guide · static export
PC · windows-update

Remove a Bad Windows Update with DISM

When a cumulative update breaks a driver or a feature, wusa is gone and Settings offers no uninstall button. DISM lists the package names, removes the exact one and reports whether the removal is pending a reboot.

by@guidox updated:10/31/26 time:30 min level:Advanced tested on:Windows 11 24H2 works on:Windows 10, Windows 11, Windows Server 2019 tools:PowerShell as administrator, DISM
TL;DR

Find the KB in **Get-HotFix** or the UpdateClient log, translate it into a package with **dism /online /get-packages**, remove it with **/remove-package /packagename:... /quiet /norestart**, then pause updates until a fix ships.

Before you start

Requirements

  • Admin rights
  • The KB number of the update that broke things
  • 30 minutes and one reboot
Step by step

Instructions

01

Identify the update and its install time

**Get-HotFix** sorted by date shows what landed recently, and the WindowsUpdateClient event 19 names the KB as it installed. Match the timestamp to the moment the problem started.

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 8 HotFixID,InstalledOn
Get-WinEvent -LogName System -MaxEvents 300 | Where-Object { $_.ProviderName -eq 'Microsoft-Windows-WindowsUpdateClient' -and $_.Id -eq 19 } | Select-Object TimeCreated,Message
02

Translate the KB into a package name

DISM does not accept a KB number. The package name is a long string that contains the KB digits, so filtering on them is the reliable way to find it.

dism /online /get-packages /format:table | findstr /i "KB5063878"
Get-WindowsPackage -Online | Where-Object PackageName -like '*5063878*' | Select-Object PackageName,InstallTime,PackageState
03

Remove exactly that package

**/remove-package** needs the full package name, not the KB. Leave **/quiet** off the first run so the progress and any error are visible in the window.

dism /online /remove-package /packagename:Package_for_RollupFix~31bf3856ad364e35~amd64~~26100.4061.1.11 /norestart
⚠ warningRead the returned package name character by character. One wrong digit and DISM reports error 0x800f0805.
04

Confirm the removal and reboot

A package that is scheduled for removal shows the state **Uninstall Pending**. The KB disappears from Get-HotFix only after the reboot completes.

dism /online /get-packages /format:table | findstr /i "5063878"
Get-HotFix | Where-Object HotFixID -eq 'KB5063878'
Restart-Computer
05

Keep the broken build from reinstalling itself

Windows Update will offer the same package again on the next scan. Pausing deferrals buys time; the pause is stored as an expiry date in the UX settings key.

New-Item -Path 'HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings' -Name PauseUpdatesExpiryTime -Value '2026-11-14T00:00:00Z' -Type String
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings' | Select-Object PauseUpdatesExpiryTime
06

Repair the image if the removal left damage

A failed removal can leave component store corruption behind. **RestoreHealth** repairs from Windows Update, and **sfc** then replaces damaged system files with the repaired source.

dism /online /cleanup-image /restorehealth
sfc /scannow
dism /online /cleanup-image /startcomponentcleanup
Troubleshooting

Common issues

DISM says the package was not found

The package name was copied with a line break or the wrong suffix. Run get-packages without filters, copy the whole name and paste it in quotes.

The update is not in the DISM list at all

Some driver and servicing-stack updates install as components rather than packages. Look them up under Get-WindowsDriver or in the setup event log instead.

Removal fails with 0x800f0906

The component store lacks the files needed to roll back. Run RestoreHealth first, then retry the removal in the same session.

The KB returns after every reboot

The pause expired or a policy re-armed it. Check the pause expiry value and the WU deadline settings before removing it again.

FAQ

Frequently asked

Does removing a cumulative update delete my files?

No. It reverts the operating system binaries to the previous servicing state; user data and installed programs stay where they are.

Why is there no Uninstall button in Settings any more?

Windows 11 removed the per-update uninstall entry for cumulative updates. DISM is the supported route, and wusa.exe no longer accepts the /uninstall switch.

Can I remove several updates at once?

Yes, but remove them one at a time and reboot between removals. A batch removal that fails leaves you without a clear idea of which package caused it.

How to undo this

Reinstall the update from Windows Update by resuming updates and running a manual scan, or install the same KB from the Microsoft Update Catalog. Then run dism /online /cleanup-image /restorehealth to confirm the image is intact.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress