Fix it now
0x80246007 is WU_E_DM_NOTDOWNLOADED: the update has not been downloaded, so the installer has been pointed at a file that is not there. The update itself is fine and the machine is licensed and healthy. What is broken sits between the download queue and the disk.
Get-BitsTransfer -AllUsers | Select-Object DisplayName, JobState, BytesTransferred, BytesTotal
Get-BitsTransfer -AllUsers | Remove-BitsTransfer
net stop wuauserv
net stop bits
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
net start bits
net start wuauserv
- Read the job list before you clear it. A job stuck in a transient error state, or one days old with a byte count that never moves, tells you which of the causes below you are in.
- Check for updates and let the download start from scratch.
- If one specific KB still fails, download it from the Microsoft Update Catalog and install it by hand. That proves whether the content is good and the transfer path is at fault.
- Run
Get-DeliveryOptimizationStatusduring a download to see whether Delivery Optimization or the background transfer service is doing the work.
Do not rename the folder that holds the BITS queue. Microsoft does not document it as a supported repair; removing jobs with Remove-BitsTransfer and restarting the service is the documented route.
If the download completes and the update installs, you are finished. If it fails the same way, the next section separates a broken transfer from content that is being altered on the wire.
Why it happens
Windows Update splits fetching from installing. The agent decides what is needed, hands the content request to a transfer component, and only later calls the handler to install what arrived. Historically that transfer was always done by the Background Intelligent Transfer Service; on current builds Delivery Optimization does most of it and falls back to BITS in some configurations. Either way the same contract applies: the file has to be complete, and its digest has to match what the metadata said it would be.
0x80246007 is the install step discovering that the contract was not met. Its published wording is exactly that: the update hasn’t been downloaded. 0x80246002 is the more informative sibling, WU_E_DM_INCORRECTFILEHASH, meaning a download manager operation could not be completed because the file digest was not recognised. That distinction matters. A missing file points at a transfer that failed or was cleaned up. A digest mismatch points at something modifying content in flight, which in practice means a proxy, a caching appliance or TLS inspection.
0x80246008 is WU_E_DM_FAILTOCONNECTTOBITS: the download manager could not connect to the Background Intelligent Transfer Service. That is a service state problem on the machine rather than a network one, and it is answered by checking whether BITS is running and what stopped it. 0x8024000B is WU_E_CALL_CANCELLED, an operation cancelled by the user or the service, which Microsoft notes you can also receive when results cannot be filtered.
The two 0x8020xxxx codes are BITS reporting for itself, and both are routinely described wrongly. 0x80200010 is BG_E_NETWORK_DISCONNECTED: the network adapter is inactive or disconnected, and all jobs are placed in the transient error state. 0x80200013 is BG_E_INSUFFICIENT_RANGE_SUPPORT, whose published wording is that the server does not support the Content-Range header, and which Microsoft says you can also receive if an intermediate proxy is removing the Content-Range or Content-Length header. That second one is a concrete instruction to go and look at the proxy, not a hint that the link is flaky.
The transfer queue is stuck
You have this one if Get-BitsTransfer -AllUsers shows jobs that never progress, or jobs days old.
- Remove the stale jobs:
Get-BitsTransfer -AllUsers | Remove-BitsTransfer. - Stop and start the service:
net stop bitsthennet start bits, and confirm it reaches a running state. - Reset the download cache by renaming SoftwareDistribution with the services stopped.
- Rescan for updates and watch the job appear and progress.
The downloaded file failed its digest check
You have this one if 0x80246002, and the same update fails at the same point on every machine behind one internet connection.
- Exempt Microsoft’s update and content endpoints from TLS inspection. Update content is signed and verified by Windows already, so inspecting it can only break it.
- Check for a caching web proxy serving a stale or truncated copy, and clear its cache for those hosts.
- Confirm the proxy honours byte-range requests without collapsing or rewriting them.
- Test one machine on a connection that bypasses the proxy entirely. If the update installs, you have proved where the fault is.
The transfer service will not start
You have this one if 0x80246008, and BITS shows as stopped or its start type is disabled.
- Set a supported start type:
sc.exe config bits start= delayed-auto, thennet start bits. Note the space after the equals sign. - Check Group Policy and any hardening baseline that may be disabling the service deliberately. Reversing it locally will not hold if policy sets it again.
- Confirm its dependencies are running.
- Look in Event Viewer under Applications and Services Logs – Microsoft – Windows – Bits-Client – Operational for the reason it stopped.
A proxy is stripping the range headers
You have this one if 0x80200013, on a network with a proxy or caching appliance in the path.
- Take the published wording at face value: the server does not support the Content-Range header, or an intermediate proxy is removing Content-Range or Content-Length.
- Ask the proxy team to pass those headers through for Microsoft’s update and content endpoints.
- Test the same download on a connection that bypasses the proxy to confirm.
- Where the appliance cannot be changed, deliver updates from an internal update server so client traffic never crosses it.
The connection drops or is treated as metered
You have this one if 0x80200010, or transfers that restart from zero repeatedly on wireless or a reconnecting VPN.
- Download once over a wired connection to prove the content is retrievable.
- Check the connection is not marked metered, which pauses background transfers.
- Check any per-machine bandwidth limits set through Delivery Optimization policy that may be throttling the job to nothing.
- On laptops, confirm the power plan is not suspending the network adapter while the machine is idle.
