0x80240001 and 0x80240004: the Windows Update agent will not initialise

Fix it now

The Windows Update agent could not provide the service or could not initialise its objects, so the scan fails before it reaches any update server. Reset the client’s registration and its download cache, then repair servicing if the reset does not take.

net stop wuauserv
net stop bits
ren %WinDir%\SoftwareDistribution SoftwareDistribution.old
net start bits
net start wuauserv
wuauclt.exe /resetauthorization /detectnow

1. Give the client a few minutes after the last command. It rebuilds the datastore and re-registers before it will report anything useful.
2. If it still fails, repair servicing itself: DISM /Online /Cleanup-Image /ScanHealth, then /RestoreHealth, then sfc /scannow.
3. Check that the machine has a proxy configuration the system account can use: netsh winhttp show proxy, and netsh winhttp import proxy source=ie if it needs the browser’s settings.
4. Confirm the services the update stack depends on are running and not disabled: Windows Update, Background Intelligent Transfer Service, Cryptographic Services and the Windows Installer.

Renaming SoftwareDistribution is reversible until you delete the old folder. Leave the renamed copy in place until the client has scanned successfully at least once.

If a scan completes you can stop here. If not, the next section explains which of these codes is a fault and which is the agent telling you something perfectly ordinary.

Why it happens

The Windows Update agent is a set of COM objects rather than a single program. Something asks it for a session, it builds a searcher, it queries a service, and it returns update objects that the caller reads. Every code in this article comes from that layer, which is why they appear before any network traffic and why the fix is nearly always local.

Two of them are the headline faults. 0x80240001 is WU_E_NO_SERVICE: the Windows Update Agent was unable to provide the service. 0x80240004 is WU_E_NOT_INITIALIZED: the object could not be initialized. Both mean the agent could not get itself into a state where it could do anything, and both are usually a damaged datastore, a broken registration, or a servicing stack that is not healthy enough to answer.

The rest are more specific and some of them are not faults at all. 0x80240008 is WU_E_ITEMNOTFOUND, the key for the item queried could not be found. 0x80240009 is WU_E_OPERATIONINPROGRESS, another conflicting operation was in progress. 0x8024000C is WU_E_NOOP, no operation was required, which is the agent saying there was nothing to do. And 0x8024000E is WU_E_XML_INVALID: the agent found invalid information in the update’s XML data.

Full reference

The codes, and which of them are actually errors

0x8024000C is worth calling out. It is not a failure. Something asked the agent to do a piece of work that did not need doing, and it said so. Chasing it as though it were a fault is a good way to spend an afternoon reinstalling things that were never broken.

0x80240009 is similar in spirit. Two operations collided, which happens when a management tool triggers a scan while one is already running. Wait for the first to finish and retry before treating it as a defect.

The services this depends on

Check that none of them is set to Disabled. A machine hardened by a policy or a script that disabled a service by name will produce initialisation failures that no amount of cache clearing will fix.

Where to look when the reset does not help

• %WinDir%\Logs\CBS\CBS.log for servicing failures underneath the agent.
• %WinDir%\Logs\WindowsUpdate or the update event log for what the agent recorded at the time.
• The registered service list under the client-state key, which tells you which services this client believes it has.
• Policy under HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, in case the client is being pointed somewhere unreachable.
• The system-wide proxy, since the agent uses it and the browser’s settings are not it.

A note on what these codes do not prove

0x80240001 in particular is often presented as evidence of something specific about how the agent is being called, including claims about remote use that no Microsoft page makes. This article does not repeat them. What the constant says is that the agent was unable to provide the service, and the productive response is to establish whether the client can initialise at all, which the reset above answers in a few minutes.

Every code this article covers

Confirm the fix worked

1. A scan completes and either lists updates or reports the machine as up to date.
2. A new SoftwareDistribution folder has been created and is populating.
3. The four services above are running and none is set to Disabled.
4. On a managed client, the machine reports into its update server with a recent check-in time.

Questions people ask about this