extended security updates error

Consumer Windows 10 ESU enrollment does not include technical support, so an update-installation case is not covered at no additional charge merely because the PC is ESU-enrolled.^1^

If this is a personal or home PC

Microsoft’s consumer ESU terms provide critical and important security updates but explicitly exclude technical support. “At no additional cost” refers to an ESU enrollment option for users syncing PC settings—not free installation assistance.^1^

To request assistance outside the ESU entitlement:

1. Open Start, type Get Help, and open the Get Help app.
2. Search for Windows Update error 0x80070643.
3. Complete the diagnostic and select Contact Support if offered.
4. Provide the failed update’s KB number, shown under Settings > Update & Security > Windows Update > View update history.

Any assisted-support availability or charge depends on Microsoft’s current consumer support offerings and your region. Microsoft Q&A is community support and does not create an official Microsoft support case.

If this is a commercially licensed ESU device

Commercial ESU has limited support for ESU license activation, installation, and possible regressions, but the organization must also have an active Microsoft support plan.^2^

Customers with purchased ESUs and a paid support plan can request assistance with ESU key installation, licensing, or activation. Microsoft requires customers to call Microsoft Support and provide their Enterprise Agreement number or full customer name so entitlement can be validated and a case created.^3^

A general Windows Update failure is not automatically covered. It must be established that the problem concerns ESU installation, activation, or a regression caused by ESU; ordinary product troubleshooting remains outside the included ESU scope.

Check which update is producing 0x80070643

The error code alone does not prove an ESU licensing problem. Since the Windows Update and Defender paths have already been investigated, identify the failed KB before doing further repairs.

If the failed update is KB5057589, Microsoft documented an inaccurate 0x80070643 result for that Windows Recovery Environment (WinRE) update. The update was typically installed successfully after restart, and the issue was corrected by KB5063523 or later.^4^

For that specific KB:

1. Install the latest update offered under Settings > Update & Security > Windows Update.
2. Restart and run another update scan.
3. Optionally verify success in Event Viewer > Windows Logs > System by finding a WinREAgent event with Event ID 4501 and “Servicing succeeded.”
4. Alternatively, verify that the installed WinRE version is at least 10.0.19041.6090, the level documented for KB5063523.^5^

KB5063523 requires 250 MB free in the WinRE recovery partition—not merely free space on the normal Windows C: volume. Its historical failure entry may remain visible in Update History even after the issue is resolved.^5^

If a different KB is failing, include that KB number, Windows 10 edition/version, and whether the enrollment is consumer or commercial when contacting support; the available information does not establish the cause from 0x80070643 alone.

References

1. Windows 10 Consumer Extended Security Updates (ESU)
2. Extended Security Updates (ESU) program for Windows 10
3. Lifecycle FAQ - Extended Security Updates
4. KB5057589: Windows Recovery Environment update for Windows 10, version 21H2 and 22H2: April 8, 2025 | Microsoft Support
5. KB5063523: Windows Recovery Environment update for Windows 10, version 21H2 and 22H2: July 8, 2025 | Microsoft Support