How to fix Windows update error 0x80244018?

Error 0x80244018 means that Windows Update asked a server for updates and got HTTP status 403 back: the request was understood and refused. Nothing is wrong with the update file. Turn off any VPN or proxy first, then look for a filter, a system proxy or an old update policy that blocks the way.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What Windows update error 0x80244018 means

In Microsoft's list of Windows Update error codes, 0x80244018 belongs to the networking part of the update client. Its name is WU_E_PT_HTTP_STATUS_FORBIDDEN, and Microsoft describes it as "Same as HTTP status 403 - server understood the request but declined to fulfill it." Put simply, the request arrived, and the answer was a plain no.

A 403 is different from a lost connection. Some server did answer, and it said the PC may not have this file or this list of updates. Microsoft's own update servers do not refuse an ordinary home PC, so the answer almost always comes from something in the middle: a VPN exit, a proxy, a filter, or a company update server.

Why Windows update error 0x80244018 appears

Microsoft's guide to update scan failures lists 0x80244018 (HTTP 403) next to 0x80244017 (HTTP 401) and names four reasons: port configuration, proxy configuration, firewall issues and network connectivity. It adds that when the update server itself does not return the error, "the issue is probably with an intermediate firewall or proxy." On a home PC that gives this order:

How to fix Windows update error 0x80244018

Fixes 1 to 3 find what refuses the request on your side, and solve most home cases. Fix 4 is for a PC that once belonged to a company or school. Fixes 5 and 6 clear a stuck update session. Fix 7 installs one update by hand.

Fix 1. Disconnect the VPN, turn off a manual proxy and test another network

5 minutesNo riskEveryone, first. A VPN or proxy is the most common thing that answers 403 on a home PC.

With the VPN and the manual proxy off, the request goes straight to Microsoft, which serves updates to home PCs. A second network then shows whether the refusal comes from your PC or from the network it sits on.

1. Disconnect your VPN and close any proxy app that routes your traffic.
2. Open Settings > Network & internet > Proxy (on Windows 10, Settings > Network & Internet > Proxy).
3. Under Manual proxy setup, check Use a proxy server. If you did not turn it on yourself, turn it off.
4. Restart the PC.
5. Open Settings > Windows Update and select Check for updates.
6. If the error returns, connect to your phone's hotspot and select Check for updates again.

Fix 2. Find the router, DNS or security filter that blocks Windows Update addresses

10 minutesLow riskUpdates work on a hotspot but not at home, or the network has parental controls, an ad blocking DNS or a web filter.

A filter that blocks an address often answers with its own block page, which Windows Update sees as HTTP 403. Microsoft lists the addresses Windows Update must reach, so the filter needs to let exactly those through.

1. Write down every filter on the way: router parental controls, a filtering DNS service set in the router or in Windows, and the web protection of a security suite.
2. Open the router's settings page and look under parental controls, web filter or blocked sites for any Microsoft address.
3. In the DNS service or ad blocker, open the log of blocked requests and select Check for updates on the PC while you watch it.
4. Allow every blocked address that ends in one of the Windows Update names in the table below.
5. Select Check for updates again.

Fix 3. Check the system proxy with netsh winhttp and reset it

5 minutesLow riskThe error stays with the VPN off, or a VPN, proxy or company software was installed on the PC before.

Windows Update downloads through WinHTTP, the system level connection, not through your browser settings. Microsoft notes that the two proxies can differ, so an old WinHTTP proxy can refuse update requests while every website opens fine.

1. Press Win + S, type cmd, right-click Command Prompt and select Run as administrator.
2. Type netsh winhttp show proxy and press Enter.
3. If you see Direct access (no proxy server), the system proxy is not the cause. Go to Fix 4.
4. If a proxy server is named and you do not use one on purpose, type netsh winhttp reset proxy and press Enter.
5. If your network does need a proxy and your browser works through it, type netsh winhttp import proxy source=ie instead.
6. Restart the PC and select Check for updates.

netsh winhttp show proxy
netsh winhttp reset proxy

Fix 4. Check whether the PC is set to a WSUS server and remove an old policy

10 minutesRead the warningA used or former work or school PC, or a PC where a tool once changed the update settings.

Microsoft's scan failure guide says the WSUS server address is read from the Windows Update policy key. If that address belongs to a server that refuses your PC, every scan ends with 0x80244018 and the fixes above change nothing.

1. Open Command Prompt as administrator, as in Fix 3.
2. Type reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /s and press Enter.
3. If Windows cannot find the key, there is no such policy. Go to Fix 5.
4. If you see WUServer with an http:// or https:// address, often with port 8530 or 8531, the PC is set to use WSUS.
5. If a company or school still manages the PC, stop here and send that address to its IT team.
6. On your own PC with a leftover setting, back up the key first: Back up the registry before editing it.
7. Type reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /f and press Enter.
8. Restart the PC and select Check for updates.

Fix 5. Run the Windows Update troubleshooter

5 minutesNo riskNo VPN, no filter, no proxy and no policy, and the error stays after a restart.

The troubleshooter restarts the update services and clears a stuck session, so the next check starts fresh instead of repeating a request that was refused earlier.

1. Open Troubleshoot settings. Select Start > Settings > System > Troubleshoot.
2. Open the list of troubleshooters. Select Other troubleshooters.

   

3. Run the Windows Update troubleshooter. Under Most frequent, select Run next to Windows Update. The Get Help app opens and starts the checks.

   

4. Read the result. Wait until Get Help finishes. If it found and fixed a problem, it says so and asks whether this solved the problem. Answer the question so it can offer the next step.

   

5. Restart the PC. Restart when the troubleshooter finishes, even if it does not ask you to.
6. Check for updates again. Select Start > Settings > Windows Update > Check for updates, and install the updates it finds.

These steps were written for Windows 11 (screenshots: 26H2). The full page with the other versions and what each result means: Run the Windows Update troubleshooter

Fix 6. Reset the Windows Update components

10 minutesLow riskThe troubleshooter found nothing, and the connection is direct.

Renaming the SoftwareDistribution and catroot2 folders throws away half finished downloads, so Windows Update asks the server for everything again over the now clear path.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

Fix 7. Install the update by hand from the Microsoft Update Catalog

10 minutesLow riskOne update keeps failing, or you are on a network you cannot change.

The catalog file comes through your browser, not through Windows Update, so it avoids the request that is refused. It installs the one update but leaves the cause in place.

1. Check your Windows version. Press Windows key + R, type winver and press Enter. Note the version (for example 25H2) and the OS build.
2. Find the KB number. Open Settings > Windows Update. A failed or pending update is listed with its KB number; earlier ones are under Update history.
3. Check the processor type. Open Settings > System > About and look at System type: an x64-based PC needs the x64 file, an ARM-based PC (for example Snapdragon) needs the arm64 file.
4. Search the catalog. Open the Microsoft Update Catalog at catalog.update.microsoft.com in your browser, type the KB number (for example KB5124010) in the search box and press Enter.
5. Pick the right row. Find the row whose title names your Windows version and your processor type (x64-based or arm64-based) and select Download on that row.
6. Download every file listed. A window lists one or more .msu links. Download all of them into one empty folder, for example C:\packages. On Windows 11 24H2 and later the list can include earlier checkpoint updates that the new one needs.
7. Install a single file. If there is only one file, double-click it and confirm the installation in the Windows Update Standalone Installer.

These steps were written for Windows 11 24H2 and later; Windows 10 22H2. The full page with the other versions and what each result means: Install an update from the Microsoft Update Catalog

If the error 0x80244018 is still there

When none of the fixes helped, the 403 comes from a part of the network you do not control. The update log tells you which server gave the answer, and that decides who can fix it.

1. Open PowerShell as administrator, type Get-WindowsUpdateLog and press Enter. The command writes WindowsUpdate.log to your desktop.
2. Open the file and search for 0x80244018.
3. Read the address in the lines around it. A Microsoft address means a proxy or filter on the way answered. A company address with port 8530 or 8531 means a WSUS server.

How to keep error 0x80244018 from coming back

If a security suite with its own web filter is installed, pausing its protection for one update check shows whether that filter answers 403. Turn it back on right after: Turn off Microsoft Defender protection for a moment

Frequently asked questions

What does error code 0x80244018 mean?

It means HTTP status 403: the server Windows Update contacted understood the request and refused it. Microsoft names the code WU_E_PT_HTTP_STATUS_FORBIDDEN. The update file on your PC is not damaged, and Windows is not broken. Something on the path to the update server, usually a VPN, a proxy, a web filter or a company WSUS server, sent the refusal. Find that part and the error goes away.

What does "Download error - 0x80244018" mean in Windows 11?

It is the Windows 11 way to show that the download of that update was refused with HTTP 403. The text appears next to the update in Settings > Windows Update, and Windows retries on its own. The retry fails in the same way while the cause is still there. Disconnect a VPN, turn off a manual proxy and check for updates again, as in Fix 1. If it works on a phone hotspot, a filter on your home network blocks it.

What is "There were problems downloading some updates, but we'll try again later" with 0x80244018?

It is the general Windows 10 message for a download that did not finish. The code in brackets tells why. With (0x80244018) the reason is a refused request, HTTP 403, not a damaged file and not a full disk. Windows tries again later by itself, but the result stays the same until the VPN, filter, proxy or update policy that refuses the request is changed. Start with Fix 1 on this page.

What does "Windows Update client failed to detect with error 0x80244018" mean?

It is an Event Viewer entry from the WindowsUpdateClient source. Detect means the search for updates, so the refusal came during the scan, before any download started. That points to the connection to the update server list rather than to one file. On a home PC check the VPN, filters and system proxy first. On a managed PC it usually means the WSUS server or a firewall in front of it refused the scan.

Can a VPN cause Windows update error 0x80244018?

Yes, and on home PCs it is the first thing to check. A VPN sends Windows Update traffic through its own servers, and a server on its side or a filter in its network can answer 403. Disconnect the VPN, restart and check for updates. Some VPN apps also leave a system proxy behind when they close, so run netsh winhttp show proxy as in Fix 3 if the error stays.

Is 0x80244018 the same as 0x80244017?

No, but they are close relatives and the fixes overlap. 0x80244017 is HTTP 401, which means the server wants a login, while 0x80244018 is HTTP 403, which means it refuses even with a login. Microsoft groups both with port, proxy, firewall and network problems. For the 401 code, read our guide to Windows Update error 0x80244017.

Should I turn off my antivirus to fix 0x80244018?

No. Local virus scanning does not make a server answer 403, so turning the antivirus off for good does not fix this code and leaves the PC open. The one exception is a security suite with its own web filter or proxy. Pause it for a single update check, and turn it back on right after. If the check works while it is paused, allow the Windows Update addresses in that suite's web filter.

Will running SFC and DISM fix 0x80244018?

Unlikely. SFC and DISM repair damaged system files, and a damaged file on your PC cannot make a server answer HTTP 403. They do no harm, but they take time that is better spent on the VPN, the filters and the proxy. Run them only if Windows Update shows other errors as well, or if the fixes on this page did not help and you plan to repair Windows.

Does the Media Creation Tool fix 0x80244018?

It can move Windows to a newer version past the error, because it downloads the full system through its own connection and reinstalls Windows over itself. It does not remove the cause. If a filter, proxy or policy refuses Windows Update, the next monthly update fails with the same code. Fix the path first, and keep the in place repair for when nothing else helped.

What is Downloadfehler 0x80244018?

Downloadfehler is the German Windows 11 text for Download error, so it is the same error as on this page: Windows Update was refused with HTTP 403. The fixes are the same in every language: the cause is the connection path, so start with the VPN and proxy check in Fix 1, then the filters in Fix 2. The menus sit in the same places in Settings, only their names are translated.