How to fix "Windows couldn't complete the requested changes" error 0x800f0907?

Error 0x800F0907 appears when you turn on .NET Framework 3.5 and a Group Policy setting forbids Windows to download its files from Windows Update. Nothing is broken: Windows is obeying a rule. Untick Never attempt to download payload from Windows Update in Group Policy (Fix 1), or install from a Windows ISO (Fix 2).

Facts checked on 16 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What "Windows couldn't complete the requested changes" error 0x800F0907 means

In Windows 10 and Windows 11, .NET Framework 3.5 is a Feature on Demand. Windows keeps only its description on disk. The real files are downloaded from Windows Update at the moment you turn the feature on. Error 0x800F0907 means Windows was not allowed to make that download, because a policy says so.

In the Windows Features window you see the heading Windows couldn't complete the requested changes. with Microsoft's longer text under it. In Command Prompt, DISM shows the same reason with its own wording. Microsoft lists both:

Windows couldn't complete the requested changes.
Because of network policy settings, Windows couldn't connect to the Internet to download files that are required to complete the requested changes. Contact your network administrator for more information.
Error code: 0x800F0907

DISM failed. No operation was performed.
For more information, review the log file.
The DISM log file can be found at C:\Windows\Logs\DISM\dism.log

Why Windows is not allowed to download the files

Microsoft says the code appears when two things are true at once: the policy is set to Never attempt to download payload from Windows Update, and no alternate source is given, or the one given is wrong. Remove either condition and the feature installs.

The old advice for this code was to update the .NET Framework from the Microsoft Update Catalog or to run the .NET Framework Repair Tool. Neither helps here: the catalog has no package that turns on the 3.5 feature, and the Repair Tool repairs the installed .NET 4.x, not a blocked download.

How to fix error 0x800F0907

Fix 1 removes the rule on your own PC. Fix 2 works on every edition because it gives Windows the files from a Windows ISO and never asks Windows Update. The rest are for the cases in the table above.

Fix 1. Untick "Never attempt to download payload from Windows Update" in Group Policy

5 minutesLow riskYour own PC with Windows 10 or 11 Pro, Enterprise or Education.

Microsoft names this ticked box, with no alternate source, as the cause of 0x800F0907. Once it is clear, Windows may fetch the .NET 3.5 files from Windows Update again.

1. Open the Run box. Press Windows key + R.
2. Start the editor. Type the command below and select OK. Select Yes if Windows asks for permission.

   gpedit.msc

These steps were written for Windows 11 and Windows 10, Pro, Enterprise and Education (the steps are the same). The full page with the other versions and what each result means: Open the Local Group Policy Editor

1. Go to Computer Configuration > Administrative Templates > System.
2. Double-click Specify settings for optional component installation and component repair.
3. If it is Enabled, untick Never attempt to download payload from Windows Update. If nothing else in the window is filled in, you can set the whole policy to Not Configured instead.
4. If the PC once used a company update server, also tick Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS).
5. Select Apply and OK.
6. Open Terminal (Admin) and apply the policy at once:

   gpupdate /force

7. Open Windows Features again, tick .NET Framework 3.5 (includes .NET 2.0 and 3.0) and select OK. Choose Let Windows Update download the files for you.

Fix 2. Install .NET Framework 3.5 from a Windows ISO with DISM

20 minutesNo riskAny edition, Home included, or any PC where you cannot change the policy.

Microsoft's command uses a local source with /LimitAccess, which tells DISM not to contact Windows Update at all. The policy only blocks the download, so it has nothing left to block.

1. Check your version with Win + R, winver, OK. The ISO must be the same Windows version, edition family and language.
2. On another tab, get the ISO from Microsoft's Download Windows 11 or Download Windows 10 page. In the Media Creation Tool choose ISO file.
3. Right-click the ISO in File Explorer and select Mount. Note the new drive letter, for example D:.
4. Open the drive and check that the folder sources\sxs exists.
5. Open Terminal (Admin) and run, with your drive letter:

   Dism /online /enable-feature /featurename:NetFx3 /All /Source:D:\sources\sxs /LimitAccess

6. Wait for The operation completed successfully. and restart if DISM asks.
7. Right-click the drive in File Explorer and select Eject.

Fix 3. Point the policy at the ISO's sources\sxs folder

10 minutesLow riskPro or higher, where Windows Features or a setup program must work too, or the policy already holds an old path.

