Microsoft has deployed a targeted Known Issue Rollback (KIR) to fix a Windows Update Standalone Installer (WUSA) regression that caused .msu update packages to fail with ERROR_BAD_PATHNAME when installed from network shares containing multiple files. The bug, which primarily hit Windows 11 version 24H2 and Windows Server 2025, also introduced phantom "restart required" statuses in Update History. Alongside the WUSA issue, a separate WSUS delivery failure for the August 2025 cumulative update (error 0x80240069) roiled enterprise patching pipelines, forcing admins to lean on KIR policies, manual workarounds, and catalog re-syncs until permanent fixes land.
The Windows Update Standalone Installer (WUSA) is a built‑in utility that handles .msu packages—checking prerequisites, managing restarts, and enabling manual or scripted deployments in environments where automatic updates are disabled. When an .msu file is launched from a network share that holds more than one .msu, certain updates released after May 28, 2025 (such as KB5058499) can trigger the ERROR_BAD_PATHNAME failure. The installation aborts, and Update History may falsely report that a restart is needed even after rebooting. The problem does not occur when only a single .msu resides in the share, or when the file is copied locally first.
A separate but related regression affected Windows Server Update Services (WSUS) installs of the August 2025 cumulative update (a combined Servicing Stack Update + Latest Cumulative Update for Windows 11 24H2). Enterprises saw error 0x80240069 during WSUS‑mediated deployments, effectively blocking patch rollout through that channel. Microsoft acknowledged the issue and corrected the server‑side delivery, advising admins to refresh and re‑synchronize their WSUS catalogs.
What Happened: The WUSA / .msu Regression
The core symptom was a sudden ERROR_BAD_PATHNAME when running WUSA or double‑clicking an .msu from a network location that contained multiple .msu files. Administrators also reported that the Settings Update History page continued to show a pending restart even after the device had been rebooted—a state that confuses compliance monitoring and helpdesk workflows.
This behaviour was traced to updates released on or after May 28, 2025. The failure mode was most prevalent on Windows 11 version 24H2 and current Windows Server builds that share the same servicing stack. Because the bug only manifested when multiple .msu files coexisted in a network share, it specifically hurt enterprise environments that stage bundles of updates for phased or offline deployment.
Operationally, this was a triple blow:
- It broke scripted installs and recovery procedures that fetch .msu packages from network repositories.
- It created audit noise—a reboot that doesn’t clear “restart required” can flood reporting systems with false positives.
- It forced a choice between risky mass uninstalls of security fixes or applying temporary policy-based mitigations.
The WSUS Delivery Failure (Error 0x80240069)
Separately, the August 12, 2025 cumulative update for Windows 11 24H2 failed to install via WSUS for many managed devices, throwing error 0x80240069. This was not an .msu path problem but a metadata-negotiation breakdown between the Windows Update Agent and the on‑premises update server. Microsoft re‑released the package after correcting server‑side artifacts, and most clients recovered after WSUS re‑synced.
How Microsoft Fixed It
For unmanaged (consumer) devices, Microsoft automatically pushed a Known Issue Rollback that neutralizes the offending behavioral change without uninstalling the security update. KIR works by flipping a feature‑gate flag to disable the newly‑introduced code path that triggers the regression. The rollback takes effect silently after the system receives the KIR policy through Windows Update.
For managed enterprise environments, Microsoft released Group Policy (ADMX) templates and an MSI package that allow IT admins to apply the same KIR via Group Policy or Intune. The KIR does not remove the cumulative update; it simply re‑enables the pre‑regression behavior. Admins must download the KIR package from the Microsoft Download Center, deploy it to affected organizational units, and plan to remove it once a permanent servicing fix is released.
In addition to the KIR, Microsoft and community guidance converged on these practical workarounds:
- Copy the .msu file to local storage (C:\ or a local partition) and run WUSA from there.
- For WSUS: refresh and re‑synchronize the WSUS catalog; after Microsoft corrected the server side, the downloads resumed successfully.
- For very small or critical groups, manually download the .msu from the Microsoft Update Catalog and install it with DISM or WUSA locally.
Timeline of Events
- Late May 2025: Updates (including KB5058499) ship that later enable the WUSA network‑share regression when multiple .msu files are present.
- August 12, 2025: The combined SSU+LCU for Windows 11 24H2 is released. Shortly after, enterprise admins report WSUS failure 0x80240069 and the WUSA error becomes more visible.
- Late August 2025: Microsoft rolls out KIR artifacts, publishes Group Policy guidance, and fixes the WSUS delivery. Admins are advised to re‑sync WSUS and deploy the KIR where needed.
Why Enterprise Paths Are Different
Consumer devices that contact Microsoft Update directly rarely exercise the complex metadata negotiation and variant‑gating logic that WSUS and SCCM impose. Enterprise update flows involve approval steps, targeted payload selection, and often different file retrieval methods. When a Servicing Stack Update (SSU) changes the update plumbing, edge cases can surface only under these managed topologies. The leading working hypothesis in the community—backed by telemetry and reproduction steps—points to variant or feature‑gating code in the Windows Update Agent (wuauserv) that misbehaves when handling network‑share paths or WSUS metadata. That bug can produce ERROR_BAD_PATHNAME or 0x80240069. A definitive root‑cause analysis from Microsoft is pending; the variant‑gating theory remains the most credible explanation until official documentation appears.
Enterprise Impact and Recommendations
Because the regressions only affected managed delivery pipes, the operational impact was concentrated in IT departments. The cost came in three forms:
1. Helpdesk and triage overhead: False restart notifications and failed installs generated tickets and delayed security rollouts.
2. Policy lifecycle burden: KIRs and registry workarounds require careful deployment, monitoring, and eventual removal. Leaving a KIR in place can later block legitimate updates.
3. Alert fatigue: Cosmetic errors like repeated CertEnroll Event ID 57 (observed on devices with the Pluton security processor) added noise to logs, potentially masking real cryptographic issues.
Strategic recommendations for IT leaders:
- Test patches in pilot rings that mirror the enterprise topology (WSUS/SCCM paths), not just consumer update flows.
- Automate detection of known fingerprints: Event Viewer strings like “Unexpected HRESULT … 0x80240069 WUAHandler” and the CERTENROLL event.
- Treat KIR policies as temporary incident controls: document when they are applied, set a removal date, and automate rollback.
Administrator Playbook: Step‑by‑Step Actions
-
Identify affected devices
Query ConfigMgr, Intune, or WSUS for Windows 11 24H2 builds that installed the May–August updates. Scan centralized logs for the specific error codes. -
Apply targeted remediation
- For large fleets: obtain Microsoft’s KIR MSI/ADMX, deploy to a pilot OU first, validate, then scale. A reboot is required for the KIR to take effect.
- For critical few: download the .msu from the Update Catalog and install locally (wusa.exe or DISM). Document these manual steps for compliance. -
Emergency stopgap (registry override)
A community‑circulated registry snippet exists that forces a scan and can restore WSUS installs. Use only as a last resort, scope it tightly, and log every change. -
Re‑sync and refresh WSUS
After Microsoft’s server‑side correction, re‑sync WSUS and verify that clients retrieve the corrected package. Monitor failure rates in WSUS reporting. -
Clean up
Once Microsoft ships a permanent servicing fix (in a future cumulative update), remove the KIR policies and any registry overrides. Validate that Update History no longer shows stale restart requirements.
Strengths and Weaknesses of Microsoft’s Response
Strengths
- Rapid activation of Known Issue Rollback prevented the bug from spreading further without uninstalling security fixes.
- Enterprise‑ready artifacts (KIR MSI/ADMX) supported auditable, scoped deployment via Group Policy or Intune.
- Clear workarounds (local copy, WSUS re‑sync) gave admins immediate alternatives.
Weaknesses and Risks
- Recurrence: A similar WSUS delivery regression occurred earlier in the year, highlighting fragility in variant‑gating and enterprise delivery testing. Repetition erodes trust.
- Communication gaps: Knowledge Base articles and static support pages often lagged behind real‑time telemetry; admins relied on Reddit threads, Twitter, and community boards to detect the issue.
- KIR lifecycle management: Organizations with less mature change control risk leaving temporary mitigations in place indefinitely, potentially blocking future updates.
Looking Ahead
The WUSA / WSUS regressions of May–August 2025 are a sharp reminder that modern Windows servicing—with its variant payloads, SSU interactions, and enterprise delivery channels—creates failure modes invisible to consumer‑only testing. Microsoft’s KIR mechanism remains an effective emergency tool, but its value depends on IT discipline: applied promptly, monitored continually, and removed cleanly. The permanent servicing fix is expected in an upcoming cumulative update; meanwhile, admins should treat this episode as a practical lesson in patch governance. Expand your test rings to include real‑world WSUS/SCCM paths, maintain auditable runbooks for KIRs and workarounds, and automate detection of the specific log fingerprints. With these practices, organizations can restore update velocity without sacrificing stability or compliance.