How to fix "We couldn't connect to the update service" Windows update error?

"We couldn't connect to the update service" means the Windows Update client could not reach Microsoft's servers, even though web pages usually open fine. A VPN, a leftover update policy, a proxy or DNS problem is the usual block. Restart the PC, check once without the VPN, then look for an update policy.

Facts checked on 16 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What "We couldn't connect to the update service" means

When you select Check for updates, the Windows Update client contacts Microsoft's service, or the company server that a policy names, to ask which updates your PC needs. If that request fails, Settings stops the scan and shows this text:

People search every piece of it. Some type "we couldn't connect to the update service. we'll try again later or you can check now", others the full sentence with "make sure you're connected to the internet". Others paste the version with curly quotes: we couldn’t connect to the update service. we’ll try again later, or you can check now. if it still doesn’t work, make sure that you’re connected to the internet. They are all the same scan failure.

Why Windows Update cannot connect to the update service

The causes are ranked by how often they fit the reports behind this page. Each one points to the fix that removes it.

How to fix "We couldn't connect to the update service"

Fix 1 takes two minutes and clears most cases. Fix 2 finds an update policy, the cause on many former work PCs. Fixes 3 to 5 repair the connection itself. Fixes 6 to 8 are the general Windows Update repairs. Fix 9 installs one update by hand.

Fix 1. Restart the PC and check for updates without the VPN

2 minutesNo riskEveryone, first. Especially when you use a VPN, a proxy app or a filtering app.

A restart finishes pending update actions and starts the update services fresh. A VPN or filtering app may drop the update client's traffic while the browser still works, so one test without it shows whether it is the block.

1. Save your work and restart the PC with Start > Power > Restart, not Shut down.
2. Disconnect any VPN and pause any proxy or filtering app for one test.
3. If you can, switch to another network, for example a phone hotspot.
4. Press Win + I and open Windows Update on Windows 11, or Update & Security > Windows Update on Windows 10.
5. Select Check for updates and wait for the scan to finish.
6. Connect the VPN again when the test is over.

Fix 2. Check for an update policy that points to a company server

5 to 10 minutesRead the warningSettings says Some settings are managed by your organization, the PC was a work laptop, or a tool changed update settings.

A policy can tell Windows Update to ask an intranet WSUS server instead of Microsoft. When that server is gone or unreachable, the scan fails with exactly this message, as a Microsoft support engineer's log shows.

1. Press Win + S, type cmd, right-click Command Prompt and select Run as administrator.
2. Type reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /s and press Enter.
3. Look for WUServer with a server address, and under the AU subkey for UseWUServer with 0x1.
4. If Windows says it was unable to find the key, no update policy is set. Go to Fix 3.
5. Type gpresult /r and press Enter. Domain policies under Computer Settings mean the PC is still managed.
6. On a PC you own that no company manages, back up the key, then run the reg delete commands below.
7. Restart the PC and select Check for updates again.

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /s
gpresult /r

rem Only on your own PC, after the backup:
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUServer /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUStatusServer /f
net stop wuauserv
net start wuauserv

On Windows Pro you can set the same policies to Not Configured in Open the Local Group Policy Editor under Computer Configuration > Administrative Templates > Windows Components > Windows Update. The policy is Specify intranet Microsoft update service location.

Fix 3. Reset the WinHTTP proxy and the network cache

5 minutes plus a restartLow riskNo policy is set, and web pages open while Windows Update fails. Also after removing a VPN or proxy app.

The update client does not use the browser's connection settings but its own WinHTTP proxy and the Windows network stack. A leftover proxy entry or a broken Winsock catalog cuts off only the update client.

1. Open Command Prompt as administrator.
2. Type netsh winhttp show proxy and press Enter. Direct access (no proxy server) is the normal answer on a home PC.
3. If a proxy server is listed and you do not use one, type netsh winhttp reset proxy and press Enter.
4. Type ipconfig /flushdns and press Enter, then netsh winsock reset and press Enter.
5. Restart the PC and select Check for updates.

netsh winhttp show proxy
netsh winhttp reset proxy
ipconfig /flushdns
netsh winsock reset

The full network reset, including Network reset in Settings, is here: Reset the network and flush DNS. Note your Wi-Fi password and VPN settings first, because the full reset removes them.