This is Microsoft's own resolution for Windows 10: keep the policy, but tell Windows where a valid copy of the files is. Every later request for the feature, from any program, then uses that folder.

1. Mount the matching Windows ISO as in Fix 2, or copy its sources\sxs folder to C:\sxs.
2. Open the policy Specify settings for optional component installation and component repair as in Fix 1 and select Enabled.
3. In Alternate source file path, type the full path, for example D:\sources\sxs or C:\sxs. Delete any old path that no longer exists.
4. Select OK and run gpupdate /force in Terminal (Admin).
5. Turn on .NET Framework 3.5 in Windows Features again.

A path on a mounted ISO only works while the ISO is mounted. A copied C:\sxs folder keeps working. When you no longer need it, set the path back to empty.

Fix 4. Check the Servicing policy key in the registry on Windows Home

10 minutesRead the warningWindows Home, where gpedit.msc does not open, and you want the normal Windows Features route back.

Group Policy stores this setting under the Servicing policy key. Users on Microsoft Q&A report the values LocalSourcePath, RepairContentServerSource and UseWindowsUpdate there. We could not find a Microsoft page that documents each value, so this fix only removes the key after a backup.

1. Open Terminal (Admin) and check whether the key exists:

   reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Servicing

2. If Windows says it was unable to find the key, no such policy is set. Skip to Fix 6.
3. If it lists values, export the key to your desktop:

   reg export HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Servicing "%USERPROFILE%\Desktop\servicing-backup.reg"

4. Delete the key:

   reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Servicing /f

5. Restart the PC and turn on .NET Framework 3.5 in Windows Features again.

Fix 5. Work or school PC: ask IT to allow the download or give a source

5 minutes to write the requestNo riskThe PC belongs to an organization, joins a domain, or Settings shows Some of these settings are managed by your organization.

Here the rule comes from the domain policy, and Microsoft says the local change is not yours to make. It is undone at the next policy refresh, so only the administrator can change it for good.

1. Write to IT with the error text, 0x800F0907 CBS_E_GROUPPOLICY_DISALLOWED, and the feature name NetFx3.
2. Ask them to review Specify settings for optional component installation and component repair for your PC.
3. Microsoft offers them two options: allow Download repair content and optional features directly from Windows Update instead of WSUS, or set an Alternate source file path to a share with the sources\sxs files, such as \\server_name\share\Win8sxs.
4. If your account is a local administrator and the rules allow it, try Fix 2 while you wait: it works without changing the policy.

Fix 6. Repair the component store with DISM and SFC

15 to 40 minutesNo riskThe policy is clear or a source is set, and the install still fails with another code.

The same policy also controls where Windows gets files for component repair. Only after Fix 1 to Fix 4 can DISM fetch what it needs. A damaged store makes every feature install fail.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.

   

2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

   

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

   

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

   

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

Fix 7. Reinstall Windows over itself and keep your apps and files

1 to 2 hoursLow riskNothing above helped and other updates or features fail too.

A repair reinstall puts a fresh copy of the same Windows version over the old one, with a new component store. Apps, files and settings stay. It does not remove a domain policy.

1. Open Recovery in Settings. Open Settings > System > Recovery. Next to Fix problems using Windows Update, select Reinstall now. This keeps your apps, files and settings.

   

2. Start the reinstall. Choose whether the PC may restart on its own 15 minutes after the installation, then select OK.
3. Wait and restart. Windows Update downloads and installs a repair copy of your current Windows version. Keep the PC plugged in and online, and restart it when asked.

These steps were written for Windows 11 22H2 and later. The full page with the other versions and what each result means: Reinstall Windows without losing files

If error 0x800F0907 is still there

The message itself names the log: C:\Windows\Logs\DISM\dism.log. The last lines belong to your last attempt and show whether Windows tried Windows Update, a source folder, or nothing.

1. Press Win + R, type notepad C:\Windows\Logs\DISM\dism.log and select OK.
2. Press Ctrl + End to jump to the end.
3. Press Ctrl + F and search upward for 0x800f0907 or NetFx3.
4. If the lines mention policy or Windows Update, the rule is still active: check Fix 1 and Fix 4 again.
5. For more detail, open C:\Windows\Logs\CBS\CBS.log the same way and search for the same time.

