Settings → System → Storage → Cleanup recommendations, clear temporary files, then retry.

  5. Pause and resume Windows Update. This forces the update orchestrator to re-evaluate the queue. Go to Settings → Windows Update, click Pause for 1 week, wait two minutes, then click Resume updates.

If steps 1–5 don’t move it, you have a stickier problem. Continue below.

Advanced fixes

These are reversible — but understand each one before running it.

Manually install the failed update from the Update Catalog

This is the single most reliable fix for the .NET Framework variant. It bypasses the broken Windows Update orchestrator entirely.

  1. In Settings → Windows Update → Update history, find the failed update. Note the KB number (for example, KB5081276).
  2. Open the Microsoft Update Catalog in your browser.
  3. Search for the KB number.
  4. Match the result to your Windows version and architecture (x64 for almost all modern PCs).
  5. Download the .msu file. Double-click to install. Restart when prompted.

If the manual .msu install also fails with 0x80070643, the underlying problem is in the servicing stack, and you need the next step.

Repair the .NET Framework

Microsoft maintains a repair tool specifically for this. Download the .NET Framework Repair Tool from Microsoft’s official site only. Run it, accept the defaults, restart, and retry Windows Update.

Run DISM and SFC

Many of the cases that survive the manual install fix are servicing-stack corruption. Open Command Prompt as administrator and run, in order:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

RestoreHealth can take 15–45 minutes. Don’t cancel it. When all four commands complete, restart and retry the update.

For a deeper walkthrough of these commands, including what to do when DISM itself errors out, see our DISM and SFC guide.

Reset Windows Update components

If the update still fails after DISM and SFC, the next step is a full reset of Windows Update services and folders. This is the canonical recovery procedure for stuck update infrastructure. Walk through it carefully — see How to reset Windows Update components for the step-by-step.

Fix the legacy WinRE variant (KB5034441 / KB5034440)

If your 0x80070643 traces specifically to KB5034441 or KB5034440 from January 2024:

  1. Check whether the update is still being offered. If it is not, you can ignore the error in Update History — it is the ghost referenced earlier.
  2. If it is still being offered, your recovery partition needs more space. The simplest path is to use a tool like the free version of MiniTool Partition Wizard or AOMEI Partition Assistant to extend the recovery partition by 250 MB. (Both of these are well-known, mainstream tools — that is not a recommendation to use either over the other; it’s just a factual note that this is the category of utility the situation calls for.)
  3. Microsoft’s manual instructions using reagentc /disable, diskpart, and reagentc /enable work but have repeatedly broken installations for users who don’t follow them precisely. If you are not comfortable with diskpart, use a partition tool with a graphical interface instead.

If you are on a work or school device

Stop. Do not run DISM, do not reset Windows Update components, and do not edit the recovery partition on a managed device. The right action is to:

  1. Confirm the device is genuinely managed (Settings → Accounts → Access work or school).
  2. Tell your IT administrator the exact KB number that failed and the exact error code.
  3. Wait. Most enterprise devices are configured with WSUS, Intune, or similar — the update may not be expected to install yet, and what looks like a failure may be deliberate.

If you are the de facto IT person for a small business and there’s no separate admin to escalate to, your starting point is different from this article — see our admin checklist for new M365 sign-in failures for the equivalent admin-side approach to update failures across multiple devices.

When to stop

Stop running fixes and accept the error if any of the following are true:

  • The error is for KB5034441 or KB5034440, the update is no longer being offered, and you have a Recovery partition. This is the ghost. Microsoft has confirmed in its own release notes that the incorrect error message can persist in Update History after the underlying issue is fixed. It is harmless.
  • The PC is showing repeated BSODs, missing files outside Windows Update, or signs of failing storage hardware. The update error is a symptom, not the disease. Diagnose the underlying problem first.
  • You have already run the manual KB install, .NET Repair Tool, DISM, SFC, and a full Windows Update components reset. Beyond that point, an in-place repair install of Windows is the next step — and that is a 60–90 minute commitment that should be done deliberately, not on a Tuesday afternoon between meetings.
  • You are on a work device. Stop earlier. See above.
  • Windows Update error 0x80070002 — when the update files are missing rather than the install failing.
  • Windows Update error 0x800f081f — when source files for an optional component can’t be found.
  • Windows Update stuck at 0%, 33% or 100% — the symptom-led companion to this article.
  • How to reset Windows Update components — the canonical reset procedure.
  • 0x80070005 access denied — a related but distinct permissions error in the Windows Update path.
  • How to run DISM and SFC safely — for the system file repair commands referenced above.

Official references

FAQ

Is 0x80070643 a virus or sign of malware? No. It’s a generic Windows installation failure code. Antivirus software can occasionally cause this error by quarantining update files mid-install, which is the opposite of malware activity. If your machine has other genuine signs of malware, address those separately — 0x80070643 on its own is not evidence.

Can I just hide the failed update? You can — Microsoft provides the wushowhide.diagcab utility specifically for this — but you should not hide a security update unless you’ve genuinely confirmed it doesn’t apply to your system. Hiding the legacy KB5034441 ghost is fine. Hiding a current cumulative security update is not.

Why does the same update keep retrying and failing? Because Windows Update is configured to retry failed updates indefinitely until they install or are explicitly hidden. The retries are not breaking your system; they are designed to be idempotent. They are, however, irritating, and they will continue until you install the update successfully or hide it.

Will an in-place repair install fix this? Yes, in almost every case. An in-place repair install (using a current Windows ISO and choosing Keep personal files and apps) replaces the entire Windows component store while preserving your data and applications. It’s the nuclear option for Windows Update problems and it works. Block out 90 minutes and ensure you have a recent backup before starting.

Should I roll back the most recent cumulative update? Only if rolling back fixes a different, real problem you’re experiencing — not as a fix for 0x80070643 itself. Rolling back removes the security improvements in that update; you’d then have to apply them again later, often via the same update that just failed. The right path is to install the update successfully, not avoid it.

Does this error mean I need a new PC? No. 0x80070643 is a software-state problem, not a hardware problem. The fixes above resolve it on PCs of every age and configuration. If a vendor or repair shop has told you this error means you need a hardware replacement, get a second opinion.

↑ Back to top