Windows 11 Check for updates -> 0x80240439; Check online for updates from Microsoft Update -> works

The behavior points to the managed WSUS path, not the general Windows Update engine.

0x80240439 means the Windows Update agent starts but cannot complete its startup sequence. Documented causes include:

• corrupted Windows Update agent data store
• damaged or incomplete Windows Update registry configuration
• corrupted state files in %windir%\SoftwareDistribution
• a system policy or Group Policy setting that blocks agent startup
• an incomplete previous Windows Update reset

Since Check online for updates from Microsoft Update works, focus on the WSUS-managed configuration and policy path.

Recommended troubleshooting path:

1. Generate and review effective Windows Update policy Run:

      gpresult /h gpresult.html
   

   In the report, review: Computer Configuration > Administrative Templates > Windows Components > Windows Update Look for policies that could block initialization or force an invalid managed-update state.
2. Refresh Group Policy after any correction Run:

      gpupdate /force
   

   Then restart the PC and test Check for updates again.
3. Verify the WSUS configuration is valid and reachable For WSUS-managed devices, verify:
   • the client can connect to the WSUS server URL
   • firewalls allow outbound access to the WSUS server
4. Check whether the environment is configured to use WSUS without approved updates A documented bad configuration is when UseWUServer=1 is set and the client scans WSUS, but WSUS has not approved updates for that client. In that case, scans can complete but the client has no install/download direction from the server.
5. Reset the Windows Update agent Risk: this clears the local Windows Update data store and state cache. Back up the OS disk first if this is a VM. Run from an elevated Command Prompt:

      net stop wuauserv
      net stop bits
      net stop cryptSvc
      
      ren %windir%\SoftwareDistribution SoftwareDistribution.old
      ren %windir%\System32\catroot2 catroot2.old
      
      net start cryptSvc
      net start bits
      net start wuauserv
   

   If repeating this procedure, delete existing SoftwareDistribution.old and catroot2.old before rerunning.
6. Check BITS health on the client WSUS uses BITS for update downloads. Verify BITS is running under LocalSystem and is started:

      sc config bits obj= LocalSystem
      sc query bits
      sc stop bits
      sc start bits
   

   Stopping and restarting BITS requires local administrator rights.
7. If the device is an Azure VM Use the Azure VM Windows Update Reset Tool from the VM’s Azure portal page under Operations > Run command.

If the issue persists after policy review, WSUS connectivity validation, and Windows Update agent reset, the remaining supported next step is to contact Microsoft Support.

References:

• Troubleshoot Windows Update error 0x80240439
• Managing WSUS Client computers and WSUS computer Groups
• Windows Update issues troubleshooting
• Troubleshoot issues with WSUS client agents