How to fix Windows Update error 0x80096004?

Error 0x80096004 means that Windows downloaded an update, checked its digital signature and could not verify it, so it threw the package away. Most often the stored download is damaged. Clear the Windows Update cache first, then install the same update by hand from the Microsoft Update Catalog.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What Windows Update error 0x80096004 means

Microsoft's list of security and setup error codes (Winerror.h) names 0x80096004 TRUST_E_CERT_SIGNATURE and describes it in one line: "The signature of the certificate cannot be verified." It belongs to the trust checks of Windows, the same family as the 0x800B01 codes.

Every update, Store app and Windows Setup file carries a digital signature. After the download, Windows checks that signature with Cryptographic Services and the signature catalogs in the catroot2 folder. If the certificate inside the package cannot be verified, Windows does not install the file and reports 0x80096004. In other words, a broken or invalid certificate sits in the package Windows has, and the safe answer is to throw that copy away.

Why Windows Update error 0x80096004 appears

A failed signature check means the copy of the file Windows has does not match what was signed, or the signature itself is wrong. From the most likely to the least likely:

How to fix Windows Update error 0x80096004

Fix 1 and Fix 2 solve most cases: a fresh download, or the same update from the Catalog. Fix 3 is for the Windows 11 upgrade with 0x20000 and Fix 4 for the Store. Fixes 5 to 7 cover the rare cases.

Fix 1. Reset the Windows Update components and clear the download cache

10 minutesLow riskEveryone, first. It is the fix for a damaged or half finished download.

Windows keeps the downloaded package in SoftwareDistribution and the signature catalogs in catroot2. Renaming both and restarting Cryptographic Services makes Windows download the update and check its signature again, instead of retrying the same broken copy.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

Fix 2. Install the failing update by hand from the Microsoft Update Catalog

10 to 20 minutesLow riskOne KB keeps failing after Fix 1.

The Catalog file comes through your browser, from a different path than the Windows Update download. If the copy Windows Update gets is broken or signed wrongly, the Catalog file is often fine, and the installer checks its signature again on your disk.

1. Check your Windows version. Press Windows key + R, type winver and press Enter. Note the version (for example 25H2) and the OS build.
2. Find the KB number. Open Settings > Windows Update. A failed or pending update is listed with its KB number; earlier ones are under Update history.
3. Check the processor type. Open Settings > System > About and look at System type: an x64-based PC needs the x64 file, an ARM-based PC (for example Snapdragon) needs the arm64 file.
4. Search the catalog. Open the Microsoft Update Catalog at catalog.update.microsoft.com in your browser, type the KB number (for example KB5124010) in the search box and press Enter.
5. Pick the right row. Find the row whose title names your Windows version and your processor type (x64-based or arm64-based) and select Download on that row.
6. Download every file listed. A window lists one or more .msu links. Download all of them into one empty folder, for example C:\packages. On Windows 11 24H2 and later the list can include earlier checkpoint updates that the new one needs.
7. Install a single file. If there is only one file, double-click it and confirm the installation in the Windows Update Standalone Installer.

These steps were written for Windows 11 24H2 and later; Windows 10 22H2. The full page with the other versions and what each result means: Install an update from the Microsoft Update Catalog

Fix 3. Upgrade to Windows 11 from the ISO when you see 0x80096004 - 0x20000

About 1 hourRead the warningThe Windows 11 Installation Assistant, the Media Creation Tool or a feature update rolls back with 0x80096004 - 0x20000.

The Assistant and Windows Update download the setup files while they run, and one of those files fails the signature check. The ISO from Microsoft's download page is one complete file, so Setup works from what you mount instead of a fresh download.

1. Run Fix 1 first, so the old setup download in the update cache is gone.
2. On Microsoft's Download Windows 11 page, download the disk image (ISO) for your language.
3. Right-click the ISO file and select Mount.
4. Open the new drive and run setup.exe.
5. If Setup offers to download updates during the install, decline for now; you get them from Windows Update afterwards.
6. On Ready to install, check that Keep personal files and apps is selected and select Install.

The full procedure, with the pictures of each screen: Reinstall Windows without losing files

Fix 4. Clear and repair the Microsoft Store when an app update fails

5 minutesLow risk0x80096004 shows in the Store's Downloads list, not in Windows Update.

Store app packages are signed too. wsreset clears the Store cache, so the next download of the app package starts fresh and is checked again.

1. Clear the Store cache. Press Windows + R, type wsreset.exe and select OK. A blank Command Prompt window opens; after a short while it closes and Microsoft Store opens by itself.
2. Open System components. If the problem stays, select Start > Settings > System > System components. Next to Microsoft Store, select the three dots and Advanced options. If Microsoft Store is not listed there, look for it in Settings > Apps > Installed apps.
3. Repair first. Scroll to Reset and select Repair. Repair keeps the app's data. Open the Store and check whether it works.
4. Reset if Repair did not help. Select Reset and confirm. This deletes the Store app's data on this PC; your purchases stay in your Microsoft account. Open the Store and sign in again.

These steps were written for Windows 11 26H2 (build 26300). The full page with the other versions and what each result means: Reset the Microsoft Store

Fix 5. Repair system files and the component store with DISM and SFC

20 to 30 minutesLow riskMore than one update or signed program fails, or Fix 1 to Fix 4 did not help.

In rare cases a damaged certificate store or damaged system files make the certificate check fail on every package. DISM repairs the component store and SFC then replaces damaged system files.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

Fix 6. Pause updates and wait when one update is broken for everyone

5 minutes, then daysNo riskThe Catalog file fails too, many people report the same KB or build, or you are on a Windows Insider build.

