KB5132061 Won't Install? Fix 0x800f0993, 0x80070306 and 0x800f0989 (November 2026)

The November 2026 Patch Tuesday update, KB5132061, landed on November 10, and for a lot of people it isn't landing at all. It downloads, installs to about 99%, then rolls back with 0x800f0993, 0x80070306, 0x800f0989 or 0x800f0922. Retrying from Windows Update often gives the same result.

This is a security update with hundreds of fixes, so skipping it isn't a good idea. Below is what we know so far, the workaround that's helping many users, and a step-by-step path to get KB5132061 installed without resetting your PC.

Quick answer: If you use Windows Sandbox, turn it off in Turn Windows features on or off, restart, and install KB5132061 again. If that doesn't help, repair the component store with DISM /Online /Cleanup-Image /RestoreHealth and sfc /scannow, reset the update cache, or install the update manually from the Microsoft Update Catalog (with its checkpoint update). Microsoft hasn't listed this as a known issue yet, but reports say it's investigating.

Last updated: November 12, 2026. This is a developing issue; we'll update this guide when Microsoft confirms a cause or a fix.

Table of contents

• KB5132061 at a glance
• The errors people are seeing
• What Microsoft has said
• Quick troubleshooting flow
• Fix 1: Restart and retry
• Fix 2: Turn off Windows Sandbox temporarily
• Fix 3: Repair the component store (DISM + SFC)
• Fix 4: Reset Windows Update components
• Fix 5: Install KB5132061 manually
• Fix 6: Fix problems using Windows Update
• For IT admins
• Error code cheat sheet
• FAQ

KB5132061 at a glance

Windows version	Update	Build after install
Windows 11 26H2	KB5132061	26300.9974
Windows 11 25H2	KB5132061	26200.9974
Windows 11 24H2	KB5132061	26100.9974
Windows 11 23H2	KB5131087	22631.7711

Released November 10, 2026, it's a mandatory security update. Besides the security fixes it adds a customizable File Explorer right-click menu, per-monitor Magnifier zoom and the new Cloud rebuild recovery option. Some PCs need two or more restarts to finish installing it because of a pending Secure Boot certificate update, so a long "Restart required" loop on its own isn't a failure.

Check your build: press Win + R, type winver and press Enter.

The errors people are seeing

• 0x800f0993: the most common one. The install reaches the final stage and rolls back.
• 0x80070306: the download or install stops early; often shows as "Download error" in Windows Update.
• 0x800f0989: a servicing failure while the update is being staged.
• 0x800f0922: usually points to a problem with a system partition, a VPN blocking the update servers, or a feature the update can't finish configuring.

Many users report the install getting stuck at 99% before failing. You can find the exact code under Settings > Windows Update > Update history.

What Microsoft has said

At the time of writing, Microsoft's KB5132061 release notes say it isn't aware of any issues. However, Windows Latest reports that Microsoft is aware of the installation complaints and is investigating the root cause, including whether Windows Sandbox is involved. One user's logs pointed at a Sandbox-related file, but others saw the same errors with Sandbox off, so treat the Sandbox link as a strong lead, not a confirmed cause.

Quick troubleshooting flow

Try the steps in order and check Windows Update after each one.

Fix 1: Restart and retry

It sounds too simple, but several users got KB5132061 to install on the second or third attempt. Restart the PC (a full restart, not Shut down + power on, which uses Fast Startup), then open Settings > Windows Update and click Retry. If it fails again with the same code, move on.

Fix 2: Turn off Windows Sandbox temporarily

Windows Sandbox is only available on Windows 11 Pro, Enterprise and Education. If you're on Home, skip this step.

1. Press Win + R, type optionalfeatures and press Enter.
2. Untick Windows Sandbox and click OK.
3. Restart when asked.
4. Install KB5132061 from Windows Update again.
5. After it installs, turn Windows Sandbox back on the same way if you use it.

Prefer PowerShell? Run it as administrator:

Disable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM
# after the update installs:
Enable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM

Fix 3: Repair the component store (DISM + SFC)

Errors in the 0x800f09xx range often mean Windows can't build the new files from a damaged component store. Open Command Prompt as administrator and run:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Let DISM finish even if it seems stuck at one percentage. Restart, then retry the update. Our detailed guide to Windows Update error 0x80073712 covers DISM with an ISO source if RestoreHealth can't find clean files.

