Windows 11 Cumulative Update “KB5065426” Fails with Error 0x800f0991: Causes and Fixes

Introduction

KB5065426 is a Windows 11 version 24H2 cumulative update (OS Build 26100.6584). For many users it installs normally, but some run into a stubborn failure with error 0x800f0991—often after the progress bar reaches the halfway point—followed by repeated “retry” loops. Others report that after the update, file sharing / printer sharing / RDP behavior changes in ways that look like “credentials are broken.”

This guide is a fully rewritten, step-by-step troubleshooting playbook you can follow safely. It covers the most common causes (Windows Update component corruption, system file corruption, servicing stack prerequisites), plus the “imaging/cloning” scenario where network authentication can break across machines that were deployed from the same image.

Important: Do not panic-uninstall updates blindly. KB5065426 includes security fixes. Try the repair steps first, and use uninstall only as a temporary rollback if you’re blocked in a business environment.

What is KB5065426?

KB5065426 is a monthly cumulative security update for Windows 11, version 24H2 (OS Build 26100.6584). Like other cumulative updates, it bundles security patches and quality fixes, and it can also include servicing changes that affect how Windows validates components during installation. Microsoft’s official release notes also list several known issues and workarounds for related components (for example, SMBv1 connectivity and other enterprise scenarios).

If your PC can’t apply it through Windows Update, you may see 0x800f0991 (CBS/servicing failure) and Windows may repeatedly attempt to reinstall it.

Symptoms people report (and what they usually mean)

1) KB5065426 fails to install (0x800f0991)

• Download completes, then install fails—often around the middle of the process.
• Restart doesn’t help; the update returns and fails again.
• Update History may show both “successful” and “failed” entries (Windows Update UI can be confusing when retries happen).

2) Retry loop (download → install → fail → retry)

This usually points to a broken update cache (SoftwareDistribution / catroot2), a prerequisite package ordering issue, or component store corruption that prevents servicing from completing cleanly.

3) File sharing / printer sharing / RDP prompts for credentials (or “System error 86”)

In some environments—especially where many PCs were deployed from a single “gold image”—admins report that after KB5065426 (and some preview updates leading up to it), Windows becomes stricter about authentication and trust between machines, resulting in repeated credential prompts or failures for SMB shares, printers, or RDP. This has been discussed by administrators and vendors supporting image-based deployments.

Note: Microsoft’s official KB page lists certain known issues (for example SMBv1 connectivity), but “duplicate machine SID breaks sharing” is not described as an official known issue there. Treat that angle as an environment-specific trigger that shows up in the real world, not a guaranteed root cause.

Before you start: quick checks (2 minutes)

1. Confirm you’re on Windows 11 24H2
   Settings → System → About → Windows specifications.
2. Free up storage
   Make sure you have at least 10–20GB free on C: (more is safer for cumulative updates + cleanup).
3. Temporarily disable “complicated networking”
   Disconnect VPN, pause third-party security tools only if your policy allows it (then re-enable).
4. Restart once (yes, once) and try Windows Update again. If it fails again, move on to the steps below.

Fix 1: Run the built-in Windows Update troubleshooter

This is the safest “first move.” It can reset common update services and repair basic misconfigurations.

• Settings → System → Troubleshoot → Other troubleshooters
• Run Windows Update
• Reboot and try installing KB5065426 again

Fix 2: Repair system files (SFC + DISM) in the right order

Error 0x800f0991 often appears when the component store (WinSxS) or system files are inconsistent. These two commands repair that foundation.

Step-by-step

1. Right-click Start → Windows Terminal (Admin)
2. Run:

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

If SFC reports it fixed files, restart and run Windows Update again. If DISM fails, take note of the error text (it helps pinpoint whether you need a repair install).

Fix 3: Reset the Windows Update cache (safe “soft reset”)

If the update keeps retrying and failing, the cache may be stuck or corrupted. Resetting the cache forces Windows to rebuild its update database and downloads.

Option A (manual, reliable)

1. Open Windows Terminal (Admin)
2. Stop services:

net stop wuauserv
net stop bits
net stop cryptsvc
net stop msiserver

3) Rename the folders (renaming is safer than deleting):

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old

4) Start services again:

net start wuauserv

net start bits

net start cryptsvc

net start msiserver

Restart your PC and try installing KB5065426 again.

If this fixes the retry loop but the install still fails at the same percentage, jump to the “Manual install” section below.

Fix 4: Manually install KB5065426 (Catalog) — and why order matters

Microsoft’s KB notes indicate that this update can include more than one MSU and may require installation in a specific order. The official guidance also shows a DISM-based approach that installs from a folder path (useful when prerequisites are bundled).

