Event ID 20 WindowsUpdateClient Installation Failure and How to Find the Cause

Event ID 20 from Microsoft-Windows-WindowsUpdateClient is the event Windows writes when an update fails to install. It is an Error in the System log, under the task category Windows Update Agent. The message reads "Installation Failure: Windows failed to install the following update with error" followed by the error code and the update's name with its KB number. Microsoft's own example of the event is "Installation Failure: Windows failed to install the following update with error 0x80070002: Security Update for Windows (KB4586793)."

The matching success event is event 19 from the same source, which reads "Installation Successful: Windows successfully installed the following update" followed by the update's name.

What it means

Windows Update downloaded the update and the install step failed. The event names the update and the error code, but not the component that failed. The detail is in the servicing log, CBS.log, which records every package install and the error that stopped it.

How to find the cause

List the recent install results on the affected machine from an elevated PowerShell prompt. Events 19 and 20 together show which updates succeeded, which failed, and whether the same update fails on every attempt.

Get-WinEvent -FilterHashtable @{
    LogName      = 'System'
    ProviderName = 'Microsoft-Windows-WindowsUpdateClient'
    Id           = 19, 20
} -MaxEvents 30 | Select-Object TimeCreated, Id, Message | Format-List

Note the error code and the KB number from the newest event 20, then look up the code in the table of common corruption errors in Microsoft's article Fix Windows Update corruptions and installation failures. Codes such as 0x800f0831 (CBS_E_STORE_CORRUPTION) and 0x80073712 (ERROR_SXS_COMPONENT_STORE_CORRUPT) point at the component store.

Search CBS.log for the same error code to find the component that failed. The log is at C:\Windows\Logs\CBS\CBS.log, and older entries roll over into CBSpersist files in the same folder. Replace the code below with the one from your event.

Select-String -Path C:\Windows\Logs\CBS\CBS.log -Pattern '0x80070002' -SimpleMatch | Select-Object -First 10

Read the first match by time. The lines around it point to the package or installer that failed.

For the Windows Update client's own trace, build the Windows Update log. Windows Update writes .etl trace files, and this command merges them into one readable WindowsUpdate.log on the current user's desktop.

Get-WindowsUpdateLog

When several machines fail the same update, run the event query on three or four of them. The same error code and KB number on every machine points at something those machines share more than at one damaged machine.

Fixes

When the error code is one of the component store errors in Microsoft's table, repair the component store, then check the system files, then retry the update.

DISM.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannow

When the machine can't reach Windows Update, or DISM reports 0x800F081F (CBS_E_SOURCE_MISSING), point the repair at a source running the same Windows version.

DISM.exe /Online /Cleanup-Image /RestoreHealth /Source:\\<servername>\c$\windows /LimitAccess

When the error code is 0x8024002E (WU_E_WU_DISABLED), turn the Windows Update client service back on, then retry the update.

When the update installs, asks for a restart, and then rolls back, find the failing component in CBS.log as above and fix that component. Microsoft's article on 0x80070002 includes a cumulative update on Windows Server that rolled back after a restart, where CBS.log pointed at a driver.

When the error code is 0x800f0922, follow the steps on its own reference page below.

Related events and errors

• Event 19 from WindowsUpdateClient, the successful install of an update.
• 0x800F0922 CBS_E_INSTALLERS_FAILED, an update that fails while its installers run and then rolls back.
• 0x80070002, documented by Microsoft in Troubleshoot Windows Update error 0x80070002.

Where ET Ducky shows it

I build ET Ducky, and its patch management talks to the Windows Update Agent directly and installs updates by KB number. You'd tag a few machines as your first ring and schedule updates to that tag before the rest. A patch is marked successful only when the kernel events show services back up with no crash loops. The deployment moves to the next ring only after the machines in the current ring pass that check, and a regression in a ring pauses the deployment. You can also open a Live Session shell from the browser without the need for a VPN and run the commands above on each machine.

Sources

• Microsoft Learn, Troubleshoot Windows Update error 0x80070002, read 2026-10-21.
• Microsoft Learn, Event ID 20, WUA Update Installation, read 2026-10-21.
• Microsoft Learn, Troubleshoot unexpected reboots using system event logs, read 2026-10-21.
• Microsoft Learn, Fix Windows Update corruptions and installation failures, read 2026-10-21.
• Microsoft Learn, Get-WinEvent, read 2026-10-21.
• Microsoft Learn, Select-String, read 2026-10-21.
• Microsoft Learn, Get-WindowsUpdateLog, read 2026-10-21.