Troubleshooting Windows Update Failures on Remote Devices with Intermittent Connectivity

Hafiz Othman 20 Reputation points
2026-10-21T05:26:42.7466667+00:00

Hi all,

We manage a fleet of remote Windows 10 and Windows 11 devices that frequently disconnect from the corporate network or switch between VPN and direct internet access. Some devices download updates partially but never complete the installation, while others repeatedly report installation failures or remain in a pending state until the next scan cycle.

  • How can I troubleshoot Windows Update client logs, Delivery Optimization settings, and update policy configurations to determine whether these failures are caused by interrupted downloads, connectivity timeouts, or deployment enforcement issues?
  • What supported configuration changes can help devices resume downloads, retry failed installations, and complete updates reliably without requiring manual intervention?

Thank you so much!

Windows for business | Windows Client for IT Pros | Devices and deployment | Install Windows updates, features, or roles
0 comments

4 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-10-21T05:27:12.4433333+00:00

    Use a structured check across policy, connectivity, and download behavior.

    1. Verify which update service the device is scanning
      • Check whether the client is scanning Windows Update or WSUS.
      • If WSUS is configured through policy, confirm UseWUServer=1 under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU is intentional.
      • If the device scans WSUS but updates are not approved there, the client can scan successfully and still report that there is nothing to download or install.
    2. Check for policy settings that block installation completion
      • Review Group Policy, MDM, and registry-based Windows Update policies.
      • A key example is NoAutoRebootWithLoggedOnUsers under HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU. If set to 1, updates that require an automatic restart may not complete.
      • Also review Active Hours. Restrictive Active Hours can delay cumulative update installation for days, especially on frequently used devices.
    3. Validate connectivity to update endpoints
      • Ensure devices can consistently reach the required Windows Update endpoints through firewall, proxy, and web filtering.
      • Protocol and endpoint matching matters. If an endpoint requires HTTP, using HTTPS will fail, and vice versa.
      • For WSUS-managed devices, test access to the WSUS URLs for Selfupdate, ClientWebService, and SimpleAuthWebService, and verify the configured WSUS ports are reachable.
    4. Investigate interrupted or incomplete downloads
      • If smaller updates succeed but cumulative or feature updates fail, check whether the proxy supports the Content-Range header and whether antivirus blocks HTTP-range requests.
      • Windows Update uses BITS. If multipart/range downloads are interrupted, the client can repeatedly restart portions of the download and end up with incomplete or unusable installers.
    5. Review Delivery Optimization configuration
      • Delivery Optimization is the HTTP downloader used by most Microsoft content providers.
      • To disable peer-to-peer while still allowing supported downloads, set Delivery Optimization DownloadMode to 0.
      • Do not set DownloadMode to 100 (Bypass). That can cause some content to fail with error 0x80d03002, and it is deprecated starting in Windows 11.
      • DownloadMode 99 should only be used when the device is offline and has no internet access.
    6. Check for transient service-side conditions
      • Errors 0x248001 (WU_S_SEARCH_LOAD_SHEDDING) and 0x8024402d (WU_E_PT_LOAD_SHEDDING) indicate temporary service load or network congestion.
      • These are transient. The expected action is to allow the device to retry later.
    7. Confirm prerequisites that affect expedited quality updates
      • If expedited quality updates are in use, verify that Microsoft Update Health Tools is installed at C:\Program Files\Microsoft Update Health Tools.
    8. Collect logs when failures persist
      • Review Windows Update logs and deployment-related diagnostics.
      • If escalation is needed, collect data by using TSS for deployment-related issues.

    Supported configuration changes that improve reliability:

    • Ensure devices have uninterrupted access to the correct update source: Windows Update or the intended WSUS endpoint.
    • Fix WSUS approval/configuration issues so clients are not left scanning without any approved deployment action.
    • Allow multipart downloads through proxy and security controls by supporting Content-Range and not blocking HTTP-range requests.
    • Avoid Delivery Optimization DownloadMode=100; use 0 if peer-to-peer must be disabled.
    • Adjust restart-related policies so required reboots can occur.
    • Review Active Hours so devices have a realistic maintenance window to install and restart.
    • For bandwidth optimization rather than disabling downloads, use Delivery Optimization peer sharing, Microsoft Connected Cache, or Delivery Optimization throttling policies.
    • If devices are unhealthy, address low disk space because quality updates require at least 2 GB free, and feature updates require about 8 GB to 15 GB depending on configuration.

    This combination helps devices resume and complete downloads, retry after transient failures, and avoid policy-driven stalls during install and restart phases.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Daphne Huynh (WICLOUD CORPORATION) 2,540 Reputation points Microsoft External Staff Moderator
    2026-10-21T08:10:28.42+00:00

    Welcome to Microsoft Q&A!

    Thank you for providing such a clear description of the environment.

    To narrow this down efficiently, I recommend troubleshooting the issue in three areas: Windows Update processing, Delivery Optimization/network connectivity, and update policy enforcement.

    1. Determine where the update is stopping

    Start by generating the Windows Update log from an elevated PowerShell session:

    Get-WindowsUpdateLog

    Also review:

    Event Viewer > Applications and Services Logs > Microsoft > Windows > WindowsUpdateClient

    These several logs below help distinguish the failure stage:

    • WindowsUpdate.log: Windows Update client activity, including scan and download troubleshooting.
    • C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.etl: useful when an update is available, but the download doesn't start, the download completes but installation doesn't start, or installation completes but the restart isn't triggered.
    • %systemroot%\Logs\CBS\CBS.log: servicing-stack information useful for installation failures.

    The Windows Update log also separates components such as ProtocolTalker for client/server synchronization, DownloadManager for payload downloads, and Handler/Setup for installation. A pause during synchronization can indicate a network problem even when the scan eventually succeeds.

    This provides a useful first distinction: if the update downloads successfully and then fails, investigate installation and servicing; if it fails during scanning or downloading, focus on connectivity and content delivery; if installation finishes but the device remains pending, investigate orchestration and restart behavior.

    2. Check Delivery Optimization and network transitions

    Because these devices regularly move between VPN and direct internet connections, verify the behavior in both states rather than testing connectivity only once.

    The Delivery Optimization Troubleshooter, which can check device configuration, peer-to-peer behavior, and Microsoft Connected Cache connectivity. Useful options include:

    • -HealthCheck for the overall Delivery Optimization configuration
    • -P2P for peer-to-peer settings and errors
    • -MCC for Microsoft Connected Cache
    • -GenerateSupportBundle -ReproduceIssue to collect diagnostics while reproducing the problem

    You can also run:

    Get-DeliveryOptimizationStatus

    Review the reported Delivery Optimization mode and any errors. If peer delivery is being used, also check whether your policies restrict peer caching while the device is connected through VPN.

    If the problem occurs consistently only on VPN, that gives you a much stronger indication to investigate the VPN, proxy, firewall, or Windows Update/Delivery Optimization connectivity path rather than the servicing stack.

    3. Confirm which update policies and update source actually control the device

    For Intune-managed devices, first verify that the assigned Update Ring shows as successfully delivered to the affected device.

    On the Windows device, you can also check:

    Settings > Windows Update > Advanced options > Configured update policies

    For additional verification, review:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Update

    Also, check for Group Policy or previous WSUS configuration under:

    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

    And:

    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

    Running the following can also help identify policies applied through Group Policy:

    gpresult /h gpresult.html

    This check is particularly important for co-managed or previously WSUS-managed devices. Please notes that MDM and Group Policy configurations can conflict, and a device can continue scanning WSUS instead of Windows Update depending on its effective configuration.

    For co-managed devices, also confirm that the Windows Updates workload has been switched to Intune, when Intune is intended to manage it, and make sure another Update Ring, Settings Catalog policy, or Group Policy isn't applying conflicting Windows Update settings.

    4. Review deployment and restart enforcement

    If downloading and installation appear successful but devices remain pending, review the effective policies for deferrals, pauses, automatic update behavior, target release settings, Update Ring deployment, and restart/deadline behavior.

    Also consider whether the affected device simply wasn't connected when the policy was expected to apply. Microsoft notes that when a device has no active network connection, such as when it's powered off or has no service, the policy applies when the device can connect again.

    Rather than repeatedly forcing scans or resetting Windows Update components, I would first identify which stage is failing and then correct the relevant connectivity, Delivery Optimization, or policy configuration.

    Recommended order for one affected device

    To avoid changing multiple settings at once, I suggest testing one representative device and collecting the following:

    • Confirm whether it is using Windows Update/WUfB or WSUS.
    • Confirm the effective Intune and Group Policy settings.
    • Generate WindowsUpdate.log and review the WindowsUpdateClient events.
    • If the failure occurs during download, compare the behavior on VPN versus direct internet and run the Delivery Optimization diagnostics.
    • If the download completes but installation fails, review CBS.log.
    • If installation completes but the device remains pending, review UpdateSessionOrchestration.etl and the effective restart/deployment configuration.

    Following this sequence should help determine whether the root cause is interrupted connectivity/content delivery, a servicing failure, or an update-policy conflict before making configuration changes.

    Note: Windows 10 reached end of standard support on October 14, 2025. For Windows 10 systems still in the fleet, verify that the particular edition/version has the appropriate servicing path, including ESU where applicable.

    Hope this helps.

    References: Windows Update log files | Microsoft Learn

    Troubleshoot Update ring policies for Windows devices - Intune | Microsoft Learn

    Troubleshoot Delivery Optimization | Microsoft Learn

    If you find it useful, please click Accept Answer.

    Thank you for choosing Microsoft Q&A.

    Was this answer helpful?

    0 comments
  3. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  4. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.