Fix 4. Switch to another DNS server

5 minutesLow riskThe error appears on one network only, or your provider's DNS is slow or filtered.

The update client must turn Microsoft's server names into addresses. If the DNS server of your network fails or filters those names, the scan cannot connect while cached web pages still load.

1. Press Win + R, type ncpa.cpl and select OK. The Network Connections window opens on Windows 11 and Windows 10.
2. Right-click your active connection, Ethernet or Wi-Fi, and select Properties.
3. Select Internet Protocol Version 4 (TCP/IPv4) once, then select Properties.
4. Select Use the following DNS server addresses.
5. Type 8.8.8.8 as Preferred DNS server and 8.8.4.4 as Alternate DNS server, the two addresses of Google Public DNS.
6. Select OK twice, then run ipconfig /flushdns in Command Prompt and check for updates.

Fix 5. Correct the date, time and time zone

3 minutesNo riskThe clock on the taskbar is wrong, the CMOS battery is old, or the PC was off for a long time.

Windows Update talks to Microsoft over a secure connection whose certificates are checked against the clock. Microsoft lists wrong date and time settings as a cause of update failures.

1. Select Start > Settings > Time & language > Date & time.
2. Turn on Set time automatically and Set time zone automatically.
3. Under Additional settings, select Sync now.
4. Select Check for updates again.

If the time will not sync: How to fix the date and time in Windows.

Fix 6. Run the Windows Update troubleshooter

5 minutesNo riskThe connection fixes above did not help.

Microsoft puts the troubleshooter first in its own checklist. It checks the update services and their settings, the parts that make the client fail before it can connect.

1. Select Start > Settings > System > Troubleshoot on Windows 11.
2. Select Other troubleshooters.
3. Find Windows Update under Most frequent and select Run. The check runs in the Get Help app.
4. Follow the prompts, restart the PC and select Check for updates.

On Windows 10 the troubleshooter is under Update & Security > Troubleshoot > Additional troubleshooters. Step by step for both systems: Run the Windows Update troubleshooter.

Fix 7. Restart the update services and clear the update cache

10 minutesLow riskThe troubleshooter found nothing, or an update blocking tool turned the services off.

If Windows Update or Background Intelligent Transfer Service is stopped or disabled, the scan cannot start. Renaming SoftwareDistribution and catroot2 also drops a damaged update database.

1. Press Win + R, type services.msc and press Enter.
2. Check that Windows Update and Background Intelligent Transfer Service are not Disabled. Set a disabled one to Manual and select Start.
3. Then reset the update components as described in Reset Windows Update components.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

More on the Services window: Check and restart Windows services.

Fix 8. Repair system files and scan for malware

20 to 30 minutesLow riskEverything above failed, or update settings keep changing back by themselves.

Microsoft's own Windows Update checklist starts with DISM /online /cleanup-image /restorehealth. Damaged update components or malware that blocks updates stop the client before it connects.

Run DISM, then SFC, from Command Prompt as administrator. Step by step: Run DISM and SFC to repair Windows system files.

DISM /online /cleanup-image /restorehealth
sfc /scannow

Then run a Microsoft Defender Offline scan, which restarts the PC and scans before Windows loads: How to scan for malware with Microsoft Defender.

Fix 9. Install the update by hand from the Microsoft Update Catalog

10 to 30 minutesLow riskYou need one update now, for example the latest security update, while the scan still fails.

The Microsoft Update Catalog is a web page your browser can open even when the update client cannot. Installing the package by hand skips the scan that fails.

1. Find the KB number of the update in Microsoft's update history for your Windows version.
2. Open the Microsoft Update Catalog at catalog.update.microsoft.com and search for the KB number.
3. Pick the row for your Windows version and processor, select Download and run the file.
4. Restart the PC when the installer asks.

Full steps, including several files and DISM: Install an update from the Microsoft Update Catalog.

If Windows Update still cannot connect to the update service

The update log shows which address the client tried to reach and the code it got back. That tells you whether a policy, a proxy or the network is the block.

