Windows Update error codes for Intune admins: 0x8024, 0x800F081F and servicing failures

When a quality update fails on an Intune-managed PC, the evidence is usually a bare hex code: an install error in Settings, an Error state in the Intune report, or an HRESULT in CBS.log. This reference lists the Windows Update codes Microsoft documents (agent 0x8024… codes, network and download errors, and servicing failures such as 0x800F081F, 0x800F0922 and 0x80073712) with the meaning, the usual cause on a Windows Update for Business device and the first check. Feature update failures such as 0xC1900101 have their own upgrade error code reference.

How to read these codes#

The most precise evidence is always on the device:

• On the device. Settings › Windows Update lists the failed update with a download or install error and the code; Advanced options › Configured update policies shows which policies the device actually received, from Intune or Group Policy.
• In Intune. The device reports under Reports › Windows updates show Update State, Update Substate, an aggregated status such as Error, and an Alert Type with the latest alert. Client-side data needs data collection configured and refreshes about every eight hours (Reports for Windows feature update policies); for empty reports see Windows update reports not showing data.
• In the logs. Scan and download codes land in WindowsUpdate.log (built on demand with Get-WindowsUpdateLog) and in Applications and Services Logs › Microsoft › Windows › WindowsUpdateClient › Operational. Install failures carry their real cause in %windir%\Logs\CBS\CBS.log; DISM repairs also log to CBS.log and %windir%\Logs\DISM\dism.log.

The prefix names the component. 0x8024xxxx are Windows Update Agent codes (WU_E_): 0x80244xxx is the protocol layer (HTTP and SOAP), 0x80246xxx the download manager, 0x80242xxx the update handler, 0x80248xxx the local data store and 0x8024Cxxx drivers. 0x800Fxxxx come from the servicing stack (CBS_E_, PSFX_E_), 0x8007xxxx wrap a Win32 error in the last four digits, 0x80072Exx and 0x80072Fxx are WinINet network errors, 0x8020xxxx is BITS and 0x80D0xxxx Delivery Optimization. Codes starting 0x0024 are success codes, such as 0x00240005 (WU_S_REBOOT_REQUIRED: restart to finish).

Get-WindowsUpdateLog    # writes WindowsUpdate.log to the desktop
Select-String -Path "$env:windir\Logs\CBS\CBS.log" -Pattern ', Error' -SimpleMatch | Select-Object -Last 20
[ComponentModel.Win32Exception]::new(0x422).Message    # Win32 text for 0x80070422

Scan and connectivity codes#

Intune-managed devices scan Microsoft Update directly over WinHTTP, so a proxy that works in the browser can still block the scan.

Policy and service configuration codes#

These usually mean something other than your update ring is in control: leftover WSUS or hardening Group Policy, or a disabled service. Check HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate (and \AU) and a gpresult /h report.

Download codes#

Windows Update downloads with Delivery Optimization or BITS and keeps its local cache under %windir%\SoftwareDistribution. A generic download code is rarely the root cause; look for the network code just before it in WindowsUpdate.log.

To reset the cache, stop wuauserv, bits and cryptsvc, rename SoftwareDistribution\DataStore, SoftwareDistribution\Download and System32\catroot2 to *.bak, then start the services again.

Install, restart and update handler codes#

Servicing stack and component store codes#

These come from CBS, the servicing stack that applies the update; find the first , Error line in CBS.log at the failure time. For corruption, Microsoft's standard repair is:

DISM.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannow
REM No Windows Update access: repair from a matching Windows installation
DISM.exe /Online /Cleanup-Image /RestoreHealth /Source:\\server\c$\windows /LimitAccess

RestoreHealth pulls repair files from Windows Update; a /Source must run the same Windows version.

Component store corruption#

Servicing timeouts and failed installers#

Files, permissions and signatures#

How to verify a fix#

1. After a repair, run DISM /Online /Cleanup-Image /ScanHealth and confirm CBS.log shows no new errors.
2. Restart, then select Check for updates in Settings › Windows Update. The update should download, install and finish its restart without the error.
3. Confirm the build and the event log:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
    Select-Object DisplayVersion, CurrentBuild, UBR
Get-WinEvent -LogName 'Microsoft-Windows-WindowsUpdateClient/Operational' -MaxEvents 20 |
    Select-Object TimeCreated, Id, Message

Compare the build and UBR with the release's update history. In Intune, the device should leave Error in Reports › Windows updates after the next client data refresh. If a servicing code returns after a successful repair, look outside the store: permissions, filter drivers or a pending operation.

References#

• Windows Update error codes by component (Microsoft Learn): WU_E names and descriptions
• Windows Update common errors and mitigation (Microsoft Learn): causes and mitigations
• Fix Windows Update corruptions and installation failures (Microsoft Learn): corruption codes and DISM repair