If Windows Update keeps failing with 0x80070643 and the update in question is KB5034441, you have not done anything wrong and no amount of retrying will help. That update needs about 250 MB of free space inside your Windows Recovery partition, and the recovery partition Microsoft shipped on millions of machines is only 500 MB — often with less than 50 MB free. The installer can’t grow the partition itself, so it fails, rolls back, and offers itself again on the next check.

That’s the loop a lot of people are stuck in. But 0x80070643 also shows up for .NET Framework updates and for ordinary cumulative updates, and those have completely different fixes. Identify which one you have before touching a partition table.

Match your symptom to the cause

To see which one you’re dealing with, open Settings > Windows Update > Update history and read the exact name of the failed entry. The KB number is in parentheses.

The recovery partition problem, explained properly

Windows keeps a small hidden partition holding the Windows Recovery Environment — the thing that loads when you boot to “Advanced startup” to reset your PC or use Startup Repair. KB5034441 patches a real vulnerability in WinRE (BitLocker could be bypassed through it), and applying that patch means writing an updated winre.wim image into that partition.

The updated image is bigger than the one it replaces. On machines that were upgraded from Windows 10, or that OEMs configured with a 300–500 MB recovery partition, there simply isn’t room. The installer fails and reports 0x80070643 — which, unhelpfully, is the generic ERROR_INSTALL_FAILURE code and says nothing about disk space.

Microsoft acknowledged this publicly and published a manual procedure. Their fix requires you to delete the existing recovery partition, shrink your Windows partition, and recreate it larger. There is no automated tool. That’s an unusual thing to ask of ordinary users, and it’s worth being blunt about the risk before you start.

Check whether this is actually your problem

Open Command Prompt as administrator and run:

reagentc /info

You want Windows RE status: Enabled. Note the Windows RE location line — it ends with something like harddisk0partition4. Write that partition number down.

If the status reads Disabled, that alone can cause the failure. Try enabling it first:

reagentc /enable

Then retry the update. Occasionally that’s the whole fix.

Now check the size. Run diskmgmt.msc and look at the Recovery Partition on your system disk. If it’s 500 MB or smaller, or if it’s larger but shows under 250 MB free, you’ve confirmed the cause.

Resizing the recovery partition

This assumes the standard layout where the recovery partition sits immediately after the Windows partition. Verify that in Disk Management before proceeding — if your recovery partition is somewhere else on the disk, this procedure does not apply and you should stop.

Open an administrator Command Prompt.

1. Turn off the recovery environment.

reagentc /disable

2. Shrink the Windows partition by 250 MB. Enter diskpart and identify your disk and partitions:

diskpart
list disk
sel disk 0
list part

Find your OS partition — the large one, usually Primary, matching your C: drive size. Select it and shrink:

sel part 3
shrink desired=250 minimum=250

Replace 3 with your actual OS partition number. Do not guess.

3. Delete the old recovery partition. Select it by its number from the earlier list part output — this is the one reagentc /info pointed at:

sel part 4
delete partition override

4. Create the replacement. The commands differ depending on whether your disk is GPT or MBR. The list disk output shows an asterisk in the Gpt column for GPT disks.

For GPT:

create partition primary id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
gpt attributes=0x8000000000000001

For MBR:

create partition primary id=27

5. Format it and exit.

format quick fs=ntfs label="Windows RE tools"
exit

6. Re-enable recovery and confirm.

reagentc /enable
reagentc /info

Status should read Enabled with a location pointing at the new partition. Now go back to Settings > Windows Update and check for updates. KB5034441 should install.

The honest alternative: just hide the update

Here’s the part most articles won’t say plainly. For a lot of small businesses, the right call is to skip this update entirely.

The vulnerability KB5034441 patches requires an attacker with physical access to your machine to exploit a BitLocker bypass through the recovery environment. If your laptops don’t leave a locked office, or the machine isn’t running BitLocker at all, the practical risk is close to zero — and it is meaningfully lower than the risk of a non-technical user running delete partition override on the wrong number.

To stop being nagged, download Microsoft’s “Show or hide updates” troubleshooter (wushowhide.diagcab), run it, choose Hide updates, tick KB5034441, and apply. The update stops appearing and your update history stops showing red.

Two caveats. First, a hidden update can reappear after a Windows feature update. Second, don’t develop the habit — this is a specific exception for a specific known-broken update, not a general policy. Every other security patch should install.

There’s also a middle path: if the machine is due for replacement inside a year anyway, hide it now and let the new machine ship with a properly sized partition.

When 0x80070643 is a .NET Framework update

Different animal entirely. Here the code means the .NET installer failed, and it’s usually because an existing .NET installation is damaged or a previous update left things half-applied. No partitions involved.