1. Open PowerShell as administrator, type Get-WindowsUpdateLog and press Enter. It writes WindowsUpdate.log to your desktop.
2. Search the file for WSUS server. An intranet address there means a policy is still set: go back to Fix 2.
3. Search for WinHttp and failed. A line like SendRequestToServerForFileInformation failed with 0x80072efe means the connection was cut on the way.
4. Note the server address in the lines before the failure, for example sls.update.microsoft.com, and check that your firewall or router allows it.

Windows 10 left support on 14 October 2025. A Windows 10 PC without Extended Security Updates no longer gets regular security updates, so a working scan may simply find little to install.

How to keep Windows Update connected

• Remove update blocking tools instead of letting them change policies and services.
• When you leave a job and keep the laptop, ask IT to remove it from management, or reset Windows so no company policy stays behind.
• Allow Windows Update in your VPN, firewall or filtering app.
• Keep Set time automatically on.
• Do not put Microsoft update addresses into the hosts file or a DNS block list.

Frequently asked questions

Why does Windows say it couldn't connect to the update service when my internet works?

Because the browser and the update client use different routes. The Windows Update client uses its own WinHTTP proxy setting, the system DNS and, on many PCs, an update policy that names a server. A VPN, a leftover proxy entry or a policy pointing to a company WSUS server blocks only the update client. Web pages keep opening, so the PC looks online. Fix 1 tests the VPN, Fix 2 finds a policy and Fix 3 resets the proxy.

What does "We'll try again later" mean in the message?

The full text is "We couldn't connect to the update service. We'll try again later, or you can check now." It means Windows will run the scan again on its own schedule. Waiting helps only when the problem is on Microsoft's side, such as a short outage. If the message comes back after a restart and on another day, something on your PC or network blocks the update client, and waiting will not fix it. Start with Fix 1.

How do I fix Windows Update "We couldn't connect to the update service" on Windows 11?

The steps are the same as on Windows 10, only the Settings paths differ. Restart the PC and check for updates without a VPN. Then run the reg query from Fix 2 to look for an update policy, reset the WinHTTP proxy and DNS cache, and correct the clock. On Windows 11 the troubleshooter is at Settings > System > Troubleshoot > Other troubleshooters and runs in the Get Help app.

What does "Some settings are managed by your organization" have to do with it?

That line means at least one policy is set on the PC. When the policy is an intranet update server, Windows asks that server instead of Microsoft. If the server no longer exists, for example on a former work laptop, every scan fails with this message. Check the policy with reg query in Fix 2. On a PC you own, back up the key and remove the WSUS values. On a work PC, ask IT.

Is Microsoft's update service down?

Sometimes, but rarely for long. Microsoft has had outages that showed this message to many users at once, and it fixed them on its side. If the message appeared for you and for other people on the same day, wait an hour and select Check for updates again. If only your PC has it, or it has lasted for days, the cause is on your PC or network.

Can a VPN or antivirus cause this error?

A VPN can, and it is one of the most common causes. Some VPNs and filtering apps route or drop traffic to Microsoft's update addresses. Disconnect the VPN for one test, as in Fix 1, and add an exception if that helps. Do not turn off your antivirus for good. If you suspect it, pause protection for one test only and turn it back on: Turn off Microsoft Defender protection for a moment.

Does changing the DNS server fix it?

It fixes the cases where your network's DNS fails or filters Microsoft's update addresses. The old advice to use Google Public DNS still works, but the addresses are 8.8.8.8 and 8.8.4.4, not 8.8.8.9 as some pages say. Change DNS after the policy and proxy checks, because it does not help when a policy or VPN is the block. You can switch back to automatic at any time.

Will resetting Windows Update delete my files?

No. Resetting the update components stops the update services and renames the SoftwareDistribution and catroot2 folders. Your documents, apps and settings stay. Windows only forgets the update history it cached and downloads what it needs again. The update history list in Settings may look shorter afterwards. Fix 7 links the full steps.

Is there an error code for this message?

Not on screen. The Settings page shows only the text. The code is in the update log: run Get-WindowsUpdateLog in PowerShell as administrator and search WindowsUpdate.log for failed. A WinHttp error such as 0x80072efe means the connection was ended on the way. A related code, 0x80240438, means there is no route to the update endpoint at all and has its own guide.