Windows Update usually patches itself without complaint. Sometimes it doesn't: the bar freezes at 0%, an update is marked as failed and never retried, or one specific fix never appears in the list at all. You don't have to wait for the queue to sort itself out — you can pull the package from Microsoft's public catalog and install it by hand.

I've used this route on 24H2 and 26H2 machines, and once you know which KB you're chasing it takes about ten minutes. Below is the sequence I follow, including the two checks that keep a half-finished install from ruining your afternoon.

One clarification up front: this is for a single security fix. If the thing that never arrives is a whole version upgrade, that's a different procedure with a different toolset.

Two terms come up constantly:

  • KB number — Microsoft's article ID for one specific update, e.g. KB5031234.
  • MSU — Microsoft Update Standalone package, a single installer file you can double-click. That is exactly what the Catalog hands you.

What you need before you start

  • A Windows 11 PC where your account is an administrator. If a UAC prompt appears, you qualify.
  • The KB number of the missing security update.
  • Your build number — via Win+R → winver, or Settings → System → About.
  • 2–3 GB of free space on C:. Cumulative updates are large, and the unpacked temp files need room too.
  • A browser on catalog.update.microsoft.com, Microsoft's official public download site for updates.
  • A folder for the package, for example C:\Updates.
  • A reasonably clean state: work saved, documents closed, reboot acceptable.

My pre-flight list looks like this:

  • [ ] admin rights confirmed
  • [ ] KB number written down
  • [ ] build number written down
  • [ ] 2–3 GB free on C:
  • [ ] C:\Updates created
  • [ ] Catalog open in the browser
  • [ ] files saved

Step 1: Note your build number and the KB ID

Press Win+R, type winver, hit Enter. A window shows something like Version 24H2 and OS Build 26100.xxxx. The digits after the dot are the important ones: Catalog packages are tied to a build family, and choosing the wrong family ends in not applicable to your computer.

Then open Settings → Windows Update → Update history. Failed and partially installed items are listed there with their KB IDs. That history is the authoritative record of what Windows itself attempted, which makes it the best place to find the exact number.

What you should walk away with: a version string, a full build number, and one KB ID such as KB5031234.

Step 2: Find the matching package in the Catalog

Go to catalog.update.microsoft.com, paste the KB number into the search field, press Search. Searching KB5031234 returns a short list of rows like 2025-01 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5031234), each with a size and a date.

Before clicking anything, match three attributes:

  1. Windows 11 version (24H2, 26H2, and so on).
  2. Architecture — x64-based Systems for Intel/AMD, ARM64-based Systems for Snapdragon-class chips.
  3. Date — if you're missing the January patch, take the January row.

A 24H2 x64 machine needs the x64-based Systems row; the ARM64 one will go nowhere. Pick exactly one row and be able to explain why the rest don't apply.

Step 3: Download and verify the .msu

Click Download on the chosen row. A small page opens with a .msu link — click it and save into C:\Updates. The filename looks roughly like windows11.0-kb5031234-x64_abc123.msu.

Compare the file size with the size shown in the Catalog listing. If it's noticeably smaller, the transfer was cut short: delete it and download again.

Then verify the file before touching the installer. Open PowerShell as administrator:

Get-ChildItem C:\Updates\*.msu | Select-Object Name, Length, LastWriteTime Get-FileHash C:\Updates\*.msu -Algorithm SHA256

Length should roughly match the Catalog size, and the hash should print without errors. Why care? A truncated .msu dies halfway through with a cryptic error code, and you only learn that after a reboot.

Step 4: Install it from an elevated command line

In the same PowerShell window:

wusa.exe "C:\Updates\windows11.0-kb5031234-x64_abc123.msu" /quiet /norestart

wusa.exe is the Windows Update Standalone Installer — the built-in tool that consumes .msu files. /quiet suppresses the UI and /norestart keeps it from rebooting behind your back.

The command returns silently after a while. Check the result:

$LASTEXITCODE

Zero means it worked.

Step 5: Reboot, then prove it landed

Open Settings → Windows Update and wait for the Restart required banner, then restart normally. Don't hold the power button while Working on updates is on screen — that's how a servicing stack ends up half-written.

After the desktop comes back:

Get-HotFix | Where-Object HotFixID -eq 'KB5031234' Get-ComputerInfo | Select-Object WindowsProductName, OsBuildNumber

The first command should print a row with the KB ID and today's date; the second should show a build number higher than the one from step 1. The same KB also shows up in Settings → Windows Update → Update history.

Last bit of housekeeping: delete the .msu from C:\Updates and take the space back.

When it goes sideways

Error 0x800f081e, or the update is not applicable to your computer. The package doesn't match your build or architecture, or it's already installed. Re-read winver against the Catalog row, double-check x64 vs ARM64, and run Get-HotFix — if the KB is already listed, there is nothing left to do.

Error 0x800f0823, or a message about needing a restart. A previously staged update is still holding the servicing stack. Do a full restart (Start → Power → Restart, not fast startup) and run the wusa.exe command again. If the same Catalog search also shows a Servicing Stack Update (SSU), install that first: the SSU is the component that lets Windows install anything else.

The download stalls or the page spins forever. Try the other link on the list, turn off VPN or proxy, switch browsers. Then repeat the size and hash check from step 3 — a half-downloaded file is the single most common reason an install fails.

The build number is unchanged after the reboot. The package installed but was superseded or rolled back. Look at Update history for the failed entry and let Windows Update fetch the newest cumulative update instead — a cumulative update already contains every earlier fix for that build.

Two questions I get asked a lot: do you need to do this for every security update? No — Windows Update handles that routine. The Catalog is a repair path for when the automatic route breaks or when one specific KB has to land on a machine where Windows Update is blocked. And is it safe to download from the Catalog? Yes, catalog.update.microsoft.com is Microsoft's own repository, the same source Windows Update pulls from. What you should avoid is grabbing .msu files from random third-party download sites.

Manual installation isn't a weekly habit — Windows Update is faster and less error-prone. But knowing the path (identify the KB, match the architecture, verify the hash, install with wusa.exe, confirm with Get-HotFix) turns a stuck patch from a mystery into a ten-minute chore. The two habits worth keeping are the hash check before installing and the build-number check after the reboot; the rest is just clicking.

This article was originally published on AI Release — https://ai-release.org. More short, practical guides land regularly on the channel: https://t.me/ai_release1.