How to fix Windows update error 0x80244007?

Error 0x80244007 means that Windows Update asked an update server for updates and the server sent back a SOAP fault, a formal refusal. Microsoft ties it almost always to PCs that get updates from a WSUS or Configuration Manager server. First check whether your PC uses such a server, then reset its client ID.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What Windows update error 0x80244007 means

Windows Update talks to update servers with SOAP, a format for web service messages. 0x80244007 belongs to the Protocol Talker errors, the part of the update client that sends those messages. Microsoft names it WU_E_PT_SOAPCLIENT_SOAPFAULT: the server did answer, but its answer was a SOAP fault, a structured message that says "I refuse this request, and here is why".

Microsoft's troubleshooting article says the error "typically occurs when Windows clients or virtual machines (VMs) try to scan and download updates from Windows Server Update Services (WSUS) or Configuration Manager endpoints". So the question is not what is broken in Windows, but which server your PC asks and why that server refuses.

Why Windows update error 0x80244007 appears

Microsoft names three causes, all of them SOAP faults sent by the WSUS server. A fourth one matters for home users: a PC that still has a WSUS policy from a former owner or employer. Ranked by how often they explain the error:

How to fix Windows update error 0x80244007

Fix 1 tells you whether a WSUS server is involved. Fixes 2 and 3 repair the PC side. Fixes 4 and 5 are for admins who run the WSUS server. Fixes 6 to 8 are for a PC with no WSUS policy at all.

Fix 1. Check whether the PC gets its updates from a WSUS server

2 minutesNo riskEveryone, first. It changes nothing and takes a minute.

Microsoft ties 0x80244007 to PCs that scan against WSUS or Configuration Manager. This check shows whether your PC is one of them and which server it asks.

1. Press Win + S, type cmd, right-click Command Prompt and select Run as administrator.
2. Type reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /s and press Enter.
3. If Windows says it cannot find the key, the PC has no WSUS policy and asks Microsoft directly. Go to Fix 6.
4. If you see WUServer with an http:// or https:// address, often with port 8530 or 8531, the PC uses WSUS.
5. If the PC belongs to a company or school that still manages it, send IT the address, the error code and the time. They can use Fix 2, 4 and 5.
6. If it is your own PC and nobody manages it any more, the policy is a leftover. Go to Fix 3.

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /s

Fix 2. Reset the WSUS client ID and scan again

10 minutes plus 15 minutes of waitingLow riskA PC that gets updates from WSUS, especially a cloned PC, a VM or one that was rebuilt, or a log that shows GetAuthorizationCookie.

Microsoft explains that one form of 0x80244007 comes from a missing WSUS client entry used to authorize the PC. Deleting the client ID values makes the PC register with the server again under a new identity, so the server can issue a fresh authorization cookie.

1. Open Command Prompt as administrator, as in Fix 1.
2. Type net stop wuauserv and press Enter.
3. Run the four reg Delete commands below, pressing Enter after each one.
4. Type net start wuauserv and press Enter.
5. Type wuauclt.exe /resetauthorization /detectnow and press Enter.
6. Wait 10 to 15 minutes, then open Settings > Windows Update and select Check for updates.

net stop wuauserv
reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v PingID /f
reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v AccountDomainSid /f
reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientId /f
reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientIDValidation /f
net start wuauserv
wuauclt.exe /resetauthorization /detectnow

Fix 3. Remove a leftover WSUS policy from your own PC

10 minutesRead the warningFix 1 found a WUServer address, and no company or school manages the PC any more.

With a WUServer policy, the PC asks that WSUS server instead of Microsoft. A server that no longer knows the PC refuses it with a SOAP fault on every scan. Without the policy, Windows Update goes to Microsoft directly.

1. Back up the key first: Back up the registry before editing it.
2. Open Command Prompt as administrator, as in Fix 1.
3. Type reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /f and press Enter.
4. Restart the PC.
5. Run the reg query command from Fix 1 again and make sure the key is gone.
6. Open Settings > Windows Update and select Check for updates.

Fix 4. Raise maxInstalledPrerequisites and maxCachedUpdates in the WSUS web.config

15 minutesRead the warningYou run the WSUS server, and client logs show InvalidParameters with InstalledNonLeafUpdateIDs or OtherCachedUpdateIDs.

Microsoft explains that the scan fails when a client passes more installed prerequisites to SyncUpdates than the server allows. The limits sit in the ClientWebService web.config. Doubling them lets the server accept the full list again.

