Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 20 Source: WindowsUpdateAgent

Installation Failure: Windows failed to install the following update with error <error code>: <update>.


Windows failed to install the following update with error 0x8007f004: Security Update for Windows 2000 (KB901214).
Error code 0x8007054f - In my case, an infection by rootkit 'Rootkit.TDSS.BQ' made it impossible to install only two updates. The installation of KB2676562 and KB2633171 failed. After cleaning the system with Kasperskys TDSSKiller the errors where gone. See EV100367 (Anti-rootkit utility TDSSKiller).
Error code 0x80246007 - Create a repair.bat batch file with following commands:

net stop wuauserv
cd %systemroot%\SoftwareDistribution
ren Download Download.old
net start wuauserv
net stop bits
net start bits
net stop cryptsvc
cd %systemroot%\system32
ren catroot2 catroot2old
net start cryptsvc

Execute the batch file and install the update again. If it works, you can delete the folders Download.old and catroot2old. See ME958042 for details.
The troubleshooting of this event depends on the actual error code reported in the event description. There could be many reasons for an update failure but the suggestions found on various website should be followed only if the error code matches the one reported in your particular case.


- Error code 0x8007f076 = Indicates that the system does not have the required service pack for this update. To fix install first the latest service pack for this operating system and then retry the update.
- Error code 0x800703e3 = The I/O operation has been aborted because of either a thread exit or an application request
- Error code 0x80242000 =  The caller requested a remote object, but no remote process is available.
- Error code 0x8007f004 = You do not have permission to update. Obviously for certain installs one needs to have administrative rights. Retry the installation when logged in as a local administrator.

T735642 suggests that in some conditions a system restart might fix the problem while ME906602 provides information on how to troubleshoot common Windows Update, Microsoft Update, and Windows Server Update Services installation issues.
Ensure you have all the permissions required by the update agent to allow the update to be installed. See ME888791 for details. Check your local Security Group Policy. If you are on a server, check the domain controller policies. Read the C:\windows\WindowsUpdate.log file for more details.
- Error code 0x80070643, update: "Visual Studio 2005 Service Pack 1" - I was getting this error on several Windows Server 2003 systems. Installing the hotfix from ME925336 fixed the problem.

The error occurred whilst trying to update Office 2003 SP2 with WSUS also producing an error. The problem was caused by the removal\change of the Office installation Path. As per Microsoft ME903776, this problem was solved by clearing the LIS path using the LIS (Local Installation Source) tool.
- Error code 0x80070643 - Go to ME830168 and download the Local Installation Source Tool (ListTool). My MSOCache was corrupt. Deleting and disabling it fixed the problem. The solution for this error is very obscure and it took a lot of digging to find it.
See ME822798 for troubleshooting tips on errors regarding Windows Update Agent or the Automatic Updates service.
There are a couple of articles on Microsoft’s website dealing with this problem. Usually, it indicates that the Office Source Engine service is set to disabled. It has to be set to manual for it to run. If it is, then the actual OSE.exe file could be corrupt. See ME903772 and ME903774 for more information.
In our environment, this was caused by a lack of privilege, stemming from an error in group policy. If the users attempting to run Windows Update do not have "Back up files and directories" user privilege, the update will fail generating this error.
"EventID 20 from source Automatic Updates" provides information on these errors.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.