Fix Windows 11 Stuck on “Updates Are Underway”: Recovery, Rollback, and Repair

If Windows 11 is stuck on “Updates are underway” and the message has not progressed for a long time, use Windows Recovery Environment (Windows RE) to uninstall the latest quality update first, then boot normally and repair Windows Update. This guide applies to Windows 11 and Windows 10, although Windows 10 reached end of support on October 14, 2025 and should be moved to a supported Windows 11 release where hardware permits. Do not interrupt an update merely because the percentage appears unchanged for a few minutes. If the display, storage-activity indicator, or fan activity suggests work is continuing, leave the PC connected to AC power and allow it to finish. Use the recovery steps below when the screen has remained unchanged through an extended period, the computer repeatedly returns to the same update screen, or Windows will no longer reach the sign-in screen.

Prerequisites and compatibility​

Quick walkthrough

• Connect laptops and tablets to AC power. Do not attempt recovery on battery alone.
• Disconnect nonessential devices before recovery: USB drives, external disks, printers, docks, scanners, and game controllers. Leave a wired keyboard and mouse connected if needed.
• Know the password for an administrator account.
• If BitLocker or device encryption is enabled, have the BitLocker recovery key available before entering Windows RE. Some recovery tools require it.
• These steps preserve personal files unless you later choose Reset this PC or reinstall Windows. Do not choose either option as an initial response to a stuck update.
• If the PC belongs to an employer or school, update repair options may be restricted by management policy. Contact the organization’s IT administrator before removing updates or changing managed update settings.

Primary procedure: recover the PC, roll back the failed update, and repair Windows Update​

1. Enter Windows Recovery Environment​

Use the least disruptive method that is available.
If you can reach the sign-in screen or desktop:

• Hold down Shift.
• While holding Shift, select Power > Restart.
• Release Shift when the blue Choose an option screen appears.

Windows 11 Settings path:

• Select Start > Settings > System > Recovery.
• Under Recovery options, find Advanced startup.
• Select Restart now.
• Confirm Restart now.

Windows 10 Settings path:

• Select Start > Settings > Update & Security > Recovery.
• Under Advanced startup, select Restart now.
• Confirm the restart.

If the PC is frozen on “Updates are underway” and cannot reach sign-in:

Warning: Forcing power off during an update can leave Windows unable to start. Use this only when the update is clearly stuck or caught in a repeated loop, not while it is visibly progressing.

Click to expand...

• Hold the physical Power button until the PC switches off.
• Turn it on.
• As soon as the Windows logo or manufacturer logo appears, hold the Power button again until the PC turns off.
• Repeat this interruption one more time.
• Turn the PC on a third time.
• Wait for Preparing Automatic Repair or Automatic Repair.
• Select Advanced options to open Windows RE.

If Windows RE does not appear, use Windows installation media created on another working PC. Boot from it, select language options, then choose Repair your computer rather than Install now.

2. Uninstall the latest quality update from Windows RE​

A failed monthly cumulative update is the most appropriate rollback target. Start with a quality update, not a feature update.

• In Windows RE, select Troubleshoot.
• Select Advanced options.
• Select Uninstall Updates.
• Select Uninstall latest quality update.
• If prompted, select the Windows installation to repair.
• Enter the BitLocker recovery key or administrator credentials if requested.
• Select Uninstall quality update and wait for the process to complete.
• Select Done, then choose Continue to boot Windows.

Expected result: Windows should return to the sign-in screen rather than the update loop. The removed update may be offered again later through Windows Update; do not immediately retry it until the repair steps below are complete.

Warning: Removing a quality update can temporarily remove security fixes included in that update. Roll back only to restore a device that cannot start or cannot complete the update. After repair, check Windows Update again and install the current applicable update.

Click to expand...

3. If quality-update removal does not restore startup, use System Restore​

Use this only if a restore point exists from before the update failure.

