How to fix Windows update error 0x80244017?

Error 0x80244017 means that Windows Update asked a server for updates and got HTTP status 401 back: the request needs a login that Windows cannot give. It is a connection problem, not a broken update. Turn off any VPN or proxy first, then check the system proxy and the update policy on your PC.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What Windows update error 0x80244017 means

Microsoft's list of Windows Update error codes puts 0x80244017 among the networking errors of the update client. Its name is WU_E_PT_HTTP_STATUS_DENIED, and the description reads: "Same as HTTP status 401 - the requested resource requires user authentication." In plain words: Windows Update knocked on a server, and the answer was "show me who you are first".

Windows Update cannot type a password. It talks to the update server through the system connection (WinHTTP) as the computer itself, so when a proxy, a filter or a WSUS server demands a user login, the check simply fails. The update file on your PC is not damaged, and nothing is wrong with the update itself.

Why Windows update error 0x80244017 appears

Microsoft's troubleshooting page for update scan failures groups 0x80244017 (HTTP 401) with 0x80244018 (HTTP 403) and names four reasons: port configuration, proxy configuration, firewall issues and network connectivity. On a home PC that narrows down to the rows below, from the most likely to the least likely.

How to fix Windows update error 0x80244017

Fixes 1 and 2 remove what stands between Windows Update and the server, and solve most home cases. Fix 3 is for a PC that once belonged to a company or school. Fixes 4 and 5 clear a stuck update session. Fix 6 gets one update past the problem by hand.

Fix 1. Disconnect the VPN, turn off a manual proxy and check for updates again

5 minutesNo riskEveryone, first. It is the most common source of a 401 answer on a home PC.

A 401 means the update request reached a server that wanted a login. With the VPN and the manual proxy off, the request goes straight to Microsoft, which does not ask home PCs for one.

1. Disconnect your VPN and close any proxy, ad blocking or parental filter app that routes your traffic.
2. Open Settings > Network & internet > Proxy. On Windows 10 open Settings > Network & Internet > Proxy.
3. Under Manual proxy setup, check whether Use a proxy server is on. If you did not set it on purpose, turn it off.
4. Restart the PC.
5. Open Settings > Windows Update and select Check for updates.
6. If it fails again, connect once to another network, for example your phone's hotspot, and check for updates there.

Fix 2. Check the system proxy with netsh winhttp and reset it

5 minutesLow riskThe error stays with the VPN off, or a VPN or proxy program was installed on the PC before.

Windows Update uses WinHTTP, and Microsoft notes that the WinHTTP proxy is not necessarily the same as the one in your browser settings. A proxy left there by an old program is invisible in Settings but still catches every update request.

1. Press Win + S, type cmd, right-click Command Prompt and select Run as administrator.
2. Type netsh winhttp show proxy and press Enter.
3. If the answer is Direct access (no proxy server), the system proxy is not the cause. Go to Fix 3.
4. If it names a proxy server and you do not use one on purpose, type netsh winhttp reset proxy and press Enter.
5. If your network really needs a proxy and your browser works through it, type netsh winhttp import proxy source=ie instead.
6. Restart the PC and select Check for updates in Settings > Windows Update.

netsh winhttp show proxy
netsh winhttp reset proxy

Fix 3. Check whether the PC is set to a WSUS server and remove an old policy

10 minutesRead the warningA used or former work or school PC, or a PC that once had a tool that changed update settings.

Microsoft's scan failure guide says the address of the WSUS server is written in one registry key. If that key points to a server that refuses your PC, every scan ends with 0x80244017, and nothing else on this page helps.

1. Open Command Prompt as administrator, as in Fix 2.
2. Type reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /s and press Enter.
3. If Windows says it was unable to find the key, there is no such policy. Go to Fix 4.
4. If the output shows an http:// or https:// address, often with port 8530 or 8531, the PC is set to use a WSUS server.
5. On a PC that a company or school still manages, stop here and send that address to your IT team.
6. On your own PC with a leftover setting, back up the key first: Back up the registry before editing it.
7. Then type reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /f and press Enter.
8. Restart the PC and select Check for updates.

Fix 4. Run the Windows Update troubleshooter

5 minutesNo riskThere is no proxy and no policy, and the error stays after a restart.

The troubleshooter restarts the update services and drops a stuck update session, so the next check starts with a fresh connection instead of repeating the refused request.

1. Open Troubleshoot settings. Select Start > Settings > System > Troubleshoot.
2. Open the list of troubleshooters. Select Other troubleshooters.

   

3. Run the Windows Update troubleshooter. Under Most frequent, select Run next to Windows Update. The Get Help app opens and starts the checks.

   

4. Read the result. Wait until Get Help finishes. If it found and fixed a problem, it says so and asks whether this solved the problem. Answer the question so it can offer the next step.

   

5. Restart the PC. Restart when the troubleshooter finishes, even if it does not ask you to.
6. Check for updates again. Select Start > Settings > Windows Update > Check for updates, and install the updates it finds.

These steps were written for Windows 11 (screenshots: 26H2). The full page with the other versions and what each result means: Run the Windows Update troubleshooter

Fix 5. Reset the Windows Update components

10 minutesLow riskThe troubleshooter found nothing, and you have a direct connection without a proxy.

Renaming the SoftwareDistribution and catroot2 folders clears the list of half-finished downloads, so Windows Update builds a new session with the server instead of retrying the refused one.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

Fix 6. Install the update by hand from the Microsoft Update Catalog

10 minutesLow riskOnly one update keeps failing, or you are on a network you cannot change.

The catalog download goes through your browser, which can log in to a proxy, not through Windows Update. The update then installs from the file without the 401 check.

1. Check your Windows version. Press Windows key + R, type winver and press Enter. Note the version (for example 25H2) and the OS build.
2. Find the KB number. Open Settings > Windows Update. A failed or pending update is listed with its KB number; earlier ones are under Update history.
3. Check the processor type. Open Settings > System > About and look at System type: an x64-based PC needs the x64 file, an ARM-based PC (for example Snapdragon) needs the arm64 file.
4. Search the catalog. Open the Microsoft Update Catalog at catalog.update.microsoft.com in your browser, type the KB number (for example KB5124010) in the search box and press Enter.
5. Pick the right row. Find the row whose title names your Windows version and your processor type (x64-based or arm64-based) and select Download on that row.
6. Download every file listed. A window lists one or more .msu links. Download all of them into one empty folder, for example C:\packages. On Windows 11 24H2 and later the list can include earlier checkpoint updates that the new one needs.
7. Install a single file. If there is only one file, double-click it and confirm the installation in the Windows Update Standalone Installer.

These steps were written for Windows 11 24H2 and later; Windows 10 22H2. The full page with the other versions and what each result means: Install an update from the Microsoft Update Catalog

If the error 0x80244017 is still there

When the fixes did not help, the 401 answer comes from a part of the network you do not control, or from a WSUS server that someone else runs. The log tells you which server answered.

1. Open PowerShell as administrator, type Get-WindowsUpdateLog and press Enter. It writes WindowsUpdate.log to your desktop.
2. Open the file and search for 0x80244017. The lines around it name the server address Windows Update tried to reach.
3. A Microsoft address means a proxy or filter on the way gave the 401 answer. A company address with port 8530 or 8531 means a WSUS server.

How to keep error 0x80244017 from coming back

If a security suite with its own web filter is installed, pausing its protection for one check shows whether it is the filter that answers 401. Turn it back on right after: Turn off Microsoft Defender protection for a moment

Frequently asked questions

What does error code 0x80244017 mean?

It means HTTP status 401: the server Windows Update contacted wants a user login. Microsoft names the code WU_E_PT_HTTP_STATUS_DENIED and describes it as the same as HTTP status 401, the requested resource requires user authentication. Windows Update connects as the computer and cannot type a password, so the check or the download fails. The update itself is fine. A VPN, a proxy, a network filter or a WSUS server between your PC and Microsoft is what refused the request.

What does "There were some problems installing updates, but we'll try again later" mean with 0x80244017?

It is the general Windows 10 message for an update that did not finish, and the code in brackets says why. With (0x80244017) the reason is a refused connection, HTTP 401, not a damaged file and not a lack of space. Windows will retry on its own, but the retry fails in the same way until the proxy, VPN or update policy that causes it is changed. Start with Fix 1 on this page.

Why does the update stop at 80% with 0x80244017?

The percentage covers checking, downloading and installing, and Windows Update talks to the server many times along the way. The first requests can pass, and a later one can go through a proxy or filter that wants a login. That later request ends with 0x80244017 and the progress stops. It does not mean that 80% of the update is installed. Once the connection works, Windows downloads what is missing and continues.

What is "OnSearchComplete - Failed to end search job. Error = 0x80244017"?

It is a log line, mostly seen on PCs that get updates through WSUS or Configuration Manager. Its words say that the search for updates, the scan, ended with 0x80244017. We could not confirm which log file writes this exact line. Microsoft's guide for this kind of scan failure asks the administrator to test the connection to the WSUS server, check the proxy settings and open ports 80, 443, 8530 or 8531, and read the IIS logs on the server.

Is 0x80244017 the same as 0x80244019 or 0x80242017?

No. In Microsoft's list 0x80244019 is HTTP status 404: the server cannot find the requested address. On a home PC, Fix 3 and Fix 5 are worth a try for it too. The neighbours are 0x80244018, which is HTTP 403, and 0x8024401B, which is HTTP 407, a proxy that wants a login. The code 0x80242017 comes from another part of Windows Update. Check whether you meant 0x80244017, because this page does not cover that one.

Can a VPN cause Windows update error 0x80244017?

Yes, and on home PCs it is the first thing to check. A VPN or proxy app sends Windows Update traffic through its own servers. If those servers want a login or block the request, Windows Update gets the 401 answer. Disconnect the VPN, restart and check for updates. Some VPN apps also set a system proxy that stays after they close, so run netsh winhttp show proxy as in Fix 2 if the error stays.

Should I turn off my antivirus to fix 0x80244017?

No. An antivirus does not answer with HTTP 401, so turning it off for good does not fix this code and leaves the PC open. The only exception is a security suite with its own web filter or proxy. Pause its protection for one update check to test it, and turn it back on right after. If the check works while it is paused, look for a setting in the suite that lets Windows Update through.

Is error 0x80244017 a sign of a virus?

Usually not. The common causes are a VPN, a proxy or an old update policy. But if netsh winhttp show proxy lists a proxy that you never set and no program you know could have set it, treat it as suspicious. Reset the proxy as in Fix 2 and run a full scan with Microsoft Defender. Some unwanted programs route web traffic through their own proxy, and Windows Update is often the first thing to notice.

Does the Media Creation Tool fix 0x80244017?

It can update Windows past the error, because it downloads the full system through its own connection and reinstalls Windows over itself. It does not remove the cause. If a proxy or an update policy blocks Windows Update, the next monthly update fails again with the same code. Use the fixes on this page first. If you still need a full repair, reinstall Windows and keep your files, which uses the same installation media.

Does Windows 10 still get the updates that fail with 0x80244017?

Windows 10 left support on 14 October 2025. Windows 10 22H2 still gets security updates only through Extended Security Updates, and Microsoft Defender still gets its definition updates. The fixes on this page work the same on Windows 10 and Windows 11, because the cause is the connection, not the version. If your PC can run Windows 11, moving to it is the long term answer.