How to fix KB5060533 fails to install in Windows 10?

KB5060533 is the security update of 10 June 2025 for Windows 10 version 22H2, and some PCs could not install it. Microsoft now marks it as expired, and every later Windows 10 update contains it. Restart the PC and install the newest update Windows Update offers first.

Facts checked on 15 October 2026. Steps written for Windows 10 22H2.

What Windows 10 update KB5060533 is

KB5060533 is the monthly security update that Microsoft released on 10 June 2025 for Windows 10. It moves Windows 10 22H2 to OS build 19045.5965 and Enterprise LTSC 2021 to 19044.5965. It is a cumulative update combined with a servicing stack update, KB5059504, the part of Windows that installs updates.

Microsoft lists no new features in it, only security fixes for internal Windows functions. Because the update is cumulative, it also carries the May 2025 updates KB5058379, KB5061768, KB5061979 and KB5058481. Microsoft's page now carries the word EXPIRED in its title.

Why KB5060533 fails to install

Microsoft confirmed no install failure for ordinary PCs. Its known issues are a boot failure on Surface Hub v1, blurry Chinese, Japanese and Korean text, and a late delivery on managed PCs. On home PCs the causes are the usual ones for a cumulative update, ordered here by how likely they are.

KB5060533 after the end of Windows 10 support

Support for Windows 10 ended on 14 October 2025. Microsoft's release information lists the end of updates for all 22H2 editions and names a newest update only for Extended Security Updates (ESU). This changes what Fix 1 can install on your PC.

Both newer updates contain KB5060533. A PC without ESU that installs KB5066791 has everything KB5060533 brought, but it gets no security fixes after October 2025. Moving to Windows 11 or joining ESU is the way to keep getting them.

How to check whether KB5060533 is installed and where it failed

Before you repair anything, check what the PC really has. Update history can still show an old failure after a later update installed well, and the build number settles it.

1. Press Win + R, type winver and press Enter. Read the OS build.
2. A build of 19045.5965 or higher means KB5060533 or a newer update is installed. Nothing is missing.
3. Open Settings > Update & Security > Windows Update > View update history and note the date and code of the failed attempt.
4. Press Win + R, type %windir%\Logs\CBS and press Enter. Copy CBS.log to the Desktop and open the copy in Notepad.
5. Press Ctrl + F, search for rollback and read the lines just above the hit at the time of the failure. They name the step that failed.

How to fix KB5060533 failing to install

Fix 1 solves most cases, because the update you need today is not KB5060533 any more. Fix 2 is only for Surface Hub v1. Fix 3 to Fix 5 repair Windows Update, free space and the system files. Fix 6 reinstalls Windows 10 over itself and keeps your files and apps.

Fix 1. Restart and install the newest Windows 10 update instead

10 to 30 minutesNo riskEveryone, first. Above all if KB5060533 still shows as failed in Update history.

Windows Update no longer needs KB5060533 by name. Every later cumulative update for 22H2 includes its content and comes with a newer servicing stack, which is the part that failed most often on old installs.

1. Save your work and select Start > Power > Restart. Use Restart, not Shut down.
2. Open Settings > Update & Security > Windows Update and select Check for updates.
3. Install everything offered. If KB5060533 is still listed as failed, check for updates once more: the newer update replaces it.
4. Restart when Windows asks.
5. Press Win + R, type winver and press Enter, and read the OS build.

If the PC is not enrolled in ESU, the newest update it gets is KB5066791 with build 19045.6456. With ESU it is KB5126657 with build 19045.7807. Either one closes the gap KB5060533 left.

If Windows Update itself fails, you can also download the newest update by hand from the Microsoft Update Catalog. KB5060533 is no longer there, so search for the newer KB number. Step by step: Install an update from the Microsoft Update Catalog.

Fix 2. Install KB5063159 instead on a Surface Hub v1

15 minutesLow riskThe device is a Surface Hub v1, or a Hub fails to start with a Secure Boot Violation after the June 2025 update.

Microsoft confirmed that after KB5060533, Surface Hub v1 devices might fail to start with a Secure Boot error, and its page says not to install KB5060533 on them. The out of band update KB5063159 of 16 June 2025 carries the same fixes and prevents the boot failure.

1. On the Hub, check for updates and install KB5063159 or any newer update offered, not KB5060533.
2. If the Hub is managed, ask the administrator to approve KB5063159 or a newer update and to decline KB5060533 for these devices.
3. Restart the Hub and confirm it starts normally.

Fix 3. Reset the Windows Update components

10 minutesLow riskThe update fails at once at the same percentage, or downloads fail again and again.

A damaged download in the SoftwareDistribution folder is used again at every retry. Stopping the update services and renaming the folder makes Windows download the newest update from scratch. It does not repair the system itself.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

Fix 4. Free space on drive C: with Disk Cleanup

10 minutesLow riskDrive C: is almost full, or the update downloads and then fails during the install.

A cumulative update unpacks into the system drive and needs room to keep the old files until it finishes. Windows Update Cleanup removes older update files that are no longer needed, often the largest item on an old Windows 10 PC.

1. Type Disk Cleanup in the search box on the taskbar and press Enter.
2. Select drive C: and select OK.
3. Select Clean up system files, then select drive C: and OK again.
4. Tick Windows Update Cleanup, Temporary files and Delivery Optimization Files, and select OK.
5. Restart the PC and check for updates again.

More ways to free space: Free up disk space and delete temporary files.

