How to fix Windows update error 0x800B0003?

Error 0x800B0003 means Windows downloaded an update but its signature check could not recognise the file, so Windows refused to install it. Most often the download is damaged or cut off. Clear the Windows Update download folder first, then rebuild the signature catalog folder catroot2.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What Windows update error 0x800B0003 means

Microsoft's list of security and setup error codes names 0x800B0003 TRUST_E_SUBJECT_FORM_UNKNOWN and gives this description: "The form specified for the subject is not one supported or known by the specified trust provider". Put simply, Windows was asked to check the digital signature of a file and could not tell what kind of file it was looking at.

Every Windows update is signed by Microsoft. After the download, Windows checks that signature before it installs anything. A file that is cut off, overwritten with other data or broken on the disk no longer looks like a signed update package, so the check gives up with this code. Windows Update then says it will try again later and fails the same way, because it reuses the broken file it already has.

Why Windows update error 0x800B0003 appears

The signature check needs two things: a complete update file and working check components. On a home PC the reasons it fails are, from the most likely to the least likely:

How to fix Windows update error 0x800B0003

Fixes 1 and 2 replace the broken download and the signature catalogs, and solve most cases. Fix 3 gets one stubborn update past Windows Update. Fixes 4 and 5 remove what damaged the file. Fix 6 repairs Windows itself and keeps your files.

Fix 1. Empty the Windows Update download folder and download the update again

10 minutesLow riskEveryone, first. It replaces the damaged file that the signature check refuses.

Windows Update keeps reusing the file it already downloaded, so a broken file fails the check every time. With the Download folder empty, Windows has to fetch a fresh copy, which then passes the signature check.

1. Press Win + S, type cmd, right-click Command Prompt and select Run as administrator. Select Yes.
2. Type net stop wuauserv and press Enter. Then type net stop bits and press Enter.
3. Press Win + R, paste C:\Windows\SoftwareDistribution\Download and press Enter.
4. Press Ctrl + A to select everything in the folder and press Delete. If Windows asks for permission, select Continue.
5. Back in Command Prompt, type net start wuauserv and press Enter, then net start bits and press Enter.
6. Open Settings > Windows Update and select Check for updates. On Windows 10 open Settings > Update & Security > Windows Update.

net stop wuauserv
net stop bits
net start wuauserv
net start bits

Fix 2. Rebuild the catroot2 signature catalogs and restart Cryptographic Services

10 minutesLow riskA fresh download still fails, or several updates fail with 0x800B codes.

Cryptographic Services keeps the catalogs it uses to check update signatures in C:\Windows\System32\catroot2. When that folder is damaged, even a good file can fail the trust check. Renaming it makes Windows build a clean one.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

Fix 3. Install the failing update by hand from the Microsoft Update Catalog

10 minutesLow riskOne update keeps failing while the others install, or you need it now.

The catalog file comes through your browser as a complete package, and the installer checks that file instead of the copy Windows Update keeps getting wrong.

1. Check your Windows version. Press Windows key + R, type winver and press Enter. Note the version (for example 25H2) and the OS build.
2. Find the KB number. Open Settings > Windows Update. A failed or pending update is listed with its KB number; earlier ones are under Update history.
3. Check the processor type. Open Settings > System > About and look at System type: an x64-based PC needs the x64 file, an ARM-based PC (for example Snapdragon) needs the arm64 file.
4. Search the catalog. Open the Microsoft Update Catalog at catalog.update.microsoft.com in your browser, type the KB number (for example KB5124010) in the search box and press Enter.
5. Pick the right row. Find the row whose title names your Windows version and your processor type (x64-based or arm64-based) and select Download on that row.
6. Download every file listed. A window lists one or more .msu links. Download all of them into one empty folder, for example C:\packages. On Windows 11 24H2 and later the list can include earlier checkpoint updates that the new one needs.
7. Install a single file. If there is only one file, double-click it and confirm the installation in the Windows Update Standalone Installer.

These steps were written for Windows 11 24H2 and later; Windows 10 22H2. The full page with the other versions and what each result means: Install an update from the Microsoft Update Catalog

Fix 4. Free disk space on drive C: so the update can download and unpack in full

10 minutesLow riskDrive C: is nearly full, or the download stopped part way.

An update that runs out of room while it downloads or unpacks leaves a file that is shorter than it should be. The signature check cannot read such a file and stops with 0x800B0003.

1. Open Storage settings. Select Start > Settings > System > Storage. The top of the page shows how full the drive is and what uses the space.
2. Open Cleanup recommendations. Under Storage management, select Cleanup recommendations.
3. Clean up what Windows suggests. Open each group (Temporary files, Large or unused files, Files synced to the cloud, Unused apps), check the items you do not need and select Clean up in that group.
4. Delete more temporary files. Go back to Storage and select Temporary files. Windows lists the types it can remove with their size. Check the ones you do not need and remove them. Leave Downloads unchecked unless you have checked that folder.
5. Turn on Storage Sense. Back on Storage, turn the Storage Sense switch on. Windows then deletes temporary files on its own when the drive runs low.
6. Choose what Storage Sense cleans. Select Storage Sense to open its page. Check the box for cleaning temporary files, then choose when it runs and how long files may stay in the Recycle Bin and Downloads before they are deleted.
7. Run it now. Select Run Storage Sense now at the bottom of the page.
8. Clean up system files with Disk Cleanup. Type disk cleanup in the search box on the taskbar and open Disk Cleanup. Choose drive C: and select OK, then select Clean up system files and choose C: again.
9. Delete the files. Check the types of files you want to remove (select a name to see what it is), select OK, then Delete files.

