Step-by-Step: How to Install a Windows 11 Security Update Manually via Microsoft Update Catalog
Windows Update normally installs security fixes on its own, but sometimes it stalls, hides an update, or shows an error and never retries. This guide shows you how to install a Windows 11 security update by hand: find the exact KB number, download the official package from the Microsoft Update Catalog, install it, and confirm it worked. It suits any supported Windows 11 PC (for example 24H2 or 26H2) where you have an administrator account and a working internet connection. If your problem is that a whole Windows version upgrade never arrives, that is a different task — see How to upgrade Windows 11 from 24H2 to 26H2 when the update doesn't arrive.
Two terms first. **KB number** — a Microsoft article ID like KB5031234 that identifies one specific update. **MSU** — "Microsoft Update Standalone package", a single installer file you can run by double-clicking, exactly what the Catalog hands you.
Требования и подготовка
- A Windows 11 PC with an account that has administrator rights (UAC prompt = you have them).
- The exact **KB number** of the missing security update.
- Your **build number**, from `Win+R` → `winver`, or **Settings → System → About**.
- Free disk space for the download and the temporary unpacked files (a cumulative security update is typically large; keep 2–3 GB free).
- A browser (Edge or Chrome) opened on **catalog.update.microsoft.com** — the Microsoft Update Catalog, Microsoft's official public download site for updates.
- A local folder for the package, for example `C:\Updates`.
- Recommended: a restart into a clean state — close documents, save work.
Preparation checklist:
- [ ] Admin rights confirmed
- [ ] KB number written down
- [ ] Build number written down
- [ ] 2–3 GB free on `C:`
- [ ] Folder `C:\Updates` created
- [ ] Browser open on catalog.update.microsoft.com
- [ ] Important files saved / backed up
Пошаговая инструкция
1. **Find your build number.** Press `Win+R`, type `winver`, press Enter. A window appears showing "Version 24H2" and "OS Build 26100.xxxx". The part after the dot matters most: Catalog packages are tied to a build family, and the wrong family gives you "not applicable to your computer". **Expected result:** you can read a version and a full build number off the screen.
2. **Find the KB number of the missing update.** Open **Settings → Windows Update → Update history**. Failed or partially installed items appear here with their KB IDs. **Expected result:** you have one KB number, for example `KB5031234`. Why this works: the history is the authoritative list of what Windows itself tried to install.
3. **Search the Catalog.** In the browser go to `catalog.update.microsoft.com`, paste the KB number into the search box, click **Search**. **Example:** searching `KB5031234` returns rows such as *"2025-01 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5031234)"* with a size and a date. **Expected result:** a short list of packages, each named with a product, an architecture and a date.
4. **Pick the row that matches your PC.** Match three things: the Windows 11 version, the architecture (`x64-based Systems` for Intel/AMD, `ARM64-based Systems` for Snapdragon-class chips), and the date. **Example:** a 24H2 x64 machine must take the row ending in `for x64-based Systems`, not `for ARM64-based Systems`. **Expected result:** one specific row selected, and you know why the others do not apply.
5. **Download the .msu file.** Click the row's **Download** button; a small page opens with a `.msu` link — click it. Save into `C:\Updates`. **Example:** the saved name looks like `windows11.0-kb5031234-x64_abc123.msu`. **Expected result:** the file lands in `C:\Updates` and its size is close to the size shown in the Catalog listing. If the size is far off, the download was cut short — delete and re-download.
6. **Verify the file before installing.** Open PowerShell as administrator and compare the file's properties with the Catalog listing:
Get-ChildItem C:\Updates\*.msu | Select-Object Name, Length, LastWriteTime
Get-FileHash C:\Updates\*.msu -Algorithm SHA256Expected result:the `Length` value roughly matches the Catalog size, and the hash prints without errors. Why it matters: a truncated `.msu` fails halfway through installation with a confusing error code, and you waste a reboot finding out.
7. **Install it from an elevated command line.** In the same PowerShell window run:
wusa.exe "C:\Updates\windows11.0-kb5031234-x64_abc123.msu" /quiet /norestart`wusa.exe` is the **Windows Update Standalone Installer**, the built-in tool that eats `.msu` files. `/quiet` hides the UI, `/norestart` stops it from rebooting your machine behind your back. **Expected result:** the command returns after a while with no output; check the exit code with `$LASTEXITCODE` (0 means success).