Fix 5. Repair the system files with DISM and SFC

15 to 40 minutesNo riskCBS.log names missing or damaged files, or the earlier fixes did not help.

A cumulative update replaces thousands of system files and fails when the component store it builds on is damaged. DISM downloads clean copies of damaged components, and SFC then repairs the files in use.

1. Open Command Prompt as administrator. Type cmd in the search box on the taskbar, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Run DISM first. Type the command below and press Enter. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

3. Run System File Checker. Type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC.

These steps were written for Windows 10 22H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

Fix 6. Repair Windows 10 with an in-place upgrade that keeps files and apps

1 to 2 hoursLow riskNothing above worked, or DISM could not repair the damage.

Windows 10 Setup puts a clean copy of Windows 10 over the old one and keeps apps, files and settings. It replaces the damaged update files that the smaller repairs could not fix.

1. Back up the files you cannot lose first: Back up your files (Windows Backup, File History, Time Machine).
2. Download the Windows 10 Media Creation Tool from Microsoft's Windows 10 download page and run it. Select Yes when Windows asks for permission.
3. Accept the licence terms, select Upgrade this PC now and select Next.
4. On Choose what to keep, select Keep personal files and apps and select Next.
5. Select Install and keep the PC plugged in and online until it restarts to the desktop.

If KB5060533 still fails

When the repair upgrade did not help, the cause is usually outside the normal update files. Pick your case.

• What to send to support: the exact code, the KB number, the OS build from winver, the date of the failed attempt and CBS.log.
• Whether the PC gets updates from Windows Update or from a company server, and which fixes you already ran.

How to uninstall KB5060533

If the update did install and something broke, first check the known issues above. Removing a security update leaves the PC open to the flaws it closed. If you still want it gone, these are your options.

1. Open Windows Update. Select Start > Settings > Update & Security > Windows Update.
2. Open the update history. Select View update history. Note the KB number and the date of the update you suspect.
3. Open the list of removable updates. Select Uninstall updates.
4. Uninstall the update. Select the update you want to remove in the list, then select Uninstall.

These steps were written for Windows 10 22H2. The full page with the other versions and what each result means: How to uninstall a Windows update

How to keep Windows 10 updates from failing again

Frequently asked questions

Can I still download KB5060533?

No. Microsoft marks the KB5060533 page as expired and says the update is no longer available from the Microsoft Update Catalog. You do not need it by name. Every later cumulative update for Windows 10 22H2 includes its content, so the newest update your PC is offered does the same job. Without ESU that is KB5066791 of 14 October 2025. With ESU it is KB5126657 of 13 October 2026.

Do I need KB5060533 if a newer update installed?

No. Cumulative updates contain all earlier fixes. If winver shows a build of 19045.5965 or higher, everything in KB5060533 is already on your PC. A failed KB5060533 entry in Update history is only a record of the attempt. It does not mean anything is missing, and you can ignore it once a newer update shows as successfully installed.

What are the known KB5060533 issues?

Microsoft lists three. Surface Hub v1 devices might fail to start with a Secure Boot Violation, fixed by KB5063159. Chinese, Japanese and Korean text can look blurry at 100% scaling in Chromium browsers such as Edge and Chrome, which Microsoft traces to the Noto fonts added in March 2025. And managed PCs with deferral policies could get the update late, because its metadata date is 20 June 2025.

Why does Windows say some updates were not installed?

That message only says the install failed, not why. Open View update history to see the error code and the date, then search CBS.log for that time. For KB5060533 Microsoft confirmed no general failure, so the cause is usually on the PC: a damaged download, too little space or damaged system files. Fix 1, Fix 3 and Fix 5 cover these in that order.

What is KB5063159?

KB5063159 is an out of band update that Microsoft released on 16 June 2025 for Windows 10 22H2, with OS build 19045.5968. It includes the fixes and improvements of KB5060533 and prevents the Surface Hub v1 boot failure. Microsoft told Surface Hub v1 users to install it instead of KB5060533. On other PCs, a later monthly update does the same.

Will a PC without ESU still get updates?

Not new ones. Support for Windows 10 ended on 14 October 2025, and Microsoft's release information lists the end of updates for Home, Pro, Enterprise and Education. The last update for a PC outside ESU is KB5066791 with build 19045.6456. It still contains KB5060533. Newer security fixes, such as KB5126657 of 13 October 2026, go only to PCs enrolled in Extended Security Updates.

Does turning off the antivirus or firewall help KB5060533 install?

No source ties security software to this failure, and switching protection off leaves the PC open while it is offline from updates. The old version of this guide suggested it. If you suspect your third party antivirus, pause it for one test install and turn it back on at once: Turn off Microsoft Defender protection for a moment. The firewall does not block Windows Update downloads in a normal setup.

How do I uninstall KB5060533?

Use View update history > Uninstall updates in Settings while it is listed there. Microsoft says wusa.exe /uninstall does not work on this combined package, because it contains the servicing stack update KB5059504, which cannot be removed. Administrators remove the cumulative part with DISM /Online /Remove-Package and the name from DISM /online /get-packages. If newer updates are on top, remove the newest one instead.

Is KB5060533 for Windows 11?

No. KB5060533 applies to Windows 10 version 22H2, all editions, and to Windows 10 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021. Windows 11 got its own June 2025 updates with other KB numbers. If Windows Update offers another number on your PC, follow that one. To see which Windows you have, press Win + R, type winver and read the version and build.