These steps were written for Windows 11 (screenshots: 26H2). The full page with the other versions and what each result means: Free up disk space and delete temporary files

Fix 5. Repair Windows system files with DISM and SFC

20 to 40 minutesLow riskThe error came after a crash or blue screen, or Fixes 1 to 4 did not help.

The trust check runs on Windows system files. A crash can damage them, and then every update fails the check. DISM repairs the Windows image, SFC then replaces damaged system files from it.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

Fix 6. Repair Windows in place and keep your files and apps

About 1 hourLow riskNothing above helped, or many updates fail.

An in-place repair replaces all Windows files, the trust check parts included, with a fresh copy and brings the PC to the latest version. Your files, apps and most settings stay.

On Windows 11, Settings > System > Recovery > Fix problems using Windows Update reinstalls the current version. On Windows 10 use the installation media from Microsoft.

1. Open Recovery in Settings. Open Settings > System > Recovery. Next to Fix problems using Windows Update, select Reinstall now. This keeps your apps, files and settings.
2. Start the reinstall. Choose whether the PC may restart on its own 15 minutes after the installation, then select OK.
3. Wait and restart. Windows Update downloads and installs a repair copy of your current Windows version. Keep the PC plugged in and online, and restart it when asked.

These steps were written for Windows 11 22H2 and later. The full page with the other versions and what each result means: Reinstall Windows without losing files

If the error 0x800B0003 is still there

When the error stays after an in-place repair, the logs name the file that failed the check. That tells you whether it is one update package, a driver or a disk problem.

1. Open PowerShell as administrator, type Get-WindowsUpdateLog and press Enter. It writes WindowsUpdate.log to your desktop.
2. Open the file and search for 800B0003. Note the update name or KB number on the lines around it.
3. Open C:\Windows\Logs\CBS\CBS.log and search for the same time. Lines with TRUST_E_SUBJECT_FORM_UNKNOWN name the file that the check refused.

Send Microsoft support or a forum the KB number, the lines around 800B0003 in WindowsUpdate.log and your Windows version from Settings > System > About.

How to keep error 0x800B0003 from coming back

If a different certificate code appears on the same PC, for example a name mismatch, the cause is on the network instead: How to fix Windows update error 0x800B010F.

Frequently asked questions

What does error code 0x800B0003 mean on Windows 10 and Windows 11?

It means the Windows signature check could not recognise the form of a file it was asked to check. Microsoft names the code TRUST_E_SUBJECT_FORM_UNKNOWN. With Windows Update, the file is almost always a downloaded update that is damaged or incomplete, so Windows refuses to install it. The code is the same on Windows 10 and Windows 11, and so are the fixes. Clear the update download folder first (Fix 1), then rebuild catroot2 (Fix 2).

What does "Download error - 0x800b0003" mean in Windows 11?

It is the Windows 11 way of showing the same error next to one update in Settings > Windows Update. The word download does not mean your internet failed. It means the update could not get past the step after the download, the signature check. Select Retry once. If it fails again, empty the Download folder as in Fix 1, so Windows gets a new copy of that update.

What is "verify sig error 0x800b0003"?

It is a log or setup message that says a signature verification (verify sig) failed with 0x800B0003. It points at the same cause: a file whose signature could not be checked because Windows did not recognise its form. We could not confirm which exact program writes this wording. If you see it while installing an update, use Fix 1 and Fix 3 on this page. If you see it while installing another program, download that installer again from its maker, because the copy you have is probably damaged.

Is 0x80070003 the same error as 0x800B0003?

No. 0x80070003 is a different code that means the system cannot find the path specified. Windows Update shows it when a folder or file it expects is missing, often in the SoftwareDistribution folder. The two codes differ by one letter group, so people mix them up. Resetting the update components with Reset Windows Update components helps with both, but the cause of 0x80070003 is a missing path, not a failed signature check.

What is error 0x8D050003?

It is a different code, not a spelling of 0x800B0003. We could not confirm its official meaning from a Microsoft source, so this page does not give fixes for it. If it appears in Windows Update, the generic repairs on this page, the component reset and the system file check, are safe to try. Look up the exact code with the name of the program that shows it.

Why does 0x800B0003 appear with the Malicious Software Removal Tool?

The Malicious Software Removal Tool comes through Windows Update every month as its own download, so a damaged copy of it fails the same signature check. Users report this case in Microsoft's forum. Microsoft also offers the tool as a standalone download, and each month's version replaces the last one. Install it by hand as in Fix 3, or clear the download folder (Fix 1) and let Windows fetch it again.

Can a blue screen or a crash cause error 0x800B0003?

Yes, that is a common pattern in user reports. When Windows stops while an update is being written to the disk, the file can stay half written, and the signature check cannot read it later. A crash can also damage system files. Run Fix 1 to replace the download and Fix 5 to repair system files. If blue screens keep coming back, check the drive with chkdsk and look for the cause of the crashes first.

Does the Windows Update troubleshooter fix 0x800B0003?

It can restart the update services and clear some caches, and it is safe to try: Run the Windows Update troubleshooter. It does not always delete a damaged file in the Download folder, though, which is the usual cause here. Fix 1 does that directly and takes about the same time, so start there.

Is error 0x800B0003 a sign of malware?

Usually not. The common causes are a broken download, a damaged catroot2 folder or a full disk. But a file that Windows cannot check can also be a file that something changed. If the error stays after Fix 1 and Fix 2, or other programs also report signature errors, run a full scan with Microsoft Defender: How to scan for malware with Microsoft Defender.

Does Windows 10 still get the updates that fail with 0x800B0003?

Windows 10 left support on 14 October 2025. Windows 10 22H2 still gets security updates only through Extended Security Updates, and Microsoft Defender still gets its definition updates. The fixes on this page work the same on Windows 10 and Windows 11. If your PC can run Windows 11, moving to it is the long term answer.