How to Fix Windows Update Error 0x800b0109
What error 0x800b0109 means
Error code 0x800b0109 is Windows' way of saying a cryptographic signature check failed while it was verifying downloaded update files. Every update package from Microsoft carries a digital signature — a mathematical seal proving the files really came from Microsoft and were not tampered with in transit. Before installing anything, Windows checks that seal against its own records and your system clock.
When that check fails, Windows refuses the whole package with the message "Some update files aren't signed correctly." In most cases the files are actually fine and the problem is on your PC: the signature catalog got corrupted in the download, your system clock is wrong so valid certificates look expired, or a third-party antivirus quietly modified the files mid-download. The fixes below address each of these in order, from the quickest checks to the full reset.
Common causes
- Wrong system date or time: certificates have a valid-from/valid-to window, so a clock that is months off makes valid signatures look invalid — a very common cause.
- Corrupted update cache: the SoftwareDistribution folder or the catroot2 signature catalog holds damaged files that keep failing verification on every retry.
- Third-party antivirus interference: security suites that scan or alter files during download can invalidate the signature of an otherwise fine update.
- Corrupted system files: damage to the cryptographic services or the component store breaks the verification pipeline itself.
- Managed PC certificate issues: on work or school PCs, third-party updates pushed through WSUS or SCCM need a company signing certificate installed — if it is missing, every install fails with this error.
How to fix error 0x800b0109 — step by step
Work through these fixes in order. Most PCs are updating again by step 5.
- Restart and try the update again Save your work and restart your PC. Then open Settings, go to Windows Update, and click Check for updates. Signature failures sometimes come from a bad first download or a temporary Microsoft-side glitch, and a fresh attempt after a restart clears many of them.
- Fix the date, time, and time zone Open Settings, go to Time and language, then Date and time. Confirm the time zone matches where you actually are — this is wrong on a surprising number of PCs. Turn on "Set time automatically" and "Set time zone automatically," then click "Sync now" next to "Synchronize your clock." Because digital signatures are validated against the clock, a wrong date alone is enough to trigger 0x800b0109. If the clock drifts again after every shutdown, your CMOS battery may be dying — a cheap hardware fix.
- Run the Windows Update troubleshooter Open Settings, go to System, then Troubleshoot, then Other troubleshooters. Click Run next to Windows Update and follow the prompts. Let it apply any fixes it finds, restart your PC, and try updating again. The troubleshooter can repair service registrations and pending-update states that contribute to signature errors.
- Temporarily disable third-party antivirus If you run a third-party security suite (Norton, McAfee, Avast, and similar), open it and disable real-time protection for a short period, then retry the update immediately. Some suites hook into the download stream and alter files in ways that break their signatures. Remember to re-enable protection as soon as the update attempt is done. Windows' built-in Windows Security does not normally cause this error.
- Reset the Windows Update components This is the most reliable fix for 0x800b0109: it clears the damaged cache and signature catalog so Windows rebuilds them clean. Open Terminal as administrator and run these commands one at a time:
net stop wuauserv,net stop cryptSvc,net stop bits,net stop appidsvc. Then rename the caches:ren C:\Windows\SoftwareDistribution SoftwareDistribution.oldandren C:\Windows\System32\catroot2 catroot2.old. Finally, restart the services:net start wuauserv,net start cryptSvc,net start bits, andnet start appidsvc. Then check for updates again — Windows will re-download everything with fresh signatures. - Repair Windows with DISM and SFC If the error persists, the verification machinery itