Windows 11 Locked out of PC when trying to "repair‑install (in‑place upgrade)"

[Mint Condish]

Hello, first time poster here and losing my mind. I know we all have things to do, but I'm on a job-killing deadline and can't get my HP laptop to complete a "repair‑install (in‑place upgrade)". The details:

I couldn't install that pesky security update KB5077181. I read this thread...

Windows 11 Thread '[SOLVED] 2026-02 Security Update (KB5077181) (26200.7840) Failing'

Feb 12, 2026

[SOLVED] KB5077181 Failing at 78–79% — Full Start‑to‑Finish Fix Guide (With ISO Checks + BitLocker Notes)

Posting this to help anyone dealing with the same issue I spent days fighting. My system refused to install KB5077181 (26200.7840) and always failed in the exact same way. Here is everything I did from start to finish, including the final fix and the verification steps recommended by others in this thread.

---------------------------------------
1. Symptoms of the Problem
---------------------------------------
• Update would reach 78%
• Instantly jump to 79%
• Windows Error Reporting...

• 10thdimension
• 26200.7840 component store kb5077181 lcu failure servicing stack update error update failure updatestuck windows 11 windows update
• Replies: 7
• Forum: Windows Help and Support

• 

...and followed the instructions, BUT I'm afraid I did not take step 4, "BitLocker Safety". So after the first (and so far, only) reboot, I got the BitLocker recovery key blue screen. Thankfully, I have the key. I've had to enter it a million times. I then must "choose keyboard layout" - I'm not entirely sure which one is correct for me, but nevermind for now; I can type. Then the "choose an option" screen appears:

- Continue (to Windows Rollback)
- Use a device
- Use another operating system
- Troubleshoot
- Turn off your PC

I have clicked on everything, I think. Nothing allows me to continue the upgrade. I have NO idea if I can do something effective using the command prompt and I cannot trust the hundreds of different YouTube "tips". Look, at this point, going back to where I was before I attempted the upgrade would be perfect, frankly.

I wish I could give you a ton of hardware and software details. All I remember is this: my Windows 11 was Home Single Language 25H2 build 7171. As I said, my laptop is an HP; I can't remember the model, I bought it brand new last year.

It was stupid of me to try a procedure I don't fully understand when I need the work stored in my PC more than ever. I was afraid about possible security vulnerabilities.

I'm begging you, please help me not get fired. A trillion thanks in advance.

 

[ChatGPT]

You’re not alone—what you’re seeing is a very common failure mode when an in‑place upgrade hits a reboot boundary while BitLocker protection is still active. The good news: since you have the recovery key, your files are almost certainly fine, and the fastest path (given your priorities) is to force Windows to roll back to the pre-upgrade state.
Below is the “do-this-first” path, then fallbacks if it loops.

---

What’s happening (in plain English)​

That guide’s Step 4 (“BitLocker Safety”) was there to suspend BitLocker protectors before the upgrade (manage-bde -protectors -disable C:). Without suspending, Windows sees the boot/upgrade environment as a “trusted boot change” and throws you into repeated recovery-key prompts. (That step is shown in the KB5077181 thread you followed.) Windows 11 - [SOLVED] 2026-02 Security Update (KB5077181) (26200.7840) Failing
Also: the keyboard layout choice does not matter for the BitLocker key (it’s digits only). Pick whatever lets you navigate.

---

Priority #1: Roll back (this is what you said you want)​

On the blue recovery flow:

1. Enter the BitLocker recovery key (yes, again).
2. At Choose an option, click:
   Continue (to Windows Rollback)

Then do not interrupt it:

• Plug in the charger.
• Let it reboot as many times as it wants.
• If it asks for the BitLocker key again, enter it again and let it continue.

If rollback succeeds, you should land back in your original Windows install (apps + files intact).

---

If “Continue (to Windows Rollback)” just loops back to the same screen​

Do this instead:

Option A (best fallback): Uninstall the pending update​

1. Troubleshoot
2. Advanced options
3. Uninstall Updates
4. Try Uninstall latest quality update (KBs are “quality updates”)

If that fails, go back and try Uninstall latest feature update (sometimes an in-place upgrade is treated more like feature servicing).

Option B: Startup Repair​

1. Troubleshoot
2. Advanced options
3. Startup Repair

It’s low-risk and sometimes it completes the rollback chain automatically.

Option C: System Restore (if you have restore points)​

1. Troubleshoot
2. Advanced options
3. System Restore

This can return you to a prior snapshot without touching personal files.

---

If you can boot into Windows again (after rollback)​

Do these before attempting any repair-install again:

1. Back up the one thing you cannot lose (your work files) to any external location: OneDrive, Google Drive, USB drive, external SSD—anything.
2. Suspend BitLocker before retrying the in-place upgrade (this is exactly the missing Step 4 from the guide):
   • Open an admin Command Prompt and run:
     manage-bde -protectors -disable C:
   • After everything is stable again:
     manage-bde -protectors -enable C:
     (Those exact commands are in the thread you followed.) Windows 11 - [SOLVED] 2026-02 Security Update (KB5077181) (26200.7840) Failing

---

Two quick questions so I can give you the exact next click-path​

1) When you click Continue (to Windows Rollback), what happens next—does it show a rollback progress screen, reboot, then return to the same menu, or error out?
2) In Troubleshoot → Advanced options, do you see Uninstall Updates and/or System Restore?
Reply with those two answers and I’ll tell you the single best next action (no YouTube roulette, no risky commands).

 

[Mint Condish]

Thank you for your reply.

After trying everything you've mentioned, I still cannot boot into Windows again. First I'm going to answer your two questions, then I'll tell you exactly what I see when trying each one of your recommendations:

1) When I click on "Continue: Exit and continue to Windows Rollback", I get the BitLocker recovery screen, then Choose keyboard layout, then back to the "Choose an option" screen. The options are:

- Continue: Exit and continue to Windows Rollback
- Use a device
- Use another operating system
- Troubleshoot
- Turn off your PC

If I select "Continue: Exit and continue to Windows Rollback" again, the same happens over and over again. No progress screen, no error out.

2) In Troubleshoot -> Advanced Options, yes, I do see both Uninstall Updates and System Restore.

----

So now, let's go over your recommendations:

"Continue (to Windows Rollback)": as I said above, and to use your same words, it "loops back to the same screen".

"Option A (best fallback): Uninstall the pending update":

First I get the BitLocker recovery screen. Then, in both "quality update" and "feature update", I must "choose an operating target system":

- Windows Rollback
- Windows 11 on volume 3
- Windows 11 on volume 3

That's right: the second and third options have exactly the same name, nothing to distinguish them. After clicking on them, I can see a different message when it comes to "quality" update. Here's what I see, verbatim:

a) When choosing "uninstall latest quality update":

- Windows Rollback: "We ran into a problem and won't be able to uninstall the latest quality update of Windows".

- Windows 11 on volume 3: "You have pending updates and we won't be able to uninstall the latest quality update of Windows. Try running Startup Repair instead".

- Windows 11 on volume 3: "We ran into a problem and won't be able to uninstall the latest quality update of Windows".

b) When choosing "uninstall latest feature update", same message for all three "operating target systems":

"We ran into a problem and won't be able to uninstall the latest feature update of Windows. Try resetting your PC instead (Troubleshoot > Reset this PC)".

"Option B: Startup Repair":

Again I must "choose an operating target system":

- Windows Rollback
- Windows 11 on volume 3
- Windows 11 on volume 3

What I get for each one:

- Windows Rollback: "Diagnosing your PC" black screen, then blue screen with this message: "Startup Repair couldn't repair your PC. Press 'Advanced options' to try other options to repair your PC or 'Shut down' to turn off your PC. Log file: C:$WINDOWS.~BT\Sources\SafeOS\winre.wim\System32\Logfiles\Srt\SrtTrail.txt"

- Windows 11 on volume 3: "Diagnosing your PC" black screen, then black screen with this message: "Your device ran into a problem and couldn't be repaired. Click or press Enter to see other recovery options. Couldn't connect to the network. Log file: C:$WINDOWS.~BT\Sources\SafeOS\winre.wim\System32\Logfiles\Srt\SrtTrail.txt"

- Windows 11 on volume 3: "Diagnosing your PC" / "Connecting to network..." screen, then black screen with this message: "Your device ran into a problem and couldn't be repaired. Click or press Enter to see other recovery options. Couldn't connect to the network. Log file: C:\windows\System32\Logfiles\Srt\SrtTrail.txt"

In the last two cases (both called "Windows 11 on volume 3"), the next screen is a blue one with "More recovery options":

- Continue: exit and continue Windows (selecting this takes me to square one, the BitLocker recovery key screen -> Choose your keyboard layout, etc.)
- Quick machine recovery
- Troubleshoot
- Turn off your PC

"Option C: System Restore":

Again I must "choose an operating target system":

- Windows Rollback
- Windows 11 on volume 3
- Windows 11 on volume 3

For all three I get: "No restore points have been created on your computer's system drive".

----

That is my situation now. I look forward to the "next click-path".

 

[ChatGPT]

Mint Condish, thanks for the very detailed feedback — you’ve hit the point where WinRE’s “buttons” won’t help, so the next effective path is:
1) Stop the BitLocker key loop (so you can reboot without entering it repeatedly)
2) Revert the “pending” upgrade actions offline (this is usually what’s keeping it stuck in rollback/repair)
3) If needed: repair boot files (UEFI)
4) Only then consider “Reset this PC (Keep my files)” as the “I need to work today” fallback.
Below is the exact click-path + the exact commands.

---

Step 0 (do this first): Back up your work files (fast + safe)​

Before we change anything, plug in a USB drive (or external SSD).

1. From the Choose an option screen:
   Troubleshoot → Advanced options → Command Prompt
2. In Command Prompt, type:
   notepad
   In Notepad: File → Open
   Change “Text Documents (*.txt)” to All files.
   Use this window like a file explorer to confirm you can see:
   • Your internal drive (with Users\...)
   • Your USB drive
3. If you prefer a faster copy (recommended), use robocopy (once you identify letters in Step 1 below). Example (replace letters and username):
   

   robocopy D:\Users\YourName\Desktop E:\Backup\Desktop /E /XJ /R:1 /W:1
   robocopy D:\Users\YourName\Documents E:\Backup\Documents /E /XJ /R:1 /W:1

   (This is just copying files; it won’t damage anything.)

If you tell me what folder your job files are in (Desktop/Documents/a project folder), I’ll tailor the robocopy commands.

---

Step 1: Identify the real Windows drive letter in WinRE​

In Command Prompt:

1. Run:
   

   diskpart
   list vol

2. Look for the large NTFS volume (hundreds of GB typically). Note its letter (often D: in WinRE, not C.
3. Type:
   exit

Now test the candidate letter(s), for example:

dir D:\Windows
dir C:\Windows

Whichever one shows the Windows folder is your offline Windows install. I’ll assume it’s D: below — change it if yours is different.

---

Step 2: Stop the BitLocker recovery prompt loop (important)​

Still in Command Prompt:

1. Check BitLocker status:
   manage-bde -status
   Find the entry that corresponds to your Windows volume (the one from Step 1).
2. If it says Locked, unlock it using your recovery key (replace with your 48-digit key):
   manage-bde -unlock D: -RecoveryPassword YOUR-48-DIGIT-KEY
3. Now suspend protection (this is what you missed originally, but we can still do it now offline):
   manage-bde -protectors -disable D:
4. Verify it took:
   manage-bde -status D:
   You want to see Protection Status: Protection Off.

This alone often stops the “enter key every reboot” nightmare while we fix the boot/rollback state.

---

Step 3 (main fix): Revert the “pending” servicing actions offline​

This is the most common reason you get a rollback loop with uninstall/startup repair failing.
In Command Prompt:
dism /image:D:\ /cleanup-image /revertpendingactions
Wait for it to complete (it can take a while). When it finishes:
1) Run a disk check (faster version first):
chkdsk D: /f
2) Run offline system file check:
sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows
Now reboot:

• Type exit
• Click Continue (or just restart)

If it boots: immediately back up your work, then we can cleanly address KB5077181 later.

---

Step 4 (only if still not booting): Repair boot files (UEFI)​

If you still loop after Step 3, your boot files/BCD may be pointing at the wrong target (and those duplicate “Windows 11 on volume 3” entries strongly suggest BCD confusion).
Back to Command Prompt:

1. Find the EFI partition and assign it a letter:
   

   diskpart
   list vol

   Look for a small FAT32 volume (usually 100–300 MB) — that’s the EFI System Partition.
   Select it (replace # with the volume number):
   

   select vol #
   assign letter=S
   exit

2. Rebuild boot files:
   bcdboot D:\Windows /s S: /f UEFI
3. Restart and test boot again.

---

Step 5 (deadline fallback): “Reset this PC” but keep your files​

If you cannot get it to boot after Steps 3–4, and you need the machine usable ASAP:
Troubleshoot → Reset this PC → Keep my files
Notes:

• This typically preserves C:\Users\... (your documents/desktop), but removes installed apps.
• Do this only after you’ve copied your work to USB (Step 0), because edge cases happen.

---

Two things I need from you to choose the single best next step​

Reply with these exact outputs (you can type them manually; a photo is fine too):
1) From Command Prompt:

• diskpart → list vol (just the table)
  2) manage-bde -status (just the section showing the OS volume letter and status)
  3) The “Root cause found” lines from:
• notepad D:\Windows\System32\Logfiles\Srt\SrtTrail.txt (or whichever drive letter actually contains \Windows)

With those 3, I can tell you exactly which “Windows 11 on volume 3” is the real one and whether we should do DISM revert pending actions first (usually yes) or jump straight to BCD repair.

 

[Mint Condish]

First, just to make sure I do not screw this up, two questions about Step 1 (and please, everybody here forgive me if this is too obvious):

– Is C: my Windows drive? It should be, because this is what I get after DISKPART> list vol:

Volume 0 D CDROM 484 KB
Volume 1 C Windows 475 GB
Volume 2 (no letter) SYSTEM 260 MB
Volume 3 (no letter) Windows RE 755 MB
Volume 4 E The Recovery 4657 GB

– E: is the external drive I used to copy my works. Can I just unplug it or do I have to remove it safely somehow?

Once I get your answers I'll move to Step 2

 

[ChatGPT]

1) Is C: your Windows drive in this environment?​

Yes — in your WinRE session it very clearly is.
From your list vol:

• Volume 1 C Windows 475 GB This is your main Windows (OS) partition.
• Volume 2 SYSTEM 260 MB (no letter) This is almost certainly the EFI System Partition (boot files) on a UEFI system.
• Volume 3 Windows RE 755 MB The recovery environment partition.
• Volume 0 D CDROM WinRE often shows a tiny “CDROM” ramdisk like this; normal.
• Volume 4 E The Recovery 4657 GB This is very likely your external drive (the size matches), especially since you used it to copy your work.

So in the commands I gave earlier, you can replace D: with C:.

---

2) Can you just unplug the external drive (E:)?​

Yes, as long as you are not actively copying to it right now.
Because you’re in WinRE (no “Safely remove” tray icon), the practical safe approach is:

1. Make sure any copy command has finished and you’re back at the X:\...> / command prompt.
2. Wait ~10–20 seconds after the last copy finishes (or until the drive activity light stops, if it has one).
3. Then unplug it.

If you want to be extra cautious: close Notepad/Explorer windows you used for copying first.

---

Proceed to Step 2 (with the correct drive letter)​

When you’re ready, go to Troubleshoot → Advanced options → Command Prompt and run these using C::
1) Check status:
manage-bde -status
2) Then suspend BitLocker protectors on the OS volume:
manage-bde -protectors -disable C:
If it complains that the volume is locked, tell me exactly what it says — then we’ll do the manage-bde -unlock C: -RecoveryPassword ... step.
After that, we’ll go straight into the “revert pending actions” command (the one most likely to break the loop).

 

[Mint Condish]

I'm running into a problem with Step 2.

X:\Windows\System32\manage-bde -status

tells me "Protection On" and "Unlocked". So I then proceed to:

X:\Windows\System32\manage-bde -protectors -disable C:

but this gives me an error message:

"ERROR: An error occured (0x80070490):
Element not found."

Just in case it needs unlocking anyway, I use:

X:\Windows\System32\manage-bde -unlock C: -RecoveryPassword (my 48-digit key)

which returns:

"ERROR: The volume is already unlocked."

So I recheck:

X:\Windows\System32\manage-bde -status C:

tells me, again: "Protection On" and "Unlocked".

TO SUM UP: I can't get "manage-bde -protectors -disable C:" to work.

 

[ChatGPT]

That’s a very useful result, and it doesn’t stop us from continuing.

Why you’re seeing 0x80070490 Element not found​

In WinRE, manage-bde -protectors -disable C: sometimes fails with Element not found even though the volume reports Protection On and Unlocked. It usually means WinRE can’t locate the specific protector object it expects to “suspend” (TPM/PCR binding metadata can be in a weird state after a failed upgrade). The important part for the next steps is that the OS volume is unlocked, which yours is.
So: don’t waste time fighting that command right now—we’ll move to the step that actually breaks the rollback loop.

---

Do this next (the real “unstick” step): revert pending actions offline​

From Troubleshoot → Advanced options → Command Prompt, run:
dism /image:C:\ /cleanup-image /revertpendingactions

• Let it finish even if it takes a long time.
• If it says it completed successfully, immediately follow with:

chkdsk C: /f
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

Then reboot (type exit and choose Continue). You may still have to enter the BitLocker recovery key on the next boot, but we’re trying to get Windows to boot normally again.

---

Quick check (optional but helpful): list protectors​

Before you reboot, run this and paste the output (do not paste your 48‑digit key):
manage-bde -protectors -get C:
This tells us what protector types exist (TPM, Recovery Password, etc.) and whether WinRE is “seeing” them properly.

---

If Windows still won’t boot after the DISM/SFC run​

Then we’ll repair the UEFI boot files (your list vol already shows a SYSTEM 260 MB partition, which is the EFI partition).
I’ll give you the exact commands for that once you tell me whether revertpendingactions succeeds or throws an error.

---

Reply with:​

1) The final message DISM shows after revertpendingactions (success vs error + any code), and
2) The output of manage-bde -protectors -get C: (key removed/hidden)
…and we’ll choose the next exact click-path.

 

[Mint Condish]

1) After revertpendingactions (which was very fast) it says:

"The operation completed. Revert of pending actions will be attempted after the reboot.
The operation completed successfully."

2) Output of manage-bde -protectors -get C: is:

"BitLocker Drive Encryption: Configuration Tool version 10.0.26100

Volume C: [Windows]
All Key Protectors

Numerical Password:
ID: --
Password: --
Backup type: Microsoft account backup

ERROR: An error occured (0x80070057):
The parameter is incorrect."


Notes:

a) chkdsk says: "Windows has scanned the file system and found no problems."

b) scannow says: "Windows Resource Protection did not find any integrity violations."

c) Due to that BitLocker error message I have not attempted to exit and reboot yet. I'll wait for your reply.

 

[ChatGPT]

You’re at the exact point where you must reboot.
That DISM message:

“Revert of pending actions will be attempted after the reboot.”

means Windows hasn’t actually performed the rollback yet—it has only scheduled it. So staying in WinRE won’t change anything further until you restart.

About the BitLocker 0x80070057 during -protectors -get​

Don’t let that stop you. Your key facts are:

• The OS volume is Unlocked
• DISM/SFC/CHKDSK all look clean
• The revert is queued for the next boot

The manage-bde -protectors -get C: error in WinRE is annoying, but it’s not required for the pending-actions revert to run.

---

Next click-path (do this now)​

1) Unplug the external drive (E (since you’ve finished copying files).
2) In Command Prompt, type:
exit
3) Back at Choose an option, pick:

• Continue (or if it keeps bouncing you around, choose Turn off your PC, then power it back on)

4) If you get the BitLocker recovery screen, enter the recovery key again.
5) Then wait:

• If you see any “Working on updates/Undoing changes/Restoring…” type screen, let it run.
• Keep it plugged into AC power.

---

If it still loops back to the same WinRE menu after reboot​

Then we’ll assume the boot entries are confused (very plausible given the “Windows Rollback” target showing up everywhere).
Do this exactly (UEFI boot rebuild):
1) Troubleshoot → Advanced options → Command Prompt
2) Run:

diskpart
list vol
select vol 2
assign letter=S
exit
bcdboot C:\Windows /s S: /f UEFI

3) Then reboot again.
(Volume 2 is your 260 MB “SYSTEM” partition from your earlier list vol output.)

---

Tell me what happens after the reboot​

After you reboot, reply with one of these outcomes:

• A) It booted into Windows
• B) It showed “undoing/restoring” and then booted
• C) It still loops to the same “Choose an option” screen

If you get C, I’ll have you paste the first ~30 lines of SrtTrail.txt (root cause section) and we’ll decide between deeper BCD cleanup vs the “Reset this PC (keep my files)” deadline option.

 

[Mint Condish]

The outcome is A.

THIS IS GLORIOUS. ROCK & ROLL!

I got the black screen with the HP logo and the spinning wheel for longer than it's been throughout this process, but it didn't say "undoing/restoring". The message I get now is this:


"We couldn't install Windows 11

We've set your PC back to the way it was before you started installing Windows 11.

0xC1900101- 0x20017
The installation failed in the SAFE_OS phase during BOOT operation"


Windows specifications are:

Edition: Windows Home Single Language
Version: 25H2
OS build: 26200.7171
Experience: Windows Feature Experience Pack 1000.26100.265.0

I don't remember exactly how much free space I had on C: before I almost destroyed my universe, but I think I now have maybe 10 or 15 GB less. Now, I still have the Win11_25H2_English_x64 ISO on my desktop, so that's over 7 GB right there. The reason I mention this is that I'd like to know whether I should remove "junk"/leftover files, and if so, how to do it.

And then there's the issue of the security update which brought me here. I don't know how I go from OS build 26200.7171 to 26200.7840.

THANKS!

 

[ChatGPT]

Fantastic news, Mint Condish — the rollback + boot is the hard part, and you’re past it.
That message means: Windows successfully rolled you back to your pre-upgrade state, but the in-place upgrade attempt failed with a driver/boot-time problem:

0xC1900101-0x20017 = usually a driver issue
failed in SAFE_OS phase during BOOT operation = it died during the reboot portion of setup (not while you were logged in)

You’re currently back on Windows 11 Home Single Language 25H2 (26200.7171), which matches what you reported earlier.

---

1) Reclaim the “lost” disk space (safe cleanup)​

After a failed/rolled-back upgrade, Windows typically leaves setup leftovers like:

• C:\$WINDOWS.~BT (can be several GB)
• C:\$WINDOWS.~WS (sometimes)
• temporary setup files, logs, etc.
• plus your ISO (~7+ GB)

Recommended cleanup (GUI)​

1. Settings → System → Storage → Temporary files
2. Check items like:
   • Temporary Windows installation files
   • Windows Update Cleanup
   • Delivery Optimization Files
   • Temporary files
3. Click Remove files

If you see Previous Windows installation(s) (i.e., Windows.old), only remove it if you’re confident you don’t need to roll back again (you already rolled back, so it may or may not exist).

Easy win: delete the ISO (if you don’t need it right now)​

If your ISO is on the Desktop and you’re not about to re-try the repair-install today, deleting it immediately gives you ~7+ GB back.

---

2) Getting from 26200.7171 → 26200.7840 (KB5077181 path)​

Try in this order:

Step A — Try Windows Update normally (now that you can boot)​

1. Reboot once (fresh boot)
2. Plug in power
3. Settings → Windows Update → Check for updates
4. Install everything offered (including any Servicing Stack updates), reboot when asked

If KB5077181 still fails the same way, then go to Step B.

Step B — Do the repair-install again, but reduce the chance of 0xC1900101-0x20017​

Because your failure was in the BOOT portion, do these before launching setup.exe:

1. Back up your work again (you already did once—keep that safety net)
2. Suspend BitLocker (important this time) from within Windows (Admin CMD):
   manage-bde -protectors -disable C:
   (After you’re stable again, re-enable with manage-bde -protectors -enable C:.)
3. Disconnect non-essential USB devices (printers, hubs, external drives, dongles—leave only power + mouse if needed)
4. Uninstall/disable third-party antivirus temporarily (if you have any)
5. Update HP drivers/BIOS via HP Support Assistant (especially storage/chipset/BIOS)

Then mount the ISO and run setup.exe again.

Critical check: confirm your ISO actually matches Home Single Language​

Before you try setup again, confirm the ISO contains your edition (this matters for a clean in-place upgrade):
Open Admin Command Prompt and run (adjust drive letter of the mounted ISO, often D:):
dism /Get-WimInfo /WimFile:D:\sources\install.wim
(or install.esd if that’s what it has)
You should see an index for Home Single Language (or an edition that matches what you have installed). If it’s missing, that can cause ugly upgrade behavior.

---

3) If the repair-install fails again: grab the one log that tells us why​

If you hit 0xC1900101-0x20017 again, don’t guess. The reason is usually recorded here:

• C:\$WINDOWS.~BT\Sources\Panther\setuperr.log
• C:\$WINDOWS.~BT\Sources\Panther\setupact.log

Zip those and attach them to this thread (or paste the last ~50 lines of setuperr.log). That will tell us which driver blocked boot.

---

Two quick questions (so I can give you the cleanest next move)​

1) Do you have any third‑party antivirus installed (Norton/McAfee/Avast/etc.), or only Microsoft Defender?
2) When you mount the ISO, does dism /Get-WimInfo show Home Single Language?
Answer those and I’ll tell you whether to try Windows Update first, or go straight to a “clean” repair-install attempt aimed at getting you to 26200.7840 without another near-heart-attack.

 

[Mint Condish]

OK, so:

- Recommended cleanup performed as you indicated.

- Tried Windows Update. Attempted to install KB5077181, same outcome: download 100%, installing reaches 100%, installation failed: "Install error - 0x800f0993".

No other updates were available, except for the optional ones. Since you mentioned I should install everything offered, I figured what the heck, let's include those:

2026-01 .NET Framework Preview Update (KB5074828) was installed.
2026-02 Preview Update (KB5077181) (26200.7922) could NOT be installed, for some reason.

Got a couple of updates from HP Support Assistant, including BIOS. After a fresh reboot I tried Windows Update again, the situation is the same.

- Now, to answer your two quick questions:

1) Yes, I have ESET Internet Security version 19.0.14.0

2) Yes, dism /Get-WimInfo shows:

Index : 3
Name : Windows 11 Home Single Language
Description : Windows 11 Home Single Language
Size : 22,213,449,980 bytes

- Something I want to add: this is not the first Windows Security Update I can't install; in fact, I believe it is the third. However, I've had no problems installing malicious software removal tools, Microsoft Defender security intelligence updates, all Microsoft Office updates, and driver updates.

- Something I want to ask: I understand a repair-install would let me keep my files and apps (I have the files copied on that external drive, in any case). But would it modify my settings? I mean file associations in particular, and in general the whole gigantic set of Windows settings.

Thank you, Mister Robot.

 

[ChatGPT]

You’re stable again (most important), and now we can focus on why KB5077181 keeps failing.

What your current symptoms point to​

• 0x800f0993 on a cumulative update after it reaches 100% install is very often “servicing stack / component store can’t commit the package cleanly.”
• On this specific KB, WindowsForum has already seen “DISM/SFC look fine, but the LCU still won’t install” cases where the durable fix is an in‑place repair upgrade using same-branch, newer build media.
• Also, you having ESET matters. We’ve seen at least one user report that simply disabling NOD32 wasn’t enough—they had to uninstall security software before the KB would go through.

So I’d do this in two passes: a “cheap try” (reset WU + remove ESET), then the “guaranteed” fix (repair-install done correctly).

---

Pass 1 (fast attempt): uninstall ESET + reset Windows Update components​

1) Uninstall ESET (don’t just disable it)

• Settings → Apps → Installed apps → ESET Internet Security → Uninstall
• Reboot

(If it refuses to fully uninstall or leaves drivers behind, tell me and I’ll point you to the “ESET Uninstaller” route.)
2) Reset Windows Update cache
Open Command Prompt (Admin) and run:

net stop wuauserv
net stop bits
net stop cryptsvc

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old

net start cryptsvc
net start bits
net start wuauserv

Reboot again, then try Settings → Windows Update → Check for updates and attempt KB5077181.
If this works, great: reinstall ESET after you’re fully patched.

---

Pass 2 (most likely fix): repair-install (in-place upgrade) with the RIGHT prep​

This is the same approach that solved the KB5077181 “won’t install despite DISM/SFC” pattern in the guide you originally followed—matching edition/arch + newer build media is the key.

A) Confirm your ISO is actually newer than your installed build​

Mount the ISO (double-click it), note the mounted drive letter (say D:), then run:
dism /Get-WimInfo /WimFile:D:\sources\install.wim /index:3
You’re looking for Version 10.0.26200 and a ServicePack Build that is higher than 7171 (for example 7840 or higher). The working example in the KB5077181 fix thread used media reporting ServicePack Build 7840.
If your ISO is not newer than 7171, the repair-install is much more likely to fail or be blocked.

B) BitLocker (do this first this time)​

Before you run setup.exe:
manage-bde -protectors -disable C:
That “BitLocker Safety” step is explicitly part of the successful KB5077181 repair-install recipe.

C) Remove upgrade blockers​

• Keep ESET uninstalled for the repair-install attempt (you can reinstall afterward)
• Disconnect non-essential USB devices (printers, hubs, external drives)
• Make sure you have ~30 GB free on C: (more is better)

D) Run the in-place upgrade correctly​

• Run setup.exe from the mounted ISO inside Windows
• Choose Keep personal files and apps
• When prompted about downloading updates during setup, I usually choose Not right now for the repair pass (we want the baseline rebuild first), then do Windows Update after the OS is back up.

After it completes:

• Re-enable BitLocker protectors:
  manage-bde -protectors -enable C:
• Then run Windows Update again—this is where KB5077181 typically finally installs.

---

Your question: will a repair-install change settings / file associations?​

Mostly it keeps settings, but you should assume some things can be reset—and default apps / file associations are one of the most common annoyances after an in-place upgrade.
If file associations matter to you, do this before the repair-install:
dism /online /Export-DefaultAppAssociations:C:\appassoc.xml
Afterward, if needed:
dism /online /Import-DefaultAppAssociations:C:\appassoc.xml
(That primarily affects defaults Windows applies; you may still need to re-pick a couple of defaults in Settings, but it gives you a strong “restore baseline”.)

---

If you want the “most accurate” next step​

Reply with the output of this (just the “Version / ServicePack Build” lines are enough):
dism /Get-WimInfo /WimFile:D:\sources\install.wim /index:3
If your ISO is newer than 7171, I’d strongly lean to: uninstall ESET → suspend BitLocker → repair-install → Windows Update as the quickest path to 26200.7840+ with the least trial-and-error.

 

[Mint Condish]

Whoa, correct me if I'm wrong, but the ISO looks way OLDER than 7171! The details:

----

Details for image : D:\sources\install.wim

Index : 3
Name : Windows 11 Home Single Language
Description : Windows 11 Home Single Language
Size : 22,213,449,980 bytes
WIM Bootable : No
Architecture : x64
Hal : <undefined>
Version : 10.0.26200
ServicePack Build : 6584
ServicePack Level : 0
Edition : CoreSingleLanguage
Installation : Client
ProductType : WinNT
ProductSuite : Terminal Server
System Root : WINDOWS
Directories : 30326
Files : 135428
Created : 2025-09-15 - 17:04:25
Modified : 2025-09-15 - 17:32:23
Languages :
en-US (Default)

The operation completed successfully.

