Unable to install Win1125H2 monthly cumulative updates to non-internet connected PCs

Question

Unable to install Win1125H2 monthly cumulative updates to non-internet connected PCs

Leslie 0

I have the following issue windows11 25H2, I'm using WSUS server to push the updates to 2 groups of Win11 PCs in our company.

Group1- Win11PCs that can access to the internet

Group2- Win11PCs that cannot access to internet.

All the Group1 internet PCs can apply the updates from the WSUS successfully.

All the Group2 Non-internet connected PCs can receive and install all the updates with the exception of the Win1125H2 monthly cumulative updates.

This is not just a one off error because this started immediately after I upgraded the PCs from Win1124H2 to 25H2. Prior to 25H2 there were no such issue.

All these PC Settings-Windows Updates failed with the message Download error - 0x80010002

I've tried some well documented troubleshooting steps,

delete the SoftwareDistribution, catroo2 folders

dism /online /cleanup-image /restorehealth

sfc /scannow

But there are no improvements.

I used manually downloaded the .msu from Windows update catalog, and apply manually under administrator, this also failed with the error message

Installer encountered an error : 0x80010002 Call was cancelled by the message filter.

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

3 answers

Answer 1

Error 0x80010002 for Windows 11 25H2 cumulative updates on non‑internet PCs behind WSUS is not directly covered in the provided material. However, there are two closely related areas in the context that matter for this scenario:

Windows 11 25H2 servicing and cumulative updates
Requirements and behavior for Feature on Demand (FoD) and update delivery when devices cannot reach Windows Update directly

Based on the context, the only supported, documented path that consistently resolves persistent 25H2 update failures of this kind on multiple devices is to perform an in‑place repair/upgrade of Windows 11 25H2 on the affected machines, then reattempt updates.

A practical remediation path for the non‑internet Group2 machines is:

Obtain the latest Windows 11 25H2 installation media (ISO) from official Microsoft channels.
On one affected non‑internet PC, run an in‑place upgrade/repair:
- Mount the ISO locally.
- Run setup.exe from the mounted drive.
- Choose to keep personal files, apps, and settings.
- Complete setup and reboot.
Rejoin the machine to WSUS and run Windows Update again to pull the latest cumulative update for 25H2.
If this succeeds, repeat the same in‑place upgrade process on the remaining Group2 machines.

If the issue persists even after an in‑place repair and with the latest 25H2 build installed, the next supported step from the context is to open a support case with Microsoft and provide logs (CBS.log, WindowsUpdate.log) from an affected device so the failure can be analyzed as a servicing/platform issue specific to 25H2 in your WSUS environment.

References:

Answer 2

Hi Leslie,

The issue you are experiencing stems from how the Component Based Servicing stack behaves in newer Windows 11 builds. During the installation phase, the servicing stack attempts to reach out to Microsoft public internet servers to negotiate dynamic updates, fetch language packs, or validate payload maps. Because your second group of machines is completely disconnected from the internet, these background remote procedure calls hang indefinitely until they time out. This timeout forces the message filter to cancel the operation entirely, which generates the 0x80010002 error you see both in the automated deployment and the manual standalone installer.

To resolve this, you need to explicitly instruct the operating system to never attempt these outbound public internet connections for update servicing. You can achieve this by navigating to HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate in the registry and creating or modifying a DWORD value named DoNotConnectToWindowsUpdateInternetLocations, setting it to 1. Additionally, you must configure the group policy regarding optional component installation and repair to rely strictly on your internal infrastructure. Under Computer Configuration, Administrative Templates, and System, locate the policy to specify settings for optional component installation and component repair, and ensure it is set to download repair content and optional features directly from your Windows Server Update Services rather than Windows Update. Applying these configurations to your offline collection will prevent the servicing components from stalling on impossible network requests and allow the updates to process successfully.

Hope this answer brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN

Leslie 0 Reputation points

2026-05-18T08:09:43.8666667+00:00

Hi VPHAN

Thank you for your reply.

"Under Computer Configuration, Administrative Templates, and System, locate the policy to specify settings for optional component installation and component repair"

I wasn't able to locate any optional install and repair settings in Computer Configuration-Administrative Templates-System.

But I saw something similar in Computer Configuration-Administrative Templates-Windows Components-Windows Update-Manage Updates Offerred from WSUS-Do not connect to any Windows update Internet locations. Set this to Enable.

Computer Configuration-Administrative Templates-Windows Components-Windows Update-Manage Updates Offerred from Windows update-Enable optional updates Set this to Disable.

Did you mean this ?
Yu, Guoqiang (ext) (SI B FIN IT CN) 0 Reputation points

2026-08-20T07:09:59.5733333+00:00

(Link removed by Moderator.)
I have met the same issue ,you can use this command to delete the bits data
Del /F /Q "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

then the manual way to install the update should be possible be succeeded

Answer 3

Leslie

You are absolutely on the right track with the first policy you found. Enabling the setting to not connect to any Windows Update internet locations is the exact graphical equivalent of the registry modification I previously mentioned, and applying it will enforce the strict offline boundary your environment requires. Disabling the optional updates policy you also found is good practice for managing what end users can see, but it does not control how the underlying servicing stack behaves when it attempts to repair components or map payloads during cumulative updates.

Regarding the optional component installation policy you could not locate, it is very common to overlook it because it is not contained within any subfolder. Once you expand Administrative Templates, you must click directly on the System folder itself, and then scroll through the long alphabetical list of settings that populates in the right hand pane. You will find the policy named exactly as specify settings for optional component installation and component repair. Opening that policy will allow you to explicitly prevent the system from downloading payloads from Windows Update, ensuring your offline machines rely entirely on your WSUS infrastructure and never attempt those doomed outbound internet connections during your 25H2 deployments.

VPHAN