Windows 10 and 11 Update Error 80092004 (0x80092004): How to Fix It
When attempting to install a cumulative update or a security patch via Windows Update on Windows 10 or Windows 11, the process may suddenly halt and throw error 80092004 (full hex code: 0x80092004). The update downloads, progresses to a certain percentage, and then fails.
Windows Update failure with error 0x80092004 in Windows 10 and 11
Quick Answer: The code 0x80092004 stands for CRYPT_E_NOT_FOUND (“Cannot find object or property”). It indicates that Windows could not locate or verify the cryptographic digital signature of the update package. In most cases, the culprits are insufficient disk space on drive C to extract setup files, corrupted .NET Framework manifests, or a damaged update cache. Below are the verified solutions arranged from the simplest to the most comprehensive.
What Helped Me: Free Disk Space on Drive C
Initially on my laptop, I went the standard route and decided to run integrity scans on system files. During the process, I noticed that drive C had only about 930 MB of free space remaining. A reasonable suspicion arose: the update archive had downloaded, but the installer physically lacked space to unpack the temporary payloads.
After performing a quick cleanup and freeing up 4 GB, the cumulative update installed immediately without a single error!
Therefore, the very first thing you should do is check available free space on your system drive. Routine monthly patches need 3–5 GB, while major feature updates on Windows 10 and 11 require at least 15–20 GB of headroom.
The fastest way to clean up space is with Windows’ built-in utility:
- Press Win + R, type
cleanmgr, and press Enter. - Select your system drive C: and click “Clean up system files”.
- Check “Windows Update Cleanup”, “Temporary files”, and “Previous Windows installation(s)” (if available).
Common Culprit: .NET Framework Update Glitches
If your system drive has plenty of free space but error 0x80092004 persistently occurs when installing updates for the .NET Framework (versions 3.5, 4.8, or 4.8.1), corrupted .NET cryptographic manifests are almost certainly to blame.
To fix this, use the official free repair utility from Microsoft:
- Download the Microsoft .NET Framework Repair Tool (file
NetFxRepairTool.exe) from Microsoft’s official download center. - Run the tool as administrator, accept the license terms, and click Next.
- The utility will automatically diagnose .NET components, fix corrupted registry entries, and restart related system services.
- Once completed, reboot your computer and check for updates again.
Repair System Files (DISM and SFC)
If the Windows Component Store (the WinSxS directory) itself is damaged, Windows Update cannot validate package certificates. To repair it, open Command Prompt (CMD) as administrator and run the following two commands in sequence:
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow
DISM will connect to Microsoft Update servers to download fresh copies of corrupted files for the component store, while SFC will repair any modified or damaged core system files. Once the scans complete, restart your PC.
Reset Update Cache and the Catroot2 Folder
Windows stores downloaded setup files in the SoftwareDistribution directory and cryptographic signatures in catroot2. When files in these folders become corrupted, updates repeatedly fail with 0x80092004.
Open Command Prompt as administrator and stop the update services:
net stop wuauserv net stop cryptSvc net stop bits net stop msiserver
Rename both cache directories (Windows will recreate fresh, uncorrupted versions on the next check):
ren %windir%\SoftwareDistribution SoftwareDistribution.old ren %windir%\System32\catroot2 catroot2.old
Restart the services:
net start wuauserv net start cryptSvc net start bits net start msiserver
Tip: If renaming catroot2 gives an “Access Denied” error or states the folder is in use, wait 10–15 seconds for the Cryptographic Service to fully unload from memory and retry the command.
Install the Update Manually via Microsoft Update Catalog
If the update still fails through the Settings app, you can install the standalone package directly:
- Note the KB number of the failing update (for example,
KB5034441or similar). - Visit the official Microsoft Update Catalog.
- Type the KB number into the search bar, download the standalone installer (
.msufile) for your architecture (x64 or ARM64), and run it. - If the cumulative update refuses to install, search for and install the latest SSU (Servicing Stack Update) for your Windows build first, reboot, and then install the main package.
Historical Context: Windows 7 and the SHA-2 Migration
In the summer and autumn of 2019, users of Windows 7 SP1 and Windows Server 2008 R2 encountered error 80092004 en masse when trying to install security updates KB4512506 and KB4512486. The cause was Microsoft’s transition to signing updates exclusively with the SHA-2 algorithm instead of obsolete SHA-1. For Windows 7, the solution was pre-installing updates KB4474419 (adding SHA-2 support) and KB4490628 (the SSU update).
Windows 11 Specifics
Windows 11 shares the same servicing stack architecture, so encountering error 0x80092004 is resolved by the exact same procedures: ensuring sufficient system disk space (at least 15–20 GB), running the .NET Repair Tool, and resetting the SoftwareDistribution and catroot2 folders.