1. On the WSUS server, open Command Prompt as administrator.
2. Type cd /d "%programfiles%\Update Services\WebServices\ClientWebService" and press Enter.
3. Take ownership and open the file with the three commands below.
4. Find maxInstalledPrerequisites and change its value from 400 to 800.
5. Find maxCachedUpdates and change its value from 22000 to 44000.
6. Save web.config and close Notepad.
7. Type IISReset and press Enter.
8. On one failing client, start a new scan and watch WindowsUpdate.log or WUAHandler.log.

takeown /f web.config
icacls web.config /grant administrator:(F)
notepad.exe web.config

<add key="maxInstalledPrerequisites" value="800"/>
<add key="maxCachedUpdates" value="44000"/>

Fix 5. Decline superseded updates and clean up the WSUS catalog

30 minutes or more, depending on the catalogLow riskA WSUS server that has not been cleaned in a long time, or the error comes back after Fix 4.

Every update the server offers adds IDs that clients send back during a scan. Microsoft lists declining superseded updates as a resolution for 0x80244007, because a smaller catalog keeps clients under the web.config limits for good.

1. On the WSUS server, open PowerShell as administrator.
2. Get Microsoft's script that declines superseded updates: PowerShell script to decline superseded updates in WSUS.
3. Read the script's notes on Microsoft's page, then run it and check which updates it declined.
4. Follow the rest of Microsoft's WSUS and Configuration Manager SUP maintenance guide for the database and cleanup steps.
5. Let clients scan on their next cycle, or start a scan on one client to test.

Fix 6. Run the Windows Update troubleshooter

5 minutesNo riskA home PC with no WSUS policy, and the error stays after a restart.

Without WSUS, 0x80244007 points to a stuck update session. The troubleshooter restarts the update services and clears that session, so the next scan starts fresh.

1. Open Troubleshoot settings. Select Start > Settings > System > Troubleshoot.
2. Open the list of troubleshooters. Select Other troubleshooters.

   

3. Run the Windows Update troubleshooter. Under Most frequent, select Run next to Windows Update. The Get Help app opens and starts the checks.

   

4. Read the result. Wait until Get Help finishes. If it found and fixed a problem, it says so and asks whether this solved the problem. Answer the question so it can offer the next step.

   

5. Restart the PC. Restart when the troubleshooter finishes, even if it does not ask you to.
6. Check for updates again. Select Start > Settings > Windows Update > Check for updates, and install the updates it finds.

These steps were written for Windows 11 (screenshots: 26H2). The full page with the other versions and what each result means: Run the Windows Update troubleshooter

Fix 7. Reset the Windows Update components

10 minutesLow riskThe troubleshooter found nothing, and the PC has no WSUS policy.

Renaming the SoftwareDistribution and catroot2 folders throws away the old update database and half finished downloads, so the client builds a new scan state with the server.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

Fix 8. Install the update by hand from the Microsoft Update Catalog

10 minutesLow riskOne update keeps failing, or the PC is on a network you cannot change.

The catalog file comes through your browser, not through the update client and its server, so no SOAP fault can stop it. It installs the one update but leaves the cause in place.

1. Check your Windows version. Press Windows key + R, type winver and press Enter. Note the version (for example 25H2) and the OS build.
2. Find the KB number. Open Settings > Windows Update. A failed or pending update is listed with its KB number; earlier ones are under Update history.
3. Check the processor type. Open Settings > System > About and look at System type: an x64-based PC needs the x64 file, an ARM-based PC (for example Snapdragon) needs the arm64 file.
4. Search the catalog. Open the Microsoft Update Catalog at catalog.update.microsoft.com in your browser, type the KB number (for example KB5124010) in the search box and press Enter.
5. Pick the right row. Find the row whose title names your Windows version and your processor type (x64-based or arm64-based) and select Download on that row.
6. Download every file listed. A window lists one or more .msu links. Download all of them into one empty folder, for example C:\packages. On Windows 11 24H2 and later the list can include earlier checkpoint updates that the new one needs.
7. Install a single file. If there is only one file, double-click it and confirm the installation in the Windows Update Standalone Installer.

These steps were written for Windows 11 24H2 and later; Windows 10 22H2. The full page with the other versions and what each result means: Install an update from the Microsoft Update Catalog

If the error 0x80244007 is still there

The update log holds the exact fault the server sent, and that fault decides the fix. Read it before you try anything else.

1. Open PowerShell as administrator, type Get-WindowsUpdateLog and press Enter. The command writes WindowsUpdate.log to your desktop.
2. Open the file and search for 80244007.
3. Read the lines just above it: Soap fault info, code and detail. The <ErrorCode> and <Message> inside detail name the reason.
4. Note the Server URL in the same block. It shows which server refused the request.

How to keep error 0x80244007 from coming back

Frequently asked questions

What does error 0x80244007 mean?

It means the update server answered Windows Update with a SOAP fault, a formal refusal of the request. Microsoft names the code WU_E_PT_SOAPCLIENT_SOAPFAULT. In nearly every case the server is a WSUS or Configuration Manager server, and the refusal has one of three reasons: the PC's client entry is missing, or the PC sends more installed or cached update IDs than the server accepts. Your Windows files are not damaged. Fix 1 shows whether your PC uses WSUS.

What is "There were some problems installing updates" with (0x80244007)?

It is the general Windows 10 message for an update run that did not finish. The code in brackets gives the reason, and (0x80244007) means the update server refused the scan with a SOAP fault. Windows retries later by itself, but a refusal from a WSUS server usually repeats until the cause is fixed. Run the policy check in Fix 1 first, then reset the client ID in Fix 2.

Does 0x80244007 happen on Windows 11 too?

Yes. The code belongs to the Windows Update client, which works the same way on Windows 11 and Windows 10, and Microsoft's article covers Windows Server and Azure VMs as well. On Windows 11 the update list may show Download error - 0x80244007 next to an update. The fixes are the same on both: check for a WSUS policy, reset the client ID, and on the server raise the web.config limits.

What does Download error - 0x80244007 mean?

It is how the Windows 11 update list shows the same SOAP fault next to an update that could not be fetched. The update itself is not broken. The server the PC asked refused the request. On a work PC that server is WSUS, so the client reset in Fix 2 or the server change in Fix 4 applies. On a home PC with no WSUS policy, reset the update components (Fix 7) or install the update by hand (Fix 8).

Why does Add-WindowsCapability fail with error code 0x80244007?

Add-WindowsCapability asks Windows Update for the optional feature, and on a WSUS managed PC that request goes to the WSUS server, which refuses it with the same SOAP fault. We could not confirm on a Microsoft page which server setting causes it for features. Check the policy with Fix 1. On a managed PC, ask IT how optional features are delivered; on your own PC, a leftover WSUS policy is the likely cause, and Fix 3 removes it.

What does Scan failed with error = 0x80244007 mean in Configuration Manager?

It is a line from ScanAgent.log or WUAHandler.log on a Configuration Manager client. The client scanned against the software update point, which runs WSUS, and the scan ended with a SOAP fault. The OnSearchComplete - failed to end search job line is the same failure. Read the fault detail in WindowsUpdate.log: InstalledNonLeafUpdateIDs or OtherCachedUpdateIDs means the web.config limits in Fix 4, and a missing cookie means the client reset in Fix 2.

What does 0x80244007(-2145107961) mean?

It is the same error written twice: as the hex code 0x80244007 and as the signed decimal number -2145107961. Scripts, PowerShell output and some management tools print both. The meaning does not change: the update server sent a SOAP fault. Use the fixes on this page in the same order, starting with the policy check in Fix 1.

Does deleting DataStore.edb fix 0x80244007?

Sometimes, on a PC with no WSUS policy, because it clears the local update database and the next scan starts fresh. Our older advice was to stop the service, delete C:\Windows\SoftwareDistribution\DataStore\DataStore.edb and start it again. The full reset in Fix 7 does the same and more. On a WSUS client it rarely helps on its own, because the refusal comes from the server; reset the client ID in Fix 2 instead.

Is 0x80244007 the same as 0x8024401F?

No. 0x8024401F is HTTP 500: the server crashed while it handled the request. 0x80244007 is a SOAP fault: the server worked and answered with a structured refusal and a reason. Both often come from WSUS servers, so the checks overlap. For the HTTP 500 code, read our guide to Windows Update error 0x8024401F.

I did everything and the error came back. What now?

Then read the fault detail itself, as shown in "If the error is still there". The ErrorCode and Message lines in WindowsUpdate.log name the exact reason the server refused the scan, and the table there ties each one to a fix. If the Server URL is a company WSUS address, the server owner has to apply Fix 4 and Fix 5. A system restore or a Windows reset does not change a server's answer, so do not start with those.