For support, send the full message, your edition and build from winver, whether the PC is managed by an organization, and the last lines of dism.log. 0x800F0907 is never a hardware fault. It can be a licence or ownership limit: on a managed PC only the administrator decides.

How to keep error 0x800F0907 from coming back

• Leave Specify settings for optional component installation and component repair at Not Configured on a home PC unless you need a local source.
• Do not run tweak scripts that change update or servicing policies without reading what they change.
• If you set an alternate source, keep it on the PC (C:\sxs) and replace it after each Windows version upgrade, since the files must match the build.
• Before an upgrade to a new Windows version, note which optional features you use; turn them on again after it, while the PC is online.
• Ask app makers for versions that do not need .NET 3.5. Microsoft says .NET Framework 3.5 reaches the end of support on 9 January 2029.

Frequently asked questions

What does error 0x800F0907 mean?

It means Windows was not allowed to download the files for a feature you turned on, usually .NET Framework 3.5. Microsoft calls it CBS_E_GROUPPOLICY_DISALLOWED. The policy Specify settings for optional component installation and component repair is set to Never attempt to download payload from Windows Update, and no other source is given. The message says Because of network policy settings, which is why the internet connection is not the problem. Untick the box (Fix 1) or install from a Windows ISO (Fix 2).

How do I fix 0x800F0907 on Windows 11?

The same way as on Windows 10. On Windows 11 Pro, open gpedit.msc, go to Computer Configuration > Administrative Templates > System, open Specify settings for optional component installation and component repair and untick Never attempt to download payload from Windows Update. Run gpupdate /force and turn .NET 3.5 on again. On Windows 11 Home, mount a Windows 11 ISO of the same version and run the DISM command in Fix 2. Both routes work on 25H2 and 26H2.

Is error 907 the same as 0x800F0907?

Not always. People shorten 0x800F0907 to error 907, but Google Play Store on Android also shows its own error 907 when an app download fails. If you saw the code on a Windows PC while turning on a feature, it is 0x800F0907 and this page applies. If you saw it on a phone in the Play Store, it is a different problem on another system, and this guide does not cover it.

Why does it say "Contact your network administrator" on my home PC?

Microsoft wrote the message for company networks, where an administrator sets update policies for every PC. On a home PC with a personal account, you are the administrator, and the policy is on this PC. Someone set it earlier: a previous owner, a tweak tool, or you while fixing something else. Fix 1 removes it on Pro, and Fix 4 checks the registry on Home.

Can I fix 0x800F0907 without Group Policy on Windows Home?

Yes. Windows Home has no Local Group Policy Editor, but Fix 2 does not need it. Mount a Windows ISO of the same version and run DISM with /Source pointing at the ISO's sources\sxs folder and /LimitAccess, so Windows never asks Windows Update. If you want Windows Features to work normally again, Fix 4 shows how to check and remove the Servicing policy key after a backup.

Does turning off my antivirus fix 0x800F0907?

No. The error comes from a Windows policy, not from a blocked connection, so the antivirus is not involved. Microsoft's description of 0x800F0907 names only the Group Policy setting and the missing alternate source. Pausing protection changes nothing here and leaves the PC open for no reason. Leave it on and use Fix 1 or Fix 2, which remove the actual cause in a few minutes.

Will Windows Update or the Update Catalog fix this error?

Not by itself. The .NET Framework 3.5 feature is not offered as a normal update in Windows Update or the Microsoft Update Catalog, so there is nothing to download there that turns it on. Installing waiting updates is still worth doing before Fix 2, because the ISO must match your Windows version. The error itself only goes away when the policy allows the download or Windows gets a local source.

I get 0x800F080C or 0x800F0906 instead. Is that the same problem?

Close, but different. 0x800F0906 means the download was allowed but failed. That is often the network or a company update server. 0x800F081F means the source you gave does not hold the right files. 0x800F080C means Windows does not know the feature name. On Windows 11 build 28000 and later, .NET 3.5 is no longer a Windows feature at all. For that case see our guide to error 0x800f080c.

Is it safe to untick "Never attempt to download payload from Windows Update"?

Yes, on your own PC. The box only decides whether Windows may fetch files for optional features and component repair from Microsoft's servers. Clearing it is the default state of Windows. On a company PC, ask IT first, because the setting may be there on purpose to keep downloads on the company's update server.