Windows Update error 0x80070643: find which update failed, then fix that one

1. Which update?

Settings → Windows Update → Update history lists failures with their KB number. Or ask the event log, where event 20 records a failed install:

Get-WinEvent -LogName System -MaxEvents 200 |
  Where-Object { $_.ProviderName -eq 'Microsoft-Windows-WindowsUpdateClient' -and $_.Id -eq 20 } |
  Select-Object -First 5 TimeCreated, Message | Format-List

2. Repair Windows, and reset Windows Update

Damaged system files make installers fail. These two commands repair them, and are safe to run:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

DISM needs a while, and it downloads from Windows Update. If it fails with 0x800f081f, see DISM 0x800f081f.

Then clear Windows Update’s download cache, which can hold a broken copy of the update:

Stop-Service wuauserv, bits, cryptsvc -Force
Rename-Item C:\Windows\SoftwareDistribution SoftwareDistribution.old
Rename-Item C:\Windows\System32\catroot2 catroot2.old
Start-Service wuauserv, bits, cryptsvc

Renaming rather than deleting keeps a way back. You can delete the .old folders once updates work. Restart, and check for updates again. Update history looks empty afterwards, which is expected.

3. .NET Framework

A .NET update fails like this when an existing .NET install is damaged. Microsoft’s .NET Framework Repair Tool fixes most cases. Also check what you have:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full' | Select-Object Release, Version

On a server, check the Windows features too: .NET 3.5 is a feature there, and it can need the installation media, as explained in the DISM article.

4. Windows Recovery Environment updates

This is where many people met this error. Some updates to WinRE, the recovery system Windows boots for repairs, need more space than its partition has. They fail with this code, and retrying changes nothing.

See where WinRE lives:

reagentc /info

Windows RE status:         Enabled
Windows RE location:       \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE

Then see the partition’s size and free space in Disk Management, or:

Get-Partition -DiskNumber 0 | Format-Table PartitionNumber, Type, Size

Microsoft documents how to make the recovery partition larger in KB5028997: turn off WinRE, shrink the Windows partition a little, recreate the recovery partition with more space, and turn WinRE back on. Follow that article step by step, and take a backup first, as it uses diskpart on the system disk.

Do you need to? If you don’t use BitLocker, and WinRE works, this update matters less, and some admins choose to hide it. On machines with BitLocker, the WinRE fixes close real security holes, so make the space.

5. Defender and other products

A Microsoft Defender update failing with this code often fixes itself on a later attempt, or after a restart. Update it directly:

Update-MpSignature

If a third-party antivirus is installed, Defender may be turned off, and its updates can fail. Updates to Office or SQL Server are installed by their own installer: its log is under %TEMP%, or in the product’s setup folder, and it names the real problem.

6. Read the detailed logs

When the cause still isn’t clear:

Get-WindowsUpdateLog

That creates WindowsUpdate.log on your desktop. Search it for 0x80070643 and read the lines just before. Servicing problems are in C:\Windows\Logs\CBS\CBS.log.