• Return to Windows RE.
• Select Troubleshoot > Advanced options > System Restore.
• Select the affected Windows account and enter its password if prompted.
• Choose a restore point dated before the update began failing.
• Select Next > Finish > Yes.

System Restore does not remove personal documents, pictures, or other user files. It can remove applications, drivers, and updates installed after the selected restore point. Windows will restart when restoration finishes.
If System Restore reports that no restore points are available, return to Advanced options and continue with the normal boot and repair steps below if possible.

4. Start Windows normally and run the Windows Update troubleshooter​

After Windows reaches the desktop, sign in and restart once normally before troubleshooting further.

• Select Start.
• Open the Get Help app.
• In the search box, type windows update troubleshooter.
• Select the Windows Update troubleshooter and follow the prompts.
• Approve diagnostics when asked.
• Restart if Get Help recommends it.

Expected result: Get Help reports the checks it performed and may correct Windows Update configuration, service, or download problems.

5. Repair the Windows component store and protected system files​

Run these commands only after Windows is usable again.

• Open Start and type Command Prompt.
• Right-click Command Prompt and select Run as administrator.
• Select Yes at the User Account Control prompt.
• Run the following command:
  DISM.exe /Online /Cleanup-Image /RestoreHealth
• Wait for the command to finish. It can pause at a percentage for several minutes; do not close the window.
• When it reports that the operation completed successfully, run:
  sfc /scannow
• Wait for Verification 100% complete.
• Restart the PC.

Expected results:

• DISM: “The operation completed successfully.”
• SFC: either “Windows Resource Protection did not find any integrity violations,” or “Windows Resource Protection found corrupt files and successfully repaired them.”

If SFC repairs files, the restart is required before testing Windows Update again.

6. Use Windows 11’s built-in reinstall repair option​

On eligible Windows 11 installations, this is the preferred repair when the update completed badly or repeatedly fails after rollback. It reinstalls the same version of Windows currently installed, repairs system files and components, and preserves apps, files, and settings.

• Connect to a stable, unmetered internet connection.
• Select Start > Settings > System > Recovery.
• Under Fix problems using Windows Update, select Reinstall now.
• Choose whether Windows may automatically restart the PC 15 minutes after installation completes.
• Select OK to begin.
• Windows opens Settings > Windows Update, downloads the repair version, and installs it.
• Restart the PC if you did not allow automatic restart.

Expected result: Windows returns to the same release and configuration, with repaired servicing components. This option may not be shown on organization-managed devices or on Windows 11 installations lacking the required servicing updates.

7. Check for updates again​

Windows 11:

• Select Start > Settings > Windows Update.
• Select Check for updates.
• Install available updates.
• Restart when prompted.

Windows 10:

• Select Start > Settings > Update & Security > Windows Update.
• Select Check for updates.
• Install available updates.
• Restart when prompted.

Install one update cycle at a time. If the same update fails again, record its KB number and any error code before using the troubleshooting section.

Verification of success​

The repair is complete when all of the following are true:

• Windows reaches the sign-in screen and desktop without returning to “Updates are underway,” “Undoing changes,” or Automatic Repair.
• Settings > Windows Update shows no pending restart caused by the failed update.
• Update history shows the previously failed update as uninstalled, superseded, or successfully installed after repair.
• DISM.exe /Online /Cleanup-Image /RestoreHealth completes successfully.
• sfc /scannow completes at 100% without reporting unrepaired corruption.
• A normal restart completes successfully.

To confirm the installed Windows version, press Windows key + R, type winver, and select OK.

Alternate method: reset the Windows Update download cache​

Use this method only when Windows now starts normally but the same update repeatedly fails to download, prepare, or install. Do not reset the cache while Windows is still in a pending-update boot loop.

Warning: This removes locally cached update downloads and update metadata. It does not remove installed updates or personal files, but Windows Update must download required files again. Ensure you have a reliable internet connection before continuing.

Click to expand...

• Open Command Prompt as administrator.
• Run each command separately:
  
  Code:

  net stop wuauserv
  net stop bits
  net stop cryptsvc
  ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
  ren %systemroot%\System32\catroot2 catroot2.old
  net start cryptsvc
  net start bits
  net start wuauserv

• Restart Windows.
• Return to Windows Update and select Check for updates.

If either rename command says the destination already exists, use a different unused suffix, such as SoftwareDistribution.old1 or catroot2.old1.
Rollback for the cache reset: If you must restore the prior cache before restarting, stop the same services, rename the newly recreated SoftwareDistribution and catroot2 folders, then remove .old from the original folder names. In normal circumstances, leave the new folders in place and let Windows rebuild them.

Troubleshooting and rollback/escalation​

Windows RE asks for a BitLocker recovery key​

This is expected on encrypted devices. Do not repeatedly guess or bypass the request. Obtain the recovery key from the Microsoft account, work or school account, printed record, or IT administrator associated with the device. Without the key, certain Windows RE tools cannot access the encrypted Windows installation.

“Uninstall latest quality update” fails or is unavailable​

First, verify that you selected quality update, not feature update. If it still fails:

• Return to Troubleshoot > Advanced options.
• Run System Restore if a pre-failure restore point exists.
• If Windows still cannot start, choose Startup Repair from Advanced options.
• If Startup Repair cannot recover the PC, boot from Windows installation media and select Repair your computer to access Windows RE again.

Do not repeatedly force-shutdown the PC after Windows RE is available.

Windows boots, but the repair reinstall option is missing​

The Fix problems using Windows Update option can be unavailable on managed PCs, older Windows 11 servicing levels, or systems configured to receive updates from an organization’s update service.
Use an in-place repair installation instead:

• Back up important files.
• Obtain Windows installation media matching the installed language, edition, and architecture.
• Start Windows normally.
• Mount the ISO or open the installation media in File Explorer.
• Run setup.exe.
• Select the option to keep personal files and apps.
• Complete setup and restart when prompted.

Do not boot from the media for this method; launching setup.exe from the running Windows installation is what preserves installed applications and settings.

DISM fails with a source or connectivity error​

DISM /RestoreHealth normally obtains repair content through Windows Update. Confirm that the PC has internet access, disable a temporary VPN or restrictive proxy if appropriate for the environment, restart, and run DISM again from an elevated Command Prompt.
If the device is work-managed, do not alter proxy, update-server, or policy settings without IT approval. A managed update source may be the reason DISM cannot retrieve repair files.

SFC says it could not perform the requested operation​

Run SFC in Safe Mode:

• Enter Windows RE.
• Select Troubleshoot > Advanced options > Startup Settings > Restart.
• After restart, press 4 or F4 for Safe Mode.
• Open an elevated Command Prompt.
• Run:
  sfc /scannow
• Restart normally after the scan.

Use 5 or F5 for Safe Mode with Networking only if you need network access for additional repair work.

The update fails again after repair​

Before retrying, disconnect nonessential external hardware and remove or update non-Microsoft antivirus software that may interfere with servicing. Confirm there is adequate free space on the Windows system drive. Then run Windows Update again.
If the same KB update repeatedly fails, keep the error code and KB number, review Settings > Windows Update > Update history, and escalate with those details plus the results of DISM and SFC. If Windows no longer starts and neither update rollback, System Restore, nor Startup Repair succeeds, back up data from recovery media if necessary and proceed with a repair installation or a documented reset/reinstallation plan.

---

References​

1. Official source: support.microsoft.com
   
   

   Use the System File Checker tool to repair missing or corrupted system files | Microsoft Support

   Describes how to use the System File Checker tool to troubleshoot missing or corrupted system files in Windows.

   support.microsoft.com
2. Official source: support.microsoft.com
   
   

   Using System File Checker in Windows | Microsoft Support

   Learn how to run System File Checker in Windows to check if your computer has problems with files.

   support.microsoft.com