Step-by-step

1. Download KB5065426 from Microsoft Update Catalog (the x64 MSU that matches your device).
2. Create a folder like C:\Packages and place the downloaded MSU(s) there.
3. Open Command Prompt / Terminal (Admin)
4. Run (example command from Microsoft guidance):

DISM /Online /Add-Package /PackagePath:C:\Packages

If DISM reports a prerequisite is missing, re-check that you downloaded all required MSU files for that KB, placed them in the same folder, and used the folder-based approach as described in the KB notes.

Still failing? If manual installation fails the same way Windows Update fails, you’re likely dealing with deeper component store corruption or a conflicting driver/security layer. In that case, the in-place repair upgrade below is often the cleanest solution.

Fix 5: In-place repair upgrade (keeps files & apps)

An in-place repair upgrade reinstalls Windows system components while keeping your personal files and installed applications. This is one of the highest-success methods when update servicing is stuck.

• Use Microsoft’s installation media / setup for Windows 11 and choose the option to keep files and apps.
• After completion, run Windows Update again and install the latest cumulative update.

This takes time, but if you’re repeatedly stuck on 0x800f0991, it can be faster than endless retries.

If sharing broke after KB5065426: practical fixes (home/small office)

Not every “sharing is broken” report has the same cause. Try these in order:

1) Confirm the network profile is Private

• Settings → Network & internet → (Wi-Fi/Ethernet) → Network profile
• Set to Private (Private enables discovery/sharing defaults in many setups)

2) Re-enable Network Discovery and File/Printer Sharing

• Control Panel → Network and Sharing Center → Advanced sharing settings
• Turn on Network discovery
• Turn on File and printer sharing

3) Clear saved credentials (when you keep getting prompted)

• Control Panel → Credential Manager → Windows Credentials
• Remove outdated entries for the target PC/share
• Reconnect and enter credentials once (save them only if appropriate)

4) Check SMBv1 only if you truly rely on it

Microsoft’s KB notes list a known issue where SMBv1 connections can fail after updates released on/after September 9, 2025, with a specific fix referenced in a later KB. If your environment uses SMBv2/v3 (most modern networks do), this is not your problem.

Security note: SMBv1 is deprecated and considered insecure. Avoid re-enabling SMBv1 unless you have no alternative (legacy NAS/old devices) and you understand the risk.

Enterprise / cloned image environments: what to do (the “duplicate identity” scenario)

Organizations using image-based deployment (VDI, PVS/MCS-style provisioning, or cloning many PCs from one configured device) have reported that KB5065426 can surface authentication problems across machines that previously “seemed fine.” Citrix documented connectivity issues (RDP/file sharing/printers) tied to KB5065426 in certain provisioned environments, and sysadmin reports discuss similar patterns.

Recommended (supported) direction:

• Stop cloning without generalizing (review your imaging pipeline).
• For physical PCs, consider rebuilding the image using supported deployment methods (commonly using Sysprep / generalize in the reference workflow, depending on your tooling).
• Test cumulative updates on a small ring first, especially if you use gold images.

About third-party “change SID” tools: Some posts recommend regenerating SIDs using third-party utilities. That may appear to help in certain edge cases, but it is not a universally safe or Microsoft-supported fix. If you manage many endpoints, the least risky long-term solution is to correct the imaging process rather than patch identities after the fact.

Error-to-solution reference table (updated)

Should you skip KB5065426?

Generally, no. Cumulative updates include security patches. If you’re blocked and need your PC stable (especially in a business), a temporary rollback can be reasonable—but treat it as a short-term measure, not a permanent strategy. Also keep an eye on Microsoft’s official KB notes for updated “known issues” and follow-up fixes.

Conclusion

KB5065426 (Windows 11 24H2) can fail with 0x800f0991 when Windows servicing components are unhealthy or the update cache is corrupted. The fastest safe path is:

1. Windows Update Troubleshooter
2. SFC + DISM repair
3. Reset Windows Update cache
4. Manual install using Microsoft’s DISM approach / correct MSU ordering
5. If all else fails: in-place repair upgrade

If your network sharing broke after the update, start with profile/sharing/credentials—and if you manage many cloned machines, treat this as a sign to review your imaging process rather than relying on risky “identity patch” shortcuts. Vendor/admin reports show this scenario can be real in the field.

Related guides (internal links)

・Why Does Windows Ask You to Restart After Changing Settings?

・How to Change the System Time and Date in Windows 11 (Beginner’s Guide with Pro Tips)

・Windows Won’t Boot After Update? Fix Black Screen & Startup Loops

タグ: Windows update, Windows, Windows 11, KB5065426, Error 0x800f0991, File sharing problems, Printer sharing