----

 

[ChatGPT]

You’re reading it right: that ISO is older than your currently installed build.

• Your PC: 26200.7171 (installed update baseline from Nov 11, 2025, per Microsoft’s update history list for 25H2). (support.microsoft.com)
• Your ISO: ServicePack Build 6584, created 2025‑09‑15.

That mismatch explains a lot:
1) why the repair-install attempt rolled back (setup media older than what’s installed), and
2) why you’re still stuck on KB5077181 (your servicing chain is unhappy, and Windows Update is failing with 0x800f0993).

What to do next (best path)​

Step 1 — Don’t use that ISO for a repair-install​

A repair-install that keeps apps/files/settings is happiest when the media is same build or newer than the installed OS. Your ISO is not.
Action: download fresh Windows 11 installation media again from Microsoft (don’t reuse the September 2025 ISO). The official Windows 11 download page is here.
After downloading, re-check it the same way you did:
dism /Get-WimInfo /WimFile:D:\sources\install.wim /index:3
You want the ISO to show a ServicePack Build that is >= 7171 (ideally it’ll be up around the current monthly level).

T before trying either the KB or the repair-install​

This is important. On WindowsForum we’ve seen cases where disabling security software wasn’t enough—users had to uninstall it to get the LCU to install cleanly.
So:

1. Settings → Apps → Installed apps → ESET Internet Security → Uninstall
2. Reboot

(After you’re fully patched, reinstall the latest ESET.)

Step 3 — Try installing KB5077181 using the Microsoft Update Catalog package (bypasses “normal” WU)​

Microsoft’s KB page explicitly documents installing KB5077181 by downloading the standalone MSU from the Microsoft Update Catalog, and then installing with DISM. (support.microsoft.com)
High-level steps:

1. Download Windows11.0-KB5077181-x64.msu from Microsoft Update Catalog (linked from the KB article). (support.microsoft.com)
2. Put it in e.g. C:\Packages
3. Run Command Prompt (Admin):
   DISM /Online /Add-Package /PackagePath:C:\Packages\Windows11.0-KB5077181-x64.msu
4. Reboot, then check winver (KB5077181 should land you on 26200.7840). (support.microsoft.com)

If DISM fails too, then we’re back to the “baseline reset” fix: repair-install using correct/newer media.

---

Your question: will a repair-install change settings (file associations etc.)?​

Mostly it preserves settings, but yes—an in-place upgrade/repair-install can reset some things (default apps/file associations are one of the more common ones).
If file associations matter, you can “snapshot” them before the repair-install:
dism /online /Export-DefaultAppAssociations:C:\appassoc.xml
Afterward (if needed):
dism /online /Import-DefaultAppAssociations:C:\appassoc.xml
It won’t necessarily restore every single preference in every app, but it’s the best built-in way to preserve/restore default app mappings.

---

One quick clarification question​

When you download a new ISO from Microsoft and run your dism /Get-WimInfo check again: what ServicePack Build does it show?
If it’s still 6584, I’ll steer you to the “setup + Dynamic Update” approach (so setup pulls the newer SafeOS/LCU during the upgrade), but I don’t want to guess until we see the number.

 

[Mint Condish]

I haven't tried any kind of updating again yet, but I want to mention I got that ISO file just over an hour ago from:

Download Windows 11

"Download Windows 11 Disk Image (ISO) for x64 devices

This option is for users that want to create a bootable installation media (USB flash drive, DVD) or create a virtual machine (.ISO file) to install Windows 11. This download is a multi-edition ISO which uses your product key to unlock the correct edition."

Download selected (only option available): "Windows 11 (multi-edition ISO for x64 devices".

 

[ChatGPT]

You’re not wrong — but in this case it’s normal, and it’s exactly why that ISO didn’t help.

Why the ISO you just downloaded looks “old” (ServicePack Build 6584)​

The “Download Windows 11 Disk Image (ISO)” option on Microsoft’s Windows 11 download page is typically a base release ISO, not a “fully patched as-of-today” ISO. The same page also offers Installation Assistant and the Media Creation Tool, which are the options that more commonly pull newer bits during the install/upgrade flow. (microsoft.com)
So: getting an ISO that reports Created 2025‑09‑15 and ServicePack Build 6584 can happen even if you downloaded it today.
Key implication: that ISO is older than your installed 26200.7171, so using it for a repair-install is likely to fail/rollback or refuse to keep apps/files.

---

Best next move for your situation (KB5077181 failing with 0x800f0993)​

Given you already updated HP BIOS/drivers and DISM/SFC are fine, the next “least guessing” approach is:

Step 1 — Uninstall ESET (don’t just disable)​

You already saw how upgrades/servicing can be sensitive; ESET can hook deep into networking/filesystem/boot. Uninstall it temporarily, reboot, and only reinstall after you’re fully patched.

Step 2 — Install KB5077181 via Microsoft Update Catalog + DISM (bypasses Windows Update’s orchestration)​

Microsoft’s own KB5077181 instructions explicitly describe downloading the standalone MSU(s) from the Microsoft Update Catalog, placing them in a folder (e.g. C:\Packages), and installing via DISM. It also notes this KB includes MSUs that may require a specific order, and DISM can handle prerequisites when the files are in the same folder.
Do this:
1) Create a folder:
mkdir C:\Packages
2) From the KB5077181 article, go to the Microsoft Update Catalog and download all MSU files for KB5077181 (Microsoft lists multiple MSUs and an order). Put them all into C:\Packages.
3) Run Command Prompt as Administrator, then:
DISM /Online /Add-Package /PackagePath:C:\Packages\Windows11.0-KB5077181-x64.msu
(That is the exact pattern Microsoft documents.)
4) Reboot and check winver. Per Microsoft, KB5077181 is the Feb 10, 2026 cumulative update and should move Windows 11 25H2 to OS Build 26200.7840.
Important: Because BitLocker already bit you once, I’d also suspend protectors before the reboot part of the install:
manage-bde -protectors -disable C:
Then after you’re stable:
manage-bde -protectors -enable C:

---

If DISM/MSU still fails: use Installation Assistant (not the ISO) for the repair-install​

If we end up needing the “baseline reset” (repair-install / in-place upgrade), use Windows 11 Installation Assistant from the same Microsoft page rather than the old base ISO. It’s explicitly presented as “the best option for installing Windows 11 on the device you’re currently using.” (microsoft.com)
And do it with:

• ESET uninstalled
• BitLocker protectors suspended
• minimal USB devices connected

---

Will a repair-install change your settings (file associations, etc.)?​

Mostly no (it tries hard to preserve apps, files, and many settings), but yes, some settings can change, and default apps/file associations are one of the most common things to get reset.
If you want to protect against that, you can export default app associations beforehand and re-import after.

---

Quick question so I can give you the cleanest exact sequence​

When you say “multi-edition ISO was the only option,” did you also see Installation Assistant and Media Creation Tool on that page (above the ISO section), or were those blocked/missing for you? (microsoft.com)
And: do you want to try the DISM/MSU method first (least disruptive), or jump straight to the Installation Assistant repair-install (most likely to “just fix the servicing baseline”)?

 

[Mint Condish]

Reply to your quick question: yes, I see Windows 11 Installation Assistant and Create Windows 11 Installation Media on that page (when I said that multi-edition ISO was the only option, I was referring to the ISO "Select Download" drop-down menu).

And yes, "least disruptive" first would be ideal.

 

[ChatGPT]

Got it — “least disruptive first” is exactly the right approach here.
At this point you have two big clues:
1) Windows Update fails with 0x800f0993 (commit/applicability/servicing failure), and
2) you’re running ESET (which often needs to be uninstalled, not merely disabled, for stubborn LCUs to install). We’ve already seen a KB5077181 case where the user reported that disabling NOD32/Malwarebytes wasn’t enough — they had to uninstall them, rebuild SoftwareDistribution, and then it worked. “least disruptive” sequence.

---

Phase 1 — Minimal change attempt (recommended)​

1) Temporarily uninstall ESET (not just disable)​

• Settings → Apps → Installed apps → ESET Internet Security → Uninstall
• Reboot

(You can reinstall after KB5077181 is installed.)

2) Reset Windows Update’s working folders (SoftwareDistribution + Catroot2)​

Open Command Prompt (Admin) and run:

net stop wuauserv
net stop bits
net stop cryptsvc

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old

net start cryptsvc
net start bits
net start wuauserv

Reboot.

3) Try KB5077181 again via Windows Update​

Settings → Windows Update → Check for updates → install KB5077181
If it installs: confirm with Win+R → winver (you’re aiming for 26200.7840 for the Feb 2026 baseline that KB5077181 targets on 25H2, per the earlier KB5077181 tracking threads here).

---

Phase 2 — Still failing? Install it offline (next least disruptive)​

If Windows Update still throws 0x800f0993, do the Catalog method:
1) Download the KB5077181 MSU for x64 from the Microsoft Update Catalog.
2) Put it in C:\Packages (create the folder if needed).
3) Run (Admin CMD):
DISM /Online /Add-Package /PackagePath:C:\Packages\Windows11.0-KB5077181-x64.msu
Reboot and re-check winver.
(This bypasses some of Windows Update’s “express/orchestration” behavior that can be part of the failure.)

---

Phase 3 — If it still won’t take: the fix that usually “sticks”​

This is where the “component store baseline refresh” comes in: an in-place repair upgrade using matching branch + same edition + same architecture + same-or-newer build media. That’s the approach documented in the KB5077181 fix guide thread you originally followed.
Two important adjustments for your case:

• Do notoaded (ServicePack Build 6584). It’s older than your installed 7171, so it’s not suitable as “same-or-newer” repair media.
• Use Windows 11 Installation Assistant or the Media Creation Tool from that same Microsoft page (these are more likely to pull newer bits than the “base” ISO download).

And before you try the upgrade again:

• Keep ESET uninstalled
• Suspend BitLocker protectors (this is the step you missed originally and it triggered the recovery-key nightmare):
  manage-bde -protectors -disable C:
  After you’re stable:
  manage-bde -protectors -enable C:

---

One question (so we don’t waste another attempt)​

After you uninstall ESET + reset SoftwareDistribution/Catroot2 + reboot, does the KB failure code remain 0x800f0993, or does it change to a different code?
If you paste the new failure code and the last ~30 lines of C:\Windows\Logs\CBS\CBS.log around the time of the failed install, I can tell you whether Phase 2 (Catalog/DISM) is likely to work immediately or if you should jump straight to the Installation Assistant repair upgrade.