Windows Update -2026-11 Security Update (KB5132061) (26300.9974) - Install error - 0x800f0993

Install KB5132061 manually with its required checkpoint cumulative update first; for an x64 PC, install KB5043080 and then KB5132061 in that exact order.

Install the two MSU packages manually

The KB5132061 catalog entry explicitly requires checkpoint packages to be installed before the target cumulative update ^1^.

1. Open Settings → System → About → System type and determine whether the PC is x64 or ARM64.
2. Create an empty folder named:

      C:\Packages
   

3. For an x64 PC, download these two files into that folder:
   1. KB5043080 checkpoint cumulative update
   2. KB5132061 cumulative update
   For an ARM64 PC, use the corresponding ARM64 packages listed on the KB catalog page instead. Do not install x64 packages on ARM64.
4. Double-click the KB5043080 file first. If Windows reports that it is already installed, continue.
5. Double-click the KB5132061 file.
6. Restart Windows, then open Settings → Windows Update → Update history and confirm that KB5132061 is installed and the OS build is 26300.9974.

Your current build, 26300.9818, identifies the 26H2 branch. KB5132061 requires a September 22, 2026-or-later update and servicing stack version 26100.9539 or later on 26H2 ^1^. Build 26300.9818 is later than that prerequisite update, but if the manual installation still rejects the package, verify the servicing stack from an elevated Command Prompt:

DISM /Online /Get-Packages | findstr /i "ServicingStack"

The returned package identity must show version 26100.9539 or later.

If the standalone installation still fails

Since SFC found no integrity violations but DISM /RestoreHealth cannot obtain repair content, use Windows 11’s supported repair-reinstall option instead of repeating the failed cache reset or the same DISM command.

1. Back up important personal files.
2. Open Settings → System → Recovery.
3. Under Fix problems using Windows Update, select Reinstall now.
4. Keep the PC connected to power and the internet.
5. Allow the repair installation to complete and restart.
6. Return to Settings → Windows Update → Check for updates.

This reinstalls the current Windows version, repairs system files and servicing components, and preserves installed applications, files, and settings ^2^.

If Fix problems using Windows Update is absent, it can be unavailable on managed work/school PCs. In that case, an administrator or Microsoft Support will need to review C:\Windows\Logs\CBS\CBS.log and C:\Windows\Logs\DISM\dism.log.

About the earlier access-denied results

Do not repeat the SoftwareDistribution/Catroot2 rename sequence at this stage. Avast prevented Cryptographic Services from stopping, so those folders remained in use and the rename returned Access is denied. Microsoft notes that third-party security software can interfere with Windows updates and may be temporarily removed before updating, provided its installer or product information is available for reinstallation ^3^.

If either the standalone MSU installation or repair reinstall is blocked again, temporarily uninstall Avast, restart, perform the operation, and reinstall Avast afterward. Simply disabling protection might not unload the service that blocked the earlier reset.

References

1. Catalog
2. Fix issues by reinstalling the current version of Windows | Microsoft Support
3. Windows 11