Run the .NET Framework Repair Tool

Microsoft publishes a dedicated utility (NetFxRepairTool.exe) that detects and corrects most .NET installation problems on its own. Download it from Microsoft’s site, run it as administrator, accept the recommended changes, and let it finish. It’s genuinely reliable — this is one of the rare vendor tools that mostly just works.

Reboot afterward, then retry the update.

If that doesn’t clear it, reinstall the feature

Open Control Panel > Programs > Turn Windows features on or off. Untick .NET Framework 3.5 and .NET Framework 4.8 Advanced Services. Click OK, reboot. Return to the same screen, tick both back on, reboot again. Then check for updates.

Note that .NET 3.5 pulls its files from Windows Update or from installation media, so the machine needs internet access during the re-enable step.

Or install the update manually

Note the KB number from your update history, search it on the Microsoft Update Catalog, download the .msu matching your Windows version and architecture, and run it directly. The standalone installer produces a real error message when it fails, which beats a hex code.

Generic fixes for everything else

If your failing update is an ordinary cumulative update, work through these.

Check free space on C: first

Feature updates want 20 GB or more of headroom. Cumulative updates want less but still need real room to stage and roll back. Run Settings > System > Storage > Temporary files and clear Windows Update Cleanup, Delivery Optimization Files, and the Recycle Bin. On a 128 GB SSD that’s frequently the whole story.

Reset the update components

From an administrator Command Prompt:

net stop wuauserv
net stop bits
net stop cryptSvc
net stop msiserver

ren C:WindowsSoftwareDistribution SoftwareDistribution.old
ren C:WindowsSystem32catroot2 catroot2.old

net start wuauserv
net start bits
net start cryptSvc
net start msiserver

Reboot, then check for updates. Windows rebuilds both folders automatically. Expect the next update check to take longer than usual because the catalog has to be re-downloaded.

Repair system files

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

DISM first, then SFC — DISM repairs the source that SFC copies replacement files from. The pair can take 30–45 minutes on older hardware. Run it after hours.

Try the built-in troubleshooter

Settings > System > Troubleshoot > Other troubleshooters > Windows Update > Run. Low expectations are appropriate, but it takes 90 seconds and occasionally resets a service permission you’d otherwise hunt for manually.

For a Defender definition update

If the failing item is a security intelligence update, reset the signatures directly:

cd "C:Program FilesWindows Defender"
MpCmdRun.exe -removedefinitions -dynamicsignatures
MpCmdRun.exe -SignatureUpdate

Managing this across several machines

If you’re running ten or fifteen workstations, expect the recovery partition issue to hit whichever ones were bought in the same batch — identical OEM images produce identical partition layouts. It’s a fleet-wide problem, not a per-machine coincidence.

Decide once, apply everywhere. Either resize on all affected machines during a scheduled maintenance window, or hide the update fleet-wide and document why. What you don’t want is a mixed state where nobody remembers which machines were handled.

A word on prioritization: a persistently failing update makes your patch dashboard look broken, which trains people to ignore it. That habituation is a bigger long-term risk than the WinRE vulnerability itself. Resolve it one way or the other and get back to a clean baseline.

Common questions

Is it safe to skip KB5034441?

For most small offices, yes. The vulnerability requires physical access to the device to exploit a BitLocker bypass. If your machines stay in a locked office and aren’t encrypted, exposure is minimal. If you issue laptops that travel, or you’re subject to compliance requirements that mandate applying all security updates, resize the partition properly instead.

Why does the same update keep failing over and over?

Because Windows Update has no mechanism to learn from repeated failure. It sees an applicable update that isn’t installed and offers it again, forever. The retry loop will not resolve on its own — you have to either fix the underlying cause or hide the update.

Can I resize the recovery partition with a GUI tool instead of diskpart?

Third-party partition managers can move and resize partitions with less typing, and for many people that’s genuinely safer. The important part isn’t the tool — it’s that the recovery partition ends up with 250 MB or more of free space, physically located after the Windows partition, with the correct partition type ID set. After any GUI resize, run reagentc /info to confirm Windows still recognises the recovery environment.

I resized the partition and the update still fails. Now what?

Run reagentc /info and confirm the status is Enabled and the location points at your new partition. If it reads Disabled, run reagentc /enable. If the location is blank or points at a WIM file on C: instead of a partition, WinRE was never properly re-registered and you’ll need to restore it — at that point it’s worth having someone look at the machine directly.

Does this error mean my hard drive is failing?

Not by itself. But if you’re also seeing slow boots, freezes, or errors in other applications, check drive health before doing anything else — wmic diskdrive get status,model for a quick SMART read, or a vendor tool like Samsung Magician or Crucial Storage Executive for real detail. Repartitioning a dying drive is a good way to lose the data on it.