Fix Error 0x80070643 - Windows Update Install Error (KB2267602)

Windows Update reports "Install error - 0x80070643" and the update fails every time you retry. The code is ERROR_INSTALL_FAILURE — "Fatal error during installation" — and it is deliberately generic. The fix depends entirely on which update failed, so start by identifying that.

Step 1: Find the KB Number

Go to Settings > Windows Update > Update history and find the failed entry. You will see something like:

Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.4xx.xxx.0)
Install error - 0x80070643

The KB number tells you which of three completely different problems you have:

Fix A: Defender Security Intelligence Update (KB2267602)

This is the most common 0x80070643 today. Defender's local definition store is corrupt, so each new signature package fails to apply.

Open an elevated Command Prompt (right-click, Run as administrator) and run:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate

The first command clears the existing definitions; the second downloads a fresh set. On systems running a newer antimalware platform, MpCmdRun.exe lives under %ProgramData%\Microsoft\Windows Defender\Platform\<version>\ instead — use that path if the command above reports the file is missing.

If that does not work, Microsoft documents pulling definitions directly from the Malware Protection Center rather than Windows Update:

MpCmdRun.exe -SignatureUpdate -MMPC

If you are on a managed network: the failure may not be local at all. If the device is pointed at a WSUS server, KB2267602 must be approved there. Check the configured server with:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\WUServer

Then verify with your update administrator that Defender security intelligence updates are approved on that server.

Verify Fix A

Get-MpComputerStatus | Select-Object AntivirusSignatureVersion, AntivirusSignatureLastUpdated

AntivirusSignatureLastUpdated should show a timestamp from within the last day. If it still shows an old date, the update is still failing.

Fix B: KB5034441 and the Recovery Partition

KB5034441 is the Windows Recovery Environment update for Windows 10 version 21H2 and 22H2. It fails with 0x80070643 when the WinRE recovery partition does not have enough free space to stage the new winre.wim. The C: drive being nearly empty is irrelevant — it is the small dedicated recovery partition that matters.

Microsoft's documented remedy is a manual partition resize, published as KB5028997, "Instructions to manually resize your partition to install the WinRE update." A recovery partition of roughly 750 MB is the usual working target.

Risk warning: this procedure uses diskpart to shrink the OS partition and delete and recreate the recovery partition. Mistyping a disk or partition number here destroys data. Back up before you start, and do not attempt it on a machine you cannot afford to rebuild. Microsoft's own instructions only apply when the recovery partition sits immediately after the OS partition — on OEM layouts where it does not, the procedure will not work as written.

Check what you are dealing with first, non-destructively:

reagentc /info

This reports whether Windows RE is enabled and which partition hosts it. If Windows RE shows as Disabled and you do not use it, the simplest safe option is to leave it disabled and stop chasing this update.

Note that Windows 10 reached end of support on 14 October 2025. If you are still hitting KB5034441 in 2026, the machine is on Extended Security Updates or is unsupported, and moving to Windows 11 or a supported build is the better use of your time than resizing partitions.

Fix C: Cumulative, .NET, and Servicing Updates

When a cumulative update, .NET update, or servicing stack update fails with 0x80070643, the component store is usually damaged. Repair it in this order, from an elevated prompt:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

DISM repairs the component store from Windows Update; SFC then repairs system files using that now-healthy store. Running SFC first is a common mistake — it has nothing good to copy from until DISM has finished. Reboot, then retry the update.

If DISM cannot reach Windows Update or reports its own failure, reset the Windows Update components:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver

ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
ren %systemroot%\System32\catroot2 catroot2.old

net start wuauserv
net start cryptSvc
net start bits
net start msiserver

This is safe — Windows rebuilds both folders automatically. You lose cached downloads and local update history, so the next scan will take longer than usual.

Verify the Fix

Whichever route you took, confirm the update actually installed rather than trusting the absence of an error:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

For Defender specifically, Get-MpComputerStatus is the authoritative check. For servicing repairs, review %windir%\Logs\CBS\CBS.log — search it for error near the end of the file to confirm the last servicing operation completed cleanly.

When Nothing Works

If 0x80073712 or 0x800f081f appears while running DISM, the component store is too damaged for an online repair. The supported fix is an in-place repair upgrade: download the ISO matching your exact Windows build, run setup.exe from it, and choose to keep personal files and apps. This rebuilds the servicing stack without wiping the machine.

Prevention

• Install the latest servicing stack update for your build before large cumulative updates.
• Do not let disk free space drop below about 20 GB on the system volume.
• On managed fleets, confirm KB2267602 stays approved in WSUS — an unapproved Defender signature update produces this exact error across every device at once.
• If a third-party antivirus is installed alongside Defender, it disables Defender through the Windows Security Center API, and Defender updates then cannot apply. That is expected behaviour, not a fault to fix.