Full reference
The six codes and what each layer is saying
| Code | Published name | Layer |
|---|---|---|
| 0x80246007 | WU_E_DM_NOTDOWNLOADED | Update agent: the update hasn’t been downloaded |
| 0x80246002 | WU_E_DM_INCORRECTFILEHASH | Update agent: the file digest was not recognised |
| 0x80246008 | WU_E_DM_FAILTOCONNECTTOBITS | Update agent: the download manager could not connect to BITS |
| 0x8024000B | WU_E_CALL_CANCELLED | Update agent: the operation was cancelled, by the user or the service |
| 0x80200010 | BG_E_NETWORK_DISCONNECTED | BITS: the network adapter is inactive or disconnected; all jobs move to the transient error state |
| 0x80200013 | BG_E_INSUFFICIENT_RANGE_SUPPORT | BITS: the server does not support the Content-Range header, or a proxy is removing Content-Range or Content-Length |
Useful commands for a stuck download
| Command | What it does |
|---|---|
Get-BitsTransfer -AllUsers |
Lists background transfer jobs owned by all users. Requires administrative credentials |
Remove-BitsTransfer |
Cancels a job and removes it, so it can be recreated cleanly |
sc.exe query bits |
Shows whether the transfer service is running |
sc.exe config bits start= delayed-auto |
Sets the service to start automatically after other automatic services |
Get-DeliveryOptimizationStatus |
Shows the newer transfer path’s view of the same download |
Get-WindowsUpdateLog |
Merges the agent’s trace files into a readable log showing which file the installer expected |
Which component is actually downloading
This matters because the two paths fail differently and you can waste an afternoon on the wrong one. Run Get-DeliveryOptimizationStatus during a download. If it shows an active job, Delivery Optimization owns the transfer, and BITS codes in the log are historical. If it shows nothing while Get-BitsTransfer -AllUsers shows a job, the background transfer service has it, and the 0x8020xxxx codes apply directly.
Proving the content rather than guessing
- Take the KB number from Update history.
- Download the standalone package for your exact edition, build and architecture from the Microsoft Update Catalog, on a connection you trust.
- Install it by hand.
- If it installs cleanly, the content is good and the transfer path is the fault. If it fails too, the problem is on the machine and you are in the wrong article.
- If every month needs this treatment, fix the transfer path rather than repeating the manual install.
What not to do
Renaming or deleting the folder that holds the BITS job queue is a recipe passed around widely and not documented by Microsoft as a repair. It can lose jobs belonging to other software as well as Windows Update. Remove the jobs with Remove-BitsTransfer and restart the service instead; that is the documented route and it achieves the same end.
When downloads work but the install still fails
- Check free space on the system volume. Feature updates in particular need several gigabytes of headroom, and a transfer that completes onto a full disk fails at install.
- Confirm no backup, sync or endpoint protection agent is locking files under
C:\Windows\SoftwareDistribution\Download, and exclude the folder from real-time scanning if the product allows it. - Run
chkdsk C: /scanon the system volume and read the result. - Read
Get-WindowsUpdateLogoutput for the exact file the installer expected, then check whether it is on disk. - If the digest is failing rather than the file being absent, stop looking at the disk and start looking at what is between the machine and Microsoft.
Every code this article covers
| Code | What it points at | Source |
|---|---|---|
0x80246007 |
WU_E_DM_NOTDOWNLOADED: the update hasn’t been downloaded, so there is nothing for the installer to work with | Microsoft Learn |
0x80246002 |
WU_E_DM_INCORRECTFILEHASH: a download manager operation could not be completed because the file digest was not recognised | Microsoft Learn |
0x80246008 |
WU_E_DM_FAILTOCONNECTTOBITS: the download manager was unable to connect to the Background Intelligent Transfer Service | Microsoft Learn |
0x8024000B |
WU_E_CALL_CANCELLED: the operation was cancelled by the user or the service. Also seen when results cannot be filtered | Microsoft Learn |
0x80200010 |
BG_E_NETWORK_DISCONNECTED: the network adapter is inactive or disconnected, and all jobs are placed in the transient error state | Microsoft Learn |
0x80200013 |
BG_E_INSUFFICIENT_RANGE_SUPPORT: the server does not support the Content-Range header. Also raised when an intermediate proxy removes the Content-Range or Content-Length header | Microsoft Learn |
Confirm the fix worked
- Confirm the update installs and appears in Update history as successful.
- Run
Get-BitsTransfer -AllUsersand confirm no failed or orphaned jobs are left behind. - Confirm
C:\Windows\SoftwareDistribution\Downloadis being populated during a fresh download rather than staying empty. - Run
sc.exe query bitsand confirm the service is running with a supported start type. - Install a second update to be sure you fixed the transfer path rather than one file.
Questions people ask about this
Is manually installing from the catalogue a permanent fix?
For one update, yes, and it is a good diagnostic. If every month needs the same treatment, the transfer path is what needs fixing, not the individual updates.
What does 0x80200013 actually tell me?
That the server does not support the Content-Range header, or that an intermediate proxy is removing Content-Range or Content-Length. It is a specific instruction to look at the proxy or caching appliance in the path, not a general sign of a flaky connection.
How do I know whether Delivery Optimization or BITS is doing the download?
Run Get-DeliveryOptimizationStatus during a download. If it shows an active job, Delivery Optimization has it. If it shows nothing while Get-BitsTransfer -AllUsers does, the background transfer service has it.
Can antivirus really cause this?
Yes, in two ways. Real-time scanning can lock partially written files in the download folder, and a product that proxies HTTPS can alter content enough to fail the digest check. Test with the product’s protection briefly paused if you have permission to do so.
Do I need to buy anything?
No. This is a download failure on a machine that is already licensed. Everything above uses built-in tools, and there is no product that makes a blocked or intercepted transfer work.
