Fix Windows Update error 0x80070643

0x80070643 is a general error meaning an installation has failed

Error code 0x80070643 stands for ERROR_INSTALL_FAILURE: something went wrong during the installation of an update, but the code itself does not say what. Windows displays it in very different situations, from a regular quality update to a standalone .NET Framework or security update.

The code is therefore a catch-all message. The solution depends on which update failed. By far the most famous since early 2024 is the recovery environment update KB5034441 on Windows 10 (and KB5034440 on Windows 11 22H2 and 23H2). That fails due to a recovery partition that is too small, requiring a different approach than a normal update failure.

You may also encounter the code with Microsoft Defender updates, during installation of security intelligence, and sometimes while updating a separate programme that uses the Windows Installer. In all those cases, the meaning is the same: the installation process stopped halfway and rolled itself back.

This guide works through the solutions from simple to thorough: first the built-in troubleshooter, then the specific fix for the recovery partition, and finally resetting the Windows Update components and repairing system files. Follow the order and test after each step whether the update now completes, so you don't change more than necessary.

The error usually has one of three causes

Before you change anything, it's useful to know which update failed. Go to Settings > Windows Update > Update history and check which update failed with 0x80070643. That points you to the correct solution. Note the KB number after the failed update, as that number determines which of the three routes below you need.

The update KB5034441 closes a security vulnerability in the recovery environment (CVE-2024-20666) that allowed bypassing BitLocker encryption via Secure Boot. This vulnerability and the associated firmware check belong to the same security layer that you configure when you enable Secure Boot in the UEFI.

The reason this particular update fails so often is historical. Many PCs were originally set up with a recovery partition just large enough for the recovery environment at that time. When the update made that environment larger, it no longer fit in the existing partition. Microsoft tried to automatically enlarge the partition, but it did not work on all systems, so the manual approach often remained the only way out.

Begin with the troubleshooter and a clean restart

For a regular quality update, the built-in troubleshooter often already resolves it. Try these quick steps first.

1. Open Settings > System > Troubleshoot > Other troubleshooters.
2. Click Run next to Windows Update and follow the instructions.
3. Restart the PC and try the update again via Windows Update > Check for updates.
4. Temporarily disable any third-party antivirus if it blocks the installation, and turn it back on afterwards.
5. Make sure there is enough free disk space on the system drive; a full C: drive can cause updates to fail.
6. Use a stable internet connection; a partial download due to a dropped connection can cause the same error.

If the error keeps occurring on exactly the same update, move on to the targeted solution that belongs to that update.

A clean restart is deliberately the first step. After a normal shutdown, Windows keeps part of the system in a fast startup mode, which can lock files and block an update. Therefore, in the Start menu, choose Restart instead of shutting down and powering on again, because only a true restart releases those locks and gives the update a clean start.

Enlarge the recovery partition for KB5034441 and KB5034440

If the recovery environment update fails, the WinRE partition is too small. WinRE stands for Windows Recovery Environment, the separate recovery environment with which you can repair Windows if it no longer starts. Microsoft requires at least 250 MB free space on that partition for the new version. First check the status in a command prompt with administrator rights:

reagentc /info

If the status is Enabled, WinRE is active and you can enlarge the partition. If BitLocker is on, suspend it first to avoid being asked for your recovery key at restart. The sequence below disables WinRE, shrinks the system partition by 250 MB, and creates a new, larger recovery partition on a GPT disk.

reagentc /disable
diskpart
list disk
sel disk 0
list part
sel part <system partition>
shrink desired=250 minimum=250
sel part <recovery partition>
delete partition override
create partition primary id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
gpt attributes=0x8000000000000001
format quick fs=ntfs label="Windows RE tools"
exit
reagentc /enable

Replace the partition numbers with the numbers shown by list part. On an older disk with MBR layout, use create partition primary id=27 instead of the GPT line with the long identifier, and omit the gpt attributes line. If you are unsure about the disk layout, check it first, because the wrong variant makes the recovery partition unusable.

After that, check with reagentc /info whether WinRE is Enabled again, and try the update again. If you want to save the effort and you don't need the recovery environment, you may also pause this specific update until you want to install it. The exact partition steps are in the Microsoft support article KB5028997 about manually enlarging the recovery partition.

Reset the Windows Update components when the cache is corrupted

If a regular update gets stuck repeatedly, the update cache is often corrupted. You stop the involved services, rename the two cache folders and restart everything. This approach resolves a large proportion of recurring update errors. Run the commands one by one in a command prompt with administrator rights.

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserver

Windows will rebuild the SoftwareDistribution and catroot2 folders automatically afterwards. Restart the PC and check for updates again. This reset does not remove any personal files; it only clears the temporary update files.

The SoftwareDistribution folder contains the downloaded updates that still need to be installed. If a file there becomes damaged, for example due to an interrupted download or a full disk, Windows keeps using that same damaged file and the installation fails repeatedly. By renaming the folder, you force Windows to download everything fresh. You can later delete the renamed .old folders once updates work again.

Repair damaged system files with SFC and DISM

If resetting doesn't help, damaged system files may be blocking the installation. Two built-in tools detect and repair them. Run them in this order in an administrator command prompt window.

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

DISM fetches a clean copy of the system files via Windows Update and repairs the underlying installation image. Then sfc /scannow checks the protected system files and replaces damaged copies. Allow ten to thirty minutes per command. When finished, restart and try the update again.

The order is not arbitrary. SFC repairs damaged files from a local store, but if that store itself is damaged, the repair fails. DISM first repairs that store with fresh files from Microsoft, after which SFC can work reliably. If SFC reports that it repaired damaged files, run the command a second time to check that everything is now clean.

Resolve .NET Framework errors with the repair tool

If the failed update refers to .NET Framework, none of the above steps work properly. .NET Framework is a separate software layer that many programmes use, and its updates install independently from the regular Windows components. Therefore, use the free Microsoft .NET Framework Repair Tool. It detects common problems with the .NET installation and repairs them automatically.

1. Download the .NET Framework Repair Tool from Microsoft.
2. Run the tool and let it apply the recommended repair actions.
3. Restart and install the update via Windows Update.

If activation hangs after a successful update or reinstall, something other than an update error is going on. In that case, look at restoring your Windows licence after a hardware change, because a changed configuration can affect the activation status.

Prevent recurrence with space, restarts and the correct order

Most 0x80070643 messages come back because an underlying cause has not been removed. With a few habits you keep updates running smoothly.

• Keep free space on C: leave at least several gigabytes free so that updates can place their temporary files.
• Regularly perform a true restart: a PC that stays in sleep mode for weeks collects half-installed updates.
• Install updates in order: a servicing stack update sometimes must come before a quality update; do not skip updates.
• Check your antivirus: third-party security software that locks files is a recurring cause of installation errors.

Work through the solutions in this guide in the order listed; there is a good chance the error disappears already at the troubleshooter or recovery partition step. If the same update still fails afterwards, that indicates a deeper problem with the installation image, and a clean installation provides the surest way out.