Over 600 Domain computers won't get windows updates

pseymour · Jul 8, 2025

certutil also has a -syncWithWU switch that, well, syncs with WU. :)

garlin · Jul 9, 2025

pjudkins said:
That key doesn't exist on this machine

That's very strange. A clean install (just did one) creates an empty sub-tree hierarchy for AuthRoot.

Wonder if a domain-wide "extinction event" clobbered this key (or another setting) at the same time. And it doesn't show up for machines created since then.

TairikuOkami · Jul 9, 2025

pjudkins said:
The only common denominator I can find is it looks like all of these were upgraded from windows 10 to windows 11.

Windows does not handle upgrades well, usually a second upgrade or a repair upgrade fixes that.
I would reset Catroot2 to see, what happens, eventually SoftwareDistribution's Download folder.

pseymour · Jul 9, 2025

No need to reset any folders. OP has already found that it’s a certificate issue. The only remaining item is figuring out what caused the cert issue.

pjudkins · Jul 9, 2025

Tester said:
Can you try to manual trigger the cert update to see if that works?
terminal with adminrights.
certutil -pulse

afterwards check with (can take a few seconds after pulse before output shows:
certutil -verifyctl AuthRoot | findstr /i "lastsynctime"

The pulse completed successfully, The last sync time still shows a date of 3/21/2024, I waited about 10 minutes to give it a chance to and did the sync time again and it still didn't change.

pjudkins · Jul 10, 2025

pseymour said:
certutil also has a -syncWithWU switch that, well, syncs with WU. :)

I still haven't found the cause, but the fix appears to be working, I'm going to have cybersecurity push a GPO to all 652 remaining computers with the issue, then I will spot check 50 or so to make sure they are doing updates.

Can you tell me the full syncwithWU command?

pjudkins · Jul 10, 2025

garlin said:
That's very strange. A clean install (just did one) creates an empty sub-tree hierarchy for AuthRoot.

Wonder if a domain-wide "extinction event" clobbered this key (or another setting) at the same time. And it doesn't show up for machines created since then.

we use lansweeper to monitor all of our network devices, I cant find a single computer on our domain with that key

pjudkins · Sep 18, 2025

pseymour said:
No need to reset any folders. OP has already found that it’s a certificate issue. The only remaining item is figuring out what caused the cert issue.

Question, we applied a new Authroot cert to most of the affected machines, now it looks like it only does updates for a few days on that certificate then it's back to not doing updates again. Any ideas?

pseymour · Sep 18, 2025

Head back to the logs (post 4). They really are your friend here.

pjudkins · Sep 25, 2025

pseymour said:
Head back to the logs (post 4). They really are your friend here.

Unfortunately, those logs are foreign language to me, I'm no expert in reading logs and figuring out what the issue is.

pseymour · Sep 25, 2025

Attach them here if they're small enough, or put them in some cloudy storage, and folks will take a look.

cereberus · Sep 25, 2025

In all honesty, this site is more geared to consumer versions of Windows rather than domain based corporate versions.

You should contact MS Support for advice.

This link might help?

Volume License Key Phone Numbers | Microsoft Volume Licensing

Access Microsoft Activation Centers for support with product activation and licensing. Find contact details and resources to ensure your software is properly licensed.

www.microsoft.com

pjudkins · Sep 25, 2025

Below is the log on the one I'm working on. It is doing updates currently, but the last sync date on the authroot cert is 9/17/2025

Dropbox

www.dropbox.com

andrew129260 · Sep 25, 2025

pjudkins said:
I desperately need help! We have 3200+/- total domain computers all on windows 11, mostly Enterprise and some on Pro, 600+ of them haven't done updates since either November of 2024 or August of 2023. They get an error when trying to do updates that says, "We couldn't connect to the update service". I have tried many things, verified all the Registry setting were correct, update troubleshooter fails, I can ping the update serves successfully from a CMD prompt, restarted services, deleted software distribution and other folders, I can manually push updates, but it won't auto pull them. Any help would be greatly appreciated.

I too had some machines do this as well at my station, and was unsure why. I never thought to look at the certificates. Luckily it was only around 3 machines in our building that were doing that, so it was fixed with a reimage.

Still odd though. I will keep an eye on this thread should I come across any more.

pjudkins · Sep 25, 2025

andrew129260 said:
I too had some machines do this as well at my station, and was unsure why. I never thought to look at the certificates. Luckily it was only around 3 machines in our org that were doing that, so it was fixed with a reimage.

Still odd though. I will keep an eye on this thread should I come across any more.

yea, I have so many of them, reimaging is not an option, they are spread all over the state of Arkansas. The list I pulled this morning was 414 devices.

pseymour · Sep 25, 2025

When you say it's doing updates, does that mean it's working? We should probably look at one that isn't working.

Regardless, you have a lot of 0x80070032 errors (request not supported) when trying to do AppX updates. The ones that are failing seem to be

756C33C9-8D18-4224-988F-911889331C84 - Microsoft.NET.Native.Runtime.1.7
95BFB018-ECDB-44EC-9464-9F8C53B38172 - Microsoft.VCLibs.140.00
7DAB5818-B936-45AE-BA63-7F4011707BCA - Microsoft.XboxApp
75FFE6C0-5EAD-4041-B6FA-EAAE0C696169 - Microsoft.NET.Native.Framework.1.7

You can try the DISM/SFC dance, a wsreset to reset the Store, or the ol' re-register all the Store apps.

Powershell:

Get-AppxPackage -AllUsers| Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

pseymour · Sep 25, 2025

I should add that, as you mentioned, your cert sync time is a little old. Until you track down what's keeping that from working, you're going to keep having this problem.

andrew129260 · Sep 25, 2025

pjudkins said:
Can you tell me the full syncwithWU command?

certutil -syncWithWU -f AuthRoot
certutil -syncWithWU -f Disallowed

This should be helpful:

Configure trusted roots and disallowed certificates in Windows

Guidance on how to configure individual software updates for automatic daily Root Certificate Updates, including certificate trust lists (CTLs)

learn.microsoft.com

You can manually update them:
certutil -f -addstore Root authrootstl.cab

You can download the latest here:

https://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

garlin · Sep 25, 2025

If something's breaking that process, asheroto's been writing (for a few years) a background tool to fetch/certuil them.
GitHub - asheroto/UpdateRootCertificates: Downloads and installs updated root and disallowed certificates on Windows. No settings are changed. Windows Update not required.

pjudkins · Sep 25, 2025

pseymour said:
I should add that, as you mentioned, your cert sync time is a little old. Until you track down what's keeping that from working, you're going to keep having this problem.

Correct, that's what I'm trying to fix. While this computer is doing updates, the Auth root cert hasn't synced since the 17th of this month. I am assuming that should be syncing every day. If I can fix this issue it will in turn resolve the update issue.

Over 600 Domain computers won't get windows updates

putting the mental back in experimental

My Computer

Well-known member

Attachments

My Computer

Microsoft 365 Basic

My Computer

putting the mental back in experimental

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

putting the mental back in experimental

My Computer

New member

My Computer

putting the mental back in experimental

My Computer

Well-known member

My Computer

New member

My Computer

Well-known member

My Computers

New member

My Computer

putting the mental back in experimental

My Computer

putting the mental back in experimental

My Computer

Well-known member

My Computers

Well-known member

My Computer

New member

My Computer