When Microsoft signs a package wrongly, no setting on your PC can make the signature valid. Windows Update keeps retrying the same package, so a pause stops the loop until Microsoft publishes a fixed one.

1. Open Settings > Windows Update. On Windows 10 open Settings > Update & Security > Windows Update.
2. Select Pause for 1 week (on Windows 10, Pause updates for 7 days).
3. Check Microsoft's Windows release health page for your Windows version and look for the KB number.
4. After the pause, select Resume updates and Check for updates.
5. On an Insider build, wait for the next build Microsoft offers through Windows Update.

Fix 7. Test once with your third-party antivirus paused

10 minutesLow riskA non-Microsoft security suite is installed and Fixes 1 to 5 did not help.

A security suite that scans files right after the download can, in some cases, damage or lock the package during the scan, and the signature check then fails. One update with the scan paused shows whether that is the cause.

1. Run Fix 1 again, so the package scanned before is removed.
2. Pause your security suite for a short time, following its own menu. For Microsoft Defender this step is not needed. The general steps: Turn off Microsoft Defender protection for a moment
3. Select Check for updates in Settings > Windows Update and let the update install.
4. Turn the protection back on right after the update.

If the error 0x80096004 is still there

The logs show which file failed the signature check. That name tells you whether one update, a Store app or a driver in Setup is the problem.

• Home PC, the same KB, nothing helped: reinstall Windows over itself and keep your files and apps: Reinstall Windows without losing files
• Work or school PC: send the code, the KB number and the log lines to IT. A company update server or certificate policy may be involved.
• Windows 10: support ended on 14 October 2025. Only PCs in Extended Security Updates still get security updates, so check that the PC is enrolled before you spend time on a failing update.

How to keep error 0x80096004 from coming back

Frequently asked questions

What does error code 0x80096004 mean?

It means Windows could not verify the signature of a certificate inside a file it was about to install. Microsoft names the code TRUST_E_CERT_SIGNATURE and describes it as: the signature of the certificate cannot be verified. Windows treats the file as untrusted and discards it. On a home PC the file is most often a damaged download in the update cache, so a reset of the update components (Fix 1) clears it. Less often the update itself was signed wrongly, and then only a new package from Microsoft helps.

What is error code 0x80096004 - 0x20000?

It is the same signature error, reported by Windows Setup during an upgrade, such as the Windows 11 Installation Assistant or the Media Creation Tool. The first part, 0x80096004, says what failed: a signature check. The second part, 0x20000, is the extend code. Its first digit, 2, places the failure in the SAFE_OS phase, before the new Windows starts. Setup then rolls the PC back. Clear the update cache (Fix 1) and run the upgrade again from the Windows 11 ISO (Fix 3).

What does Download error - 0x80096004 mean in Windows 11?

Windows 11 shows Download error - 0x80096004 next to an update in Settings > Windows Update when the downloaded package failed its signature check. The word download is there because the check runs at the end of the download, before the install. The update stays in the list and Windows retries it. If it keeps failing, the retry uses the same broken copy, so reset the update components (Fix 1) to force a fresh download.

Is 0x80096004 caused by Microsoft or by my PC?

It can be either. When one update or build fails on many PCs at the same time, the package was most likely signed wrongly on Microsoft's side. That happened in December 2017, when Microsoft staff confirmed reports of 80096004 on Insider builds. When only your PC fails, the cause is your stored download, a security suite or damaged system files. A fresh download (Fix 1) and the Catalog file (Fix 2) tell the two cases apart.

Does the Windows Update troubleshooter fix 0x80096004?

Rarely. The troubleshooter restarts update services and can clear some pending downloads, but it does not repair a package with a broken signature. A manual reset of the update components (Fix 1) does more: it renames the whole download cache and the catroot2 folder with the signature catalogs, so Windows starts the download and the signature check from zero. If you want to try the troubleshooter anyway, it is harmless: Run the Windows Update troubleshooter

Can 0x80096004 appear with Microsoft Office or the Store?

Yes. The code belongs to the trust checks of Windows, so any installer that verifies signatures can report it. People report it with Microsoft Store app updates and with Office updates. For the Store, clear and repair the Store as in Fix 4. For Office, run Fix 1 if Office updates through Windows Update, or repair Office from Settings > Apps > Installed apps if it updates on its own.

Should I replace crypt32.dll to fix 0x80096004?

No. Some guides suggest copying crypt32.dll from another PC or a download site. A file of the wrong version or from an unknown source can break Windows or bring in malware. If you suspect damaged system files, let Windows repair them itself with DISM and SFC (Fix 5), which replace system files with Microsoft's own signed copies.

Is error 0x80096004 a sign of malware?

Usually not. A failed signature check is Windows refusing a damaged file, which is a protection working as it should. Still, if signed programs and several updates fail at the same time, run a full scan with Microsoft Defender: How to scan for malware with Microsoft Defender. Then repair system files as in Fix 5. Never get around the error by installing update files from unofficial sites.

Does 0x80096004 still matter on Windows 10?

Windows 10 left support on 14 October 2025. Windows 10 22H2 gets security updates only through Extended Security Updates, and Microsoft Defender still gets its definition updates. The fixes on this page work the same on Windows 10 and Windows 11. If your PC can run Windows 11 and the upgrade fails with 0x80096004 - 0x20000, Fix 3 is the way through.