Fix 4: Reset Windows Update components

A broken download in the update cache can make every retry fail the same way. In an elevated Command Prompt:

net stop wuauserv
net stop bits
net stop cryptsvc
ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
ren %systemroot%\System32\catroot2 catroot2.old
net start cryptsvc
net start bits
net start wuauserv

Restart and check for updates. Also disconnect any third-party VPN while updating; it's a common cause of 0x800f0922.

Fix 5: Install KB5132061 manually

1. Open the Microsoft Update Catalog (catalog.update.microsoft.com) and search for KB5132061 (or KB5131087 on 23H2).
2. Pick the package for your version and architecture (x64, or ARM64 for Snapdragon PCs).
3. On 24H2 and 25H2, the catalog may also list a checkpoint update (KB5043080). Download it too if your PC doesn't have it yet; it must be installed before the November update.
4. Put the .msu files in one folder, for example C:\packages, and install from an elevated Command Prompt:

   DISM /Online /Add-Package /PackagePath:C:\packages\

   DISM installs the files in the right order when you point it at the folder.
5. Restart, possibly twice, and confirm the build with winver.

Download packages only from Microsoft's catalog, never from file-sharing sites.

Fix 6: Fix problems using Windows Update

If nothing else works, reinstall the current version of Windows in place. It keeps your apps, files and settings:

1. Back up important files (just in case).
2. Open Settings > System > Recovery.
3. Under Fix problems using Windows Update, click Reinstall now.
4. After it finishes, check for updates again.

Don't confuse this with the new Cloud rebuild option on the same page: Cloud rebuild removes all your files and apps. See our Cloud rebuild guide for the difference.

For IT admins

• Pilot first: deploy KB5132061 to a test ring before broad rollout while Microsoft investigates.
• Check Sandbox usage: if failures cluster on devices with Windows Sandbox enabled, disable it via script before the update and re-enable afterwards.
• Read the logs: C:\Windows\Logs\CBS\CBS.log and Get-WindowsUpdateLog (PowerShell) show which package failed.
• Don't forget Office: the most urgent fix this month, the exploited Outlook flaw, comes through Office updates, not KB5132061. Read our Outlook zero-day CVE-2026-124194 guide.
• Need scripts to check update status across machines? Try our PowerShell scripts for IT helpdesk.

Error code cheat sheet

Error	Most likely cause	Try first
0x800f0993	Install fails in the final stage	Fix 2 (Sandbox), then Fix 3
0x80070306	Download/staging failure	Fix 4 (reset cache), then Fix 5
0x800f0989	Servicing/component problem	Fix 3 (DISM + SFC)
0x800f0922	VPN, system partition or feature config	Disconnect VPN, then Fix 2 and Fix 5

FAQ

Is KB5132061 safe to install?

Yes. It's a security update and most PCs install it normally. The errors affect a minority of systems, and the fixes above don't put your data at risk.

Can I pause KB5132061 until Microsoft fixes it?

You can pause updates for a week or two under Settings > Windows Update, but don't stay unpatched for long. It's better to try the fixes and get the security updates installed.

Why does KB5132061 ask me to restart twice?

Some PCs also apply a pending Secure Boot certificate update, which needs an extra restart. That's expected behaviour, not an error.

Does turning off Windows Sandbox delete anything?

No. Sandbox doesn't keep data between sessions anyway. You can turn it back on after the update.

I'm on Windows 11 Home. What should I try?

Home doesn't have Windows Sandbox, so start with Fix 3 (DISM + SFC), then Fix 4 and Fix 5.

Does KB5132061 fix the Outlook zero-day?

No. The exploited Outlook flaw (CVE-2026-124194) is fixed by the November Office security updates. Update Office separately.

Still having trouble after October's updates too? See RDP error 0xC000000D and KB5127648 breaking 802.1X PEAP Wi-Fi.

Sources: Windows Latest (November 10–11, 2026), Windows Forum, Anoop C Nair (build numbers) and Microsoft's KB5132061 release notes. Checked on November 12, 2026.