Windows Update fails with code 8E5E0408: a fix

I maintain a PC where Windows 7 refused to perform updates. When in
“Windows Update” I clicked to find new updates, it informed me that I’d
first have to install new Windows Update software, but when I clicked to
proceed, it returned

Windows could not search for new updates
An error occurred while checking for new updates on your computer
Error(s) found
Code 8E5E0408 Windows Update encountered an unknown error

The “more information” button in Windows Update led to a cul-de-sac with no
useful information at all. In fact, so far as I can tell, even Microsoft’s
web site contains not a single page that deals with this specific problem.

After many useless tries with advice from many different places on the Web,
I finally succeeded in fixing the problem and getting
Windows Update working again. Here are some things I tried—based on
the many different sources I consulted, including a large number of pages
in microsoft.com—that didn’t work.

1. Setting updates to be automatic
2. Clean boot, disable non-MS services, reboot, try again, reboot, re-enable non-MS services, try again
3. sfc /scannow followed by replacing missing or corrupted files (there were none)
4. chkdsk C: and fix file system problems (there were none)
5. Installing and running the “System Update Readiness Tool (SURT) for Windows 7” (it didn’t work)
6. Installing and running the “Windows Update Agent” (“encountered unrecoverable error”)

One thing I didn’t try, because it looked worse than re-installing Windows entirely, was

7. an in-place upgrade (actually repair, not an upgrade)

However, because I was willing to look quite widely, I chanced on a page at
Microsoft that looked promising, the page about KB971058, “How do I reset
Windows Update components?” It wasn’t correct in every detail, but I
adapted it and my procedure worked; at any rate, Windows Update now works
again on that PC.

Here’s exactly what I did. You’ll need to take all these steps in a command
window with administrative privileges—and sorry to say this, but if
you don’t know how to do that, you shouldn’t proceed. Get help from someone
more experienced, because you may have to adjust these steps to the
environment of your own PC.

---

First stop BITS (Background Intelligent Transfer Service), the Windows
Update service, the Application Identity service, and the Cryptographic
service. You must do this to let them release the files they’re using,
which may be corrupted.

for %N in (bits wuauserv appidsvc cryptsvc) do net stop %N

---

Windows Update uses BITS, and if the BITS queue files are corrupted, BITS
won’t work. Delete those files. They’ll be rebuilt when the services
restart.

del "%allusersprofile%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

---

Other files, including Cryptographic Service files, may also be corrupted,
so make them inaccessible by renaming their directories. They’ll be
rebuilt—ideally in uncorrupted condition—when the services
start up again.

ren %systemroot%\SoftwareDistribution SoftwareDistribution.bak
ren %systemroot%\system32\catroot2 catroot2.bak

---

Now reset the BITS and Windows Update services to their default security
state, so they can be accessible and run with the correct privileges.

for %S in (bits wuauserv) do sc.exe sdset %S D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)

---

To re-register executable library files used by BITS and Windows Update,
reposition to the directory that contains them…

cd /d %windir%\system32

…and re-register them. If you get messages here about failure to register
something, ignore them.

for %R in (atl urlmon mshtml shdocvw browseui jscript vbscript scrrun msxml msxml3 msxml6 actxprxy softpub wintrust dssenh rsaenh gpkcsp sccbase slbcsp cryptdlg oleaut32 ole32 shell32 initpki wuapi wuaueng wuaueng1 wucltui wups wups2 wuweb qmgr qmgrprxy wucltux muweb wuwebv) do regsvr32.exe %R

---

In case the problem includes network errors, reset Winsock.

netsh winsock reset

---

Microsoft thinks you should reset the Windows HTTP proxy, but I suspect you
need to do that only if you use Internet Explorer. (You shouldn’t use
Internet Explorer, but chacun son goût. It’s your funeral.)

netsh winhttp reset proxy

---

Restart the services you stopped above. I rebooted after starting these
services.

for %N in (bits wuauserv appidsvc cryptsvc) do net start %N

Now try Windows Update again.

---

That’s what worked for me. Now you can remove the now-unused directories
you renamed above—once again, in a command window with elevated
privilege.

rmdir %systemroot%\SoftwareDistribution SoftwareDistribution.bak
rmdir %systemroot%\system32\catroot2 catroot2.bak

And done.