For ESU-covered cumulative updates, the failure is expected when one of these applies:
- The device is running an edition that is not supported for ESU.
- The ESU MAK add-on key is not installed.
- The ESU key is installed but not activated.
- Required prerequisites for the update are missing.
Since .NET updates and other Windows updates install, but the cumulative security update fails, the first checks should be ESU licensing and activation.
Steps to verify on the affected PC:
- Open an elevated Command Prompt.
- Run one of these commands:
-
slmgr /dlv -
slmgr /dlv <Activation ID> -
slmgr /dlv all
-
- In the output, confirm the ESU key shows as licensed.
- If the ESU key is not installed, install it with:
-
slmgr /ipk <ESU key>
-
- Activate it with:
-
slmgr /ato <Activation ID>
-
If the key is already present, verify it is activated and that all update prerequisites for that monthly rollup have been applied. Microsoft states that update rollback or "Failure to configure Windows updates. Reverting Changes" is expected if the edition is not supported for ESU, or if the ESU MAK add-on key is not installed and activated.
If the issue continues after confirming the ESU key is licensed and activated, copy this log file and contact Microsoft Support:
-
C:\Windows\Logs\CBS\CBS.log
Note: slmgr /ipk and activation commands change licensing state. Use only the correct ESU key for that device.
References: