How to fix Windows update error 0x8024401F?

Error 0x8024401F means that Windows Update asked a server for updates and got HTTP status 500 back: the server failed inside while it handled the request. Your update files are not the problem. Disconnect any VPN or proxy and try again later, then check whether the PC is pointed at a proxy or a company update server.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What Windows update error 0x8024401F means

In Microsoft's list of Windows Update error codes, 0x8024401F sits among the Protocol Talker errors, the part of the update client that talks to update servers over the web. Its name is WU_E_PT_HTTP_STATUS_SERVER_ERROR, and Microsoft describes it as "Same as HTTP status 500 - an error internal to the server prevented fulfilling the request."

Put simply, the request reached a server, and that server broke while it tried to answer. Your PC did nothing wrong in the request itself. The question is which server answered: Microsoft's update service, a VPN or proxy in the middle, or a company WSUS server that the PC is told to use.

Why Windows update error 0x8024401F appears

An HTTP 500 always comes from a server. So the causes are the servers on the path between your PC and the updates, and the settings that decide which path the PC takes. Ranked by how often they explain the error:

How to fix Windows update error 0x8024401F

Fixes 1 to 3 find what sits between a home PC and Microsoft, and solve most home cases. Fix 4 is for admins who run a WSUS server. Fixes 5 and 6 clear a stuck update session. Fix 7 installs one update by hand.

Fix 1. Disconnect the VPN, turn off a manual proxy and try again later

5 minutesNo riskEveryone on a home PC, first.

With the VPN and the manual proxy off, the request goes straight to Microsoft. If a server in the VPN or proxy chain was the one that failed, the error goes away at once. If Microsoft's side had a short failure, a later check also passes.

1. Disconnect your VPN and close any proxy app that routes your traffic.
2. Open Settings > Network & internet > Proxy (on Windows 10, Settings > Network & Internet > Proxy).
3. Under Manual proxy setup, check Use a proxy server. If you did not turn it on yourself, turn it off.
4. Restart the PC.
5. Open Settings > Windows Update and select Check for updates.
6. If the error returns, wait an hour and check again, or connect to your phone's hotspot and check there.

Fix 2. Check the system proxy with netsh winhttp and reset it

5 minutesLow riskThe error stays with the VPN off, or a VPN, proxy or company software was installed on the PC before.

Windows Update connects through WinHTTP, the system level connection, not through your browser settings. An old WinHTTP proxy can send update requests to a broken server while every website opens fine.

1. Press Win + S, type cmd, right-click Command Prompt and select Run as administrator.
2. Type netsh winhttp show proxy and press Enter.
3. If you see Direct access (no proxy server), the system proxy is not the cause. Go to Fix 3.
4. If a proxy server is named and you do not use one on purpose, type netsh winhttp reset proxy and press Enter.
5. If your network does need a proxy and your browser works through it, type netsh winhttp import proxy source=ie instead.
6. Restart the PC and select Check for updates.

netsh winhttp show proxy
netsh winhttp reset proxy

Fix 3. Check whether the PC is set to a WSUS server and remove an old policy

10 minutesRead the warningA used or former work or school PC, or a PC where a tool once changed the update settings.

A PC with a WUServer policy asks that server, not Microsoft, for updates. If the server is broken or gone, its web front end can answer every scan with HTTP 500, and nothing on the PC itself will help.

1. Open Command Prompt as administrator, as in Fix 2.
2. Type reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /s and press Enter.
3. If Windows cannot find the key, there is no such policy. Go to Fix 5.
4. If you see WUServer with an http:// or https:// address, often with port 8530 or 8531, the PC is set to use WSUS.
5. If a company or school still manages the PC, stop here and send that address and the error code to its IT team.
6. On your own PC with a leftover setting, back up the key first: Back up the registry before editing it.
7. Type reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /f and press Enter.
8. Restart the PC and select Check for updates.

Fix 4. Fix the WSUS server: WsusPool memory limit, queue length and recycling in IIS

15 minutesRead the warningYou run WSUS, alone or under Configuration Manager, and many clients fail to scan with 0x8024401F at the same time.

Microsoft explains that WSUS builds a large, memory hungry metadata cache, and that the IIS pool hosting it, WsusPool, recycles when it passes its default memory limits. Each recycle drops the cache, and during a scan storm clients get errors on their scan requests. Admins report 0x8024401F, the HTTP 500 form, in exactly this situation.

1. On the WSUS server, open IIS Manager and select Application Pools.
2. Select WsusPool and select Advanced Settings in the right pane.
3. Set Queue Length to 2000.
4. Set Private Memory Limit (KB) to 0, which means no limit, and set the virtual memory limit to 0 as well.
5. Set Idle Time-out (minutes) to 0 and Ping Enabled to False.
6. Under Recycling, set Regular Time Interval (minutes) to 0.
7. Select OK, then right-click WsusPool and select Start if it is stopped.
8. On one client, start a new scan and watch WUAHandler.log or WindowsUpdate.log for the result.

Fix 5. Run the Windows Update troubleshooter

5 minutesNo riskA home PC with a direct connection, no proxy and no policy, and the error stays after a restart.

The troubleshooter restarts the update services and clears a stuck session, so the next check starts fresh instead of repeating a request that failed earlier.

1. Open Troubleshoot settings. Select Start > Settings > System > Troubleshoot.
2. Open the list of troubleshooters. Select Other troubleshooters.

   

3. Run the Windows Update troubleshooter. Under Most frequent, select Run next to Windows Update. The Get Help app opens and starts the checks.

   

4. Read the result. Wait until Get Help finishes. If it found and fixed a problem, it says so and asks whether this solved the problem. Answer the question so it can offer the next step.

   

5. Restart the PC. Restart when the troubleshooter finishes, even if it does not ask you to.
6. Check for updates again. Select Start > Settings > Windows Update > Check for updates, and install the updates it finds.

These steps were written for Windows 11 (screenshots: 26H2). The full page with the other versions and what each result means: Run the Windows Update troubleshooter

Fix 6. Reset the Windows Update components

10 minutesLow riskThe troubleshooter found nothing, and the connection is direct.

Renaming the SoftwareDistribution and catroot2 folders throws away half finished downloads and the old scan state, so Windows Update starts a new session with the server.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

Fix 7. Install the update by hand from the Microsoft Update Catalog

10 minutesLow riskOne update keeps failing, or you are on a network you cannot change.

The catalog file comes through your browser, not through the Windows Update client, so it avoids the server that answers with HTTP 500. It installs the one update but leaves the cause in place.

1. Check your Windows version. Press Windows key + R, type winver and press Enter. Note the version (for example 25H2) and the OS build.
2. Find the KB number. Open Settings > Windows Update. A failed or pending update is listed with its KB number; earlier ones are under Update history.
3. Check the processor type. Open Settings > System > About and look at System type: an x64-based PC needs the x64 file, an ARM-based PC (for example Snapdragon) needs the arm64 file.
4. Search the catalog. Open the Microsoft Update Catalog at catalog.update.microsoft.com in your browser, type the KB number (for example KB5124010) in the search box and press Enter.
5. Pick the right row. Find the row whose title names your Windows version and your processor type (x64-based or arm64-based) and select Download on that row.
6. Download every file listed. A window lists one or more .msu links. Download all of them into one empty folder, for example C:\packages. On Windows 11 24H2 and later the list can include earlier checkpoint updates that the new one needs.
7. Install a single file. If there is only one file, double-click it and confirm the installation in the Windows Update Standalone Installer.

These steps were written for Windows 11 24H2 and later; Windows 10 22H2. The full page with the other versions and what each result means: Install an update from the Microsoft Update Catalog

If the error 0x8024401F is still there

When none of the fixes helped, the HTTP 500 comes from a server you do not control. The update log tells you which server gave the answer, and that decides who can fix it.

1. Open PowerShell as administrator, type Get-WindowsUpdateLog and press Enter. The command writes WindowsUpdate.log to your desktop.
2. Open the file and search for 8024401f.
3. Read the address in the lines around it. A Microsoft address means Microsoft's service or a proxy on the way failed. A company address with port 8530 or 8531 means a WSUS server.

How to keep error 0x8024401F from coming back

If a security suite with its own web filter or proxy is installed, pausing its protection for one update check shows whether that proxy is the server that fails. Turn it back on right after: Turn off Microsoft Defender protection for a moment

Frequently asked questions

What does error 0x8024401F mean?

It means HTTP status 500: the server Windows Update contacted hit an internal error and could not answer the request. Microsoft names the code WU_E_PT_HTTP_STATUS_SERVER_ERROR. Your update files are not damaged, and Windows itself is not broken. The server that failed is a VPN or proxy on the way, a company WSUS server, or, for a short time, Microsoft's own service. Find which one and the error goes away.

What does 0x8024401f(-2145107937) mean?

It is the same error written twice: once as the hex code 0x8024401F and once as the signed decimal number -2145107937. Some scripts, PowerShell output and management tools print both forms. The meaning does not change: a server answered Windows Update with HTTP 500. Use the fixes on this page in the same order, starting with the VPN and proxy check in Fix 1.

What is "There were some problems installing updates" with (0x8024401f)?

It is the general Windows 10 message for an update run that did not finish. The code in brackets tells why. With (0x8024401f) the reason is a server error, HTTP 500, during the check or the download, not a damaged file and not a full disk. Windows tries again later by itself, and a short failure on Microsoft's side clears that way. If it repeats for days, the cause is on the path, so start with Fix 1.

Why do WSUS clients fail with Scan failed with error 0x8024401f?

Because the WSUS server answered their scans with HTTP 500. In most reports the WSUS web service in IIS is overloaded: the WsusPool application pool hits its memory limit, recycles and drops its cache, and clients that scan at that moment get errors. Microsoft recommends a queue length of 2000, no private memory limit and no scheduled recycling for WsusPool. The steps are in Fix 4.

What does OnSearchComplete - failed to end search job error = 0x8024401f mean?

It is a line from WUAHandler.log on a Configuration Manager client. The client asked the WSUS server for applicable updates, and the search job ended with HTTP 500 from the server. It is a server side failure, so repairing the client rarely helps. Check WsusPool in IIS as in Fix 4, read the IIS logs for HTTP 500 lines at the same time, and make sure the WSUS database is maintained.

Can a VPN cause Windows update error 0x8024401F?

Yes. A VPN sends Windows Update traffic through its own servers, and when a server in that chain fails it can answer with HTTP 500. Disconnect the VPN, restart and check for updates. Some VPN apps also leave a system proxy behind after they close, so run netsh winhttp show proxy as in Fix 2 if the error stays without the VPN.

Is 0x8024401F the same as 0x80244018 or 0x80244022?

No, but they belong to the same family of HTTP answers. 0x8024401F is HTTP 500, a server error. 0x80244018 is HTTP 403, a refusal, and 0x80244022 is HTTP 503, a server too busy to answer. All three come from a server on the path, so the VPN, proxy and WSUS checks overlap. For the 403 code, read our guide to Windows Update error 0x80244018.

Does 0x8024401F happen on Windows 11 too?

Yes. The code belongs to the Windows Update client, which works the same way on Windows 11 and Windows 10. Windows 11 shows it in Settings > Windows Update, and the fixes are the same: the menus for the proxy are under Settings > Network & internet > Proxy. The old reader question on this page mentions Windows 10 21H2, which has long been out of support, so updating to 22H2 or Windows 11 is worth doing once the error is gone.

Should I turn off my antivirus or run SFC to fix 0x8024401F?

Neither is a real fix. Local virus scanning and damaged system files cannot make a server answer HTTP 500. Turning the antivirus off for good leaves the PC open and changes nothing. The one exception is a security suite with its own proxy or web filter: pause it for a single update check and turn it back on right after. If the check works while it is paused, that suite's proxy is the server that fails.

I did everything and the same error came back. What now?

Then the server that fails is outside your PC. Run Get-WindowsUpdateLog as shown in "If the error is still there" and read which address answered with 0x8024401F. A company address means the WSUS server, so IT must fix it. A Microsoft address on a home PC usually means a short failure on Microsoft's side, so try again later. This also answers readers who wrote to us that it did not help or that the same error came back.