8. **Watch the progress and reboot when asked.** Open **Settings → Windows Update** and let the "Restart required" / "Updates pending" banner appear, then restart normally. **Expected result:** the reboot shows "Working on updates" and comes back to the desktop. Do not force power off during this — it can leave the servicing stack half-written.
9. **Confirm the update is installed.** Run:
Get-HotFix | Where-Object HotFixID -eq "KB5031234"
Get-ComputerInfo | Select-Object WindowsProductName, OsBuildNumberExpected result:the first command prints a row with the KB ID and today's date; the second shows a build number higher than the one from step 1. The same KB also appears in **Settings → Windows Update → Update history**.
10. **Clean up.** Delete the `.msu` from `C:\Updates` to reclaim the space. **Expected result:** the folder is empty and disk usage returns to what it was.
If your goal is a full version install rather than a single fix, the process is different — see How to Install Windows 11 26H2: Step-by-Step Guide with Official ISO.
Возможные проблемы и решения
Symptom: "The update is not applicable to your computer", error `0x800f081e`.The package does not match your build, architecture, or it is already installed. Fix: re-run `winver` and compare the build line with the Catalog row; re-check `x64` vs `ARM64`; if `Get-HotFix` already lists that KB, you are done — nothing to install.
Symptom: `wusa.exe` returns `0x800f0823` or says "This update requires a restart".A previously staged update is holding the servicing stack. Fix: reboot fully (not fast startup — use **Start → Power → Restart**), then run the `wusa.exe` command again. If a **Servicing Stack Update (SSU)** is listed in the same Catalog search, install it first: the SSU is the component that lets Windows install other packages.
Symptom: the Catalog page loads but the download stops partway, or the page spins forever.Fix: try the other download link in the list, switch off any VPN or proxy, and try another browser. Then repeat the hash and size check from step 6 before installing — a half-downloaded `.msu` is the most common cause of a failed install.
Symptom: after reboot the build number is unchanged.The package installed but was superseded or rolled back. Fix: open **Settings → Windows Update → Update history**, look for the failed entry, and use **Windows Update** to fetch the newest cumulative update instead — a cumulative update contains all earlier fixes for that build.
FAQ
Do I have to install every security update manually?
No. Windows Update does this automatically; the Catalog route is a repair path for when the automatic route fails, or when you need a specific KB on a machine without internet-facing Windows Update.
Where do I find the exact KB number of a missing update?
Open **Settings → Windows Update → Update history** — failed and installed items are listed with their KB IDs. You can also search the Microsoft Update Catalog directly and match by version and date.
Is it safe to download .msu files from the Microsoft Update Catalog?
Yes — `catalog.update.microsoft.com` is Microsoft's own public package repository, the same source Windows Update pulls from. Do not take `.msu` files from third-party download sites.
Should I install the Servicing Stack Update before the cumulative update?
Yes. If the Catalog search shows both, install the SSU first and reboot, then the cumulative update. The SSU is the installer machinery; updating it first avoids the `0x800f0823` class of errors.
What if the update is installed but I still see errors in Windows Update?
Check `Get-HotFix` and `winver` first — if the build number went up and the KB is listed, the update is in place. Then let Windows Update run one more time; it usually clears the stale "failed" entry once it sees the package already present.
🤖 AI summary
- Updated: 2026-10-15
- Topics: Microsoft Update Catalog, обновление безопасности Windows 11 вручную, установить KB-обновление Windows 11, Windows 11 не устанавливает обновления, скачать патч безопасности Windows
- Summary: Как найти, скачать и поставить KB-обновление безопасности Windows 11, если Windows Update не находит патч, зависает или откладывает установку.
- Key facts:
- Windows Update normally installs security fixes on its own, but sometimes it stalls, hides an update, or shows an error and never retries.
- This guide shows you how to install a Windows 11 security update by hand: find the exact KB number, download the official package from the Microsoft Update Catalog, install it, and confirm it worked.
- It suits any supported Windows 11 PC (for example 24H2 or 26H2) where you have an administrator account and a working internet connection.
- If your problem is that a whole Windows version upgrade never arrives, that is a different task — see How to upgrade Windows 11 from 24H2 to 26H2 when the update doesn& x27;t arrive .
- KB number — a Microsoft article ID like KB5031234 that identifies one specific update.
- MSU — "Microsoft Update Standalone package", a single installer file you can run by double-clicking, exactly what the Catalog hands you.