0x80070002 and 0x80070003: update files missing from SoftwareDistribution

Fix it now

0x80070002 is ERROR_FILE_NOT_FOUND and 0x80070003 is ERROR_PATH_NOT_FOUND: the update agent was told to use a file, went looking, and neither the file nor the folder above it was there. The download cache and the agent’s database have drifted apart, so the cure is to discard the cache and let Windows rebuild it.

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserver

1. Check for updates. The first scan takes considerably longer than usual because the database is being rebuilt from nothing; leave it running rather than cancelling and retrying.
2. If a rename is refused, something is still holding the folder. Restart the machine and do the renames before anything else has started.
3. For 0x80070003 specifically, Microsoft’s guidance is to open the newest %windir%\Logs\CBS\CBS.log and search for , error to find the invalid path, then match it to the timestamp.
4. Once updates install successfully, delete the two renamed folders to reclaim the space.

Renaming SoftwareDistribution resets the update history shown in Settings. It does not uninstall anything: installed updates live in the component store, not in this folder.

If the scan completes and updates install, you are finished. If it fails the same way, the next section covers the four other reasons a path the database promised is not there.

Why it happens

SoftwareDistribution holds two things the update agent depends on. The Download folder holds payload the machine has fetched but not yet installed. The DataStore folder holds a database recording what the machine has been offered, what it has downloaded, where the files were put and what has already been installed. The two are supposed to agree with each other.

They stop agreeing for ordinary reasons. A disk cleanup deletes the payload but not the database entries pointing at it. A download is interrupted when the disk fills or the machine loses power. A reference image is captured with a populated store and then deployed to machines that inherit records of updates they never received. In each case the agent asks the file system for a path the database promised, and the file system says it is not there.

The two headline codes are plain Win32 errors: file not found and path not found. Microsoft’s guidance for 0x80070003 adds something useful, though, which is that the servicing stack could not access a specific path and the newest CBS.log holds the invalid path. That is worth reading before the reset, because a path that points somewhere impossible tells you more than a rebuilt cache does.

The data store codes that arrive alongside them are frequently misdescribed. 0x8024000D is WU_E_XML_MISSINGDATA: the agent could not find required information in the update’s XML data. 0x80248008 is WU_E_DS_MISSINGDATA, meaning the data store is missing required information or has a NULL in a table column that requires a non-null value; that is missing data, not missing structure, and the missing-structure code is a different one. 0x8024801C is WU_E_DS_RESETREQUIRED: the data store requires a session reset, so the agent must release the session and retry with a new one. That is a session reset, not proof that the on-disk cache has to be rebuilt.

Full reference

What each code actually asserts

0x8024801C in particular is worth reading carefully. It asks for a session reset by the agent, which frequently happens without any intervention. Renaming SoftwareDistribution is a reasonable next step if the condition keeps recurring, but it is not what the code means, and treating the two as equivalent leads to resetting the cache on machines that did not need it.

The reset, and what it costs you

Nothing installed is affected and no installed update is removed. If you need the record of what is on the machine after a reset, Get-HotFix and the Installed Updates view in Control Panel both read from elsewhere and still have it.

The registry that decides where the client looks

The policy values live under the Policies branch. Prefer changing the Group Policy object that sets them: a local edit that policy overwrites an hour later wastes an afternoon. Export the branch before changing anything.

Resetting a cloned client’s identity

net stop wuauserv
reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v PingID /f
reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v AccountDomainSid /f
reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientId /f
reg Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientIDValidation /f
net start wuauserv
wuauclt.exe /resetauthorization /detectnow

This is Microsoft’s published sequence for a WSUS client that will not register, and it is the right answer for an estate built from an image captured after the source machine had already talked to an update server. Give it ten to fifteen minutes before you judge whether the client has appeared. Fix the image as well, or you will be doing this again after the next deployment.

When the reset does not help

• Read %windir%\Logs\CBS\CBS.log for the invalid path. If it points somewhere that could never exist, the problem is what wrote it rather than the cache.
• Check whether a disk cleanup script or a third-party optimiser runs on a schedule. Recurring drift usually has a scheduled cause.
• Check free space. The data store needs room for its transaction logs, and a nearly full volume produces exactly this behaviour.
• Confirm no backup or endpoint protection product is holding files under SoftwareDistribution open, and exclude the folder from real-time scanning if the product supports it.
• If the same machine needs this three times, stop resetting and find what is writing into the folder.

Every code this article covers

Confirm the fix worked

1. Confirm SoftwareDistribution and catroot2 have been recreated after the services restarted.
2. Run a check for updates and confirm the scan completes rather than failing immediately.
3. Install the updates it offers and confirm they complete and survive a restart.
4. Confirm Update history is repopulating with the new installs.
5. On a managed client, confirm it appears in the update server’s console with a current last-contact time.

Questions people ask about this