How to fix KB5007651 fails to install on Windows?

KB5007651 is not a Windows patch but the update for the Windows Security app and its service, and Microsoft offers it to Windows 11 only. It reuses one KB number for every new version. Restart, check which version you already have, and if it still fails, install the newest package by hand from the Microsoft Update Catalog.

Facts checked on 15 October 2026. Steps written for Windows 11 (24H2, 25H2 and 26H2).

What Windows update KB5007651 is

Microsoft's page calls KB5007651 the Windows Security app update. It installs the latest Windows Security app and the service under it, and it applies only to Windows 11 devices, build 22000 or later. Windows Update lists it as Update for Windows Security platform with the version in brackets.

Why KB5007651 fails to install or keeps reinstalling

Microsoft lists no known issue for this update, so the causes below come from how the package installs and from what users report. They are ordered from the most likely to the rarest.

KB5007651 known issues and problems

Microsoft's KB5007651 page has no known issues section. The problems people search for are install problems, and they fall into two groups.

• It fails to install. The usual code is 0x80070643. Fix 1 and Fix 2 solve most cases.
• It keeps installing again (a loop). Users on Microsoft's community forum report that the same version shows as ready to download again and again, and that it is missing from the list of updates you can uninstall. Fix 1 and Fix 5 cover it.
• Microsoft's page lags. On 15 October 2026 Microsoft's article still named version 10.0.27840.1000, while the Update Catalog already listed 10.0.29628.1000. Trust the catalog for the newest version.

How to check which KB5007651 version is installed

Microsoft gives one PowerShell command for this. Run it before any repair, because it shows whether there is anything to fix.

1. Right-click Start and select Terminal.
2. Type Get-AppPackage Microsoft.SecHealthUI and press Enter.
3. Read the Version line. Microsoft's example: app version 1000.27840.0.1000 belongs to platform version 10.0.27840.1000.
4. Open Settings > Windows Update and compare it with the version in brackets after KB5007651.
5. Open Settings > Windows Update > Update history, expand Definition updates and note the date and code of the failed try.

PowerShell

Get-AppPackage Microsoft.SecHealthUI | Select-Object Name, Version

How to fix KB5007651 not installing

Fix 1 and Fix 2 are specific to this update and solve most cases. Fix 3 repairs the app the update installs. Fix 4 to Fix 7 repair Windows Update and Windows itself and are worth the time only when other updates fail too.

Fix 1. Restart and check whether KB5007651 is already installed

5 minutesNo riskEveryone, first. Above all when KB5007651 won't install, or comes back after it installed.

The Windows Security platform update replaces files of a running service, and some of them change only after a restart. Windows Update can then list a version as missing that is already in place.

1. Save your work and select Start > Power > Restart. Use Restart, not Shut down.
2. Right-click Start, select Terminal, type Get-AppPackage Microsoft.SecHealthUI and press Enter.
3. Note the middle number of the Version line, for example 29628.
4. Open Settings > Windows Update and select Check for updates.
5. If the offered KB5007651 has the same number in brackets, it is installed: select Retry once, then leave it.
6. If the offered version is newer, select Retry or Download & install and restart when asked.

Fix 2. Install the newest KB5007651 package by hand from the Microsoft Update Catalog

10 minutesLow riskKB5007651 keeps failing with 0x80070643 or another code in Windows Update.

Microsoft offers the same package as a separate download and asks you to run it as administrator. Running it yourself skips the copy that Windows Update keeps failing on.

1. Open the Microsoft Update Catalog and search for KB5007651.
2. Select the Last Updated column so the newest version is on top. On 15 October 2026 that was version 10.0.29628.1000, 44.0 MB.
3. Select Download on that row and download the securityhealthsetup file it lists.
4. If two files are listed, take the one for your processor. Settings > System > About > System type says x64-based or ARM-based.
5. Right-click the downloaded file and select Run as administrator, then Yes in User Account Control.
6. Wait until the setup closes, then restart the PC.
7. Run Get-AppPackage Microsoft.SecHealthUI again and check that the version changed.

Fix 3. Repair or reset the Windows Security app

5 minutesLow riskWindows Security opens blank, closes at once, or the manual setup in Fix 2 fails.

KB5007651 updates an app package. When that package is damaged, the update has nothing sound to install over, so it fails every time.

Windows Security is listed under Installed apps like other apps. Repair keeps its settings; Reset returns it to its first state.

1. Open Installed apps. Select Start > Settings > Apps > Installed apps.
2. Open the app's advanced options. Find the app in the list, select the three dots next to it and select Advanced options. Some apps do not have this option: for those, see the section about desktop programs below.

   

3. Repair first. On the page that opens, select Repair if it is there. The app's data stays. Open the app and check whether it works.

   

4. Reset if Repair did not help. Select Reset. This deletes the app's data on this PC, including sign-in details and settings. Open the app and set it up again.

These steps were written for Windows 11 25H2 and 26H2. The full page with the other versions and what each result means: How to repair or reset an app in Windows

If Windows Security does not show Advanced options, reset it from PowerShell. Right-click Start, select Terminal (Admin) and run:

Terminal (Admin)

Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage

Fix 4. Reset Windows Update components

10 minutesLow riskKB5007651 stays at Downloading or Pending install, or other updates fail too.

A damaged download in the update cache makes every Retry use the same broken copy. The reset stops the update services and gives Windows Update an empty cache.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

   

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

   

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

   

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

Fix 5. Stop the KB5007651 reinstall loop

10 minutesRead the warningKB5007651 installs successfully and is offered again after a restart, with the same version.

Microsoft has not explained the loop. Users on Microsoft's community forum report that it follows a third-party antivirus update and ends after a fresh Defender update with the vulnerable driver blocklist briefly off. We could not confirm this with Microsoft.

1. If you use a third-party antivirus, restart the PC once after it has updated itself.
2. Open Windows Security > Device security and select Core isolation details.
3. Turn Microsoft Vulnerable Driver Blocklist off and select Yes.
4. Open Settings > Windows Update, select Check for updates and install the Defender updates offered.
5. Go back to Core isolation details and turn Microsoft Vulnerable Driver Blocklist on again.
6. Restart the PC and check for updates once more.

Fix 6. Repair system files with DISM and SFC

15 to 30 minutesLow riskSeveral updates fail, or Fix 3 reported an error.

The Windows Security service is part of Windows. If its system files are damaged, no package can update it until DISM and SFC replace them.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.

   

2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

   

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

   

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

   

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

Fix 7. Reinstall Windows 11 over itself and keep your files

1 to 2 hoursRead the warningEvery fix above failed and other updates fail as well.

A repair reinstall replaces every Windows file, the Windows Security platform included, and keeps your files and apps. A user on Microsoft's forum reports that Microsoft Support used it for a KB5007651 loop.

1. Open Recovery in Settings. Open Settings > System > Recovery. Next to Fix problems using Windows Update, select Reinstall now. This keeps your apps, files and settings.

   

2. Start the reinstall. Choose whether the PC may restart on its own 15 minutes after the installation, then select OK.
3. Wait and restart. Windows Update downloads and installs a repair copy of your current Windows version. Keep the PC plugged in and online, and restart it when asked.
4. If that did not help: Reset PC. Back in Settings > System > Recovery, next to Reset this PC, select Reset PC. This keeps your personal files but removes installed apps and settings.
5. Choose Keep my files. Select Keep my files. Do not select Remove everything.

   

6. Choose where Windows comes from. Select Cloud download to download a fresh copy of Windows, or Local reinstall to use the files already on the PC (faster, but may not include the latest updates).
7. Reset. Review the summary and select Reset. The PC restarts several times.

These steps were written for Windows 11 22H2 and later. The full page with the other versions and what each result means: Reinstall Windows without losing files

If KB5007651 still fails

Your PC is not left without protection. KB5007651 updates the Windows Security app; Microsoft Defender Antivirus gets its own engine and definition updates separately, and Windows security patches come in the monthly cumulative update.

• What to send to support: the offered version, the installed version from Get-AppPackage Microsoft.SecHealthUI, the code and date from Update history and the fixes you already ran.
• Say which antivirus is installed and whether Memory integrity and Microsoft Vulnerable Driver Blocklist are on.

How to keep KB5007651 from failing again

Frequently asked questions

What is KB5007651?

KB5007651 is Microsoft's Windows Security app update. It installs the newest Windows Security app and the service under it on Windows 11. Windows Update lists it as Update for Windows Security platform with a version in brackets, for example 10.0.29628.1000. Microsoft classes it as a Definition Update in the Microsoft Security platform category. It is not a monthly security patch and not a cumulative update, and the same KB number is reused for every new version.

Is KB5007651 safe to install?

Yes. It comes from Microsoft through Windows Update or the Microsoft Update Catalog, and it only updates the Windows Security app and its service. Microsoft's page lists no known issues. The problems people report are install failures and a loop where it is offered again, not damage after it installed. Download it by hand only from Microsoft's own sites.

What does error 0x80070643 mean for KB5007651?

0x80070643 is the general Windows code for a fatal error during installation. It says the setup package started and stopped, not why. For KB5007651 it most often means a failed copy in Windows Update or a damaged Windows Security app. Install the package by hand from the Microsoft Update Catalog (Fix 2), and if that fails, repair the app (Fix 3).

Why does KB5007651 keep installing over and over?

Microsoft has not explained the KB5007651 loop. Users report that the same version is offered again after it installed, sometimes after a third-party antivirus updated itself. First check the installed version with Get-AppPackage Microsoft.SecHealthUI (Fix 1). If it already matches, the offer is stale: try Fix 5, or pause updates for a week until the next release replaces it.

Can I uninstall KB5007651?

Usually not from Installed updates. Users report that KB5007651 does not appear in the list of updates you can uninstall, because it updates an app package, not Windows itself. To start over, repair or reset the Windows Security app (Fix 3) and then install the newest package by hand (Fix 2). Do not remove Windows Security itself.

Where can I download KB5007651?

Download it from the Microsoft Update Catalog: search for KB5007651, sort by Last Updated and take the newest version. Microsoft's KB5007651 page also links 64-bit and ARM64 setup files, but on 15 October 2026 those links still pointed to the older version 10.0.27840.1000. Run the file as administrator, as Microsoft asks.

Does KB5007651 apply to Windows 10?

No. Microsoft's page says the update applies only to Windows 11 devices, build 22000 or later. If Windows 10 shows an install failure with a similar name, it is a different update, so search for its own KB number. Windows 10 left support on 14 October 2025, and it now gets security updates only through the Extended Security Updates program.

Is my PC unprotected if KB5007651 fails?

No. Microsoft Defender Antivirus keeps working and gets its engine and definition updates separately. Windows security patches come in the monthly cumulative update, which is a different download. A failed KB5007651 means the Windows Security app stays at its older version until the update installs. Fix it when you can, but it is not an emergency.

Which KB5007651 version is the newest?

On 15 October 2026 the Microsoft Update Catalog listed version 10.0.29628.1000 of 30 July 2026 as the newest, 44.0 MB. Earlier versions were 10.0.29554.1001, 10.0.29510.1001, 10.0.29429.1000, 10.0.27840.1000 and 10.0.27703.1006. Windows Update offers only the newest one, so an older failure in Update history needs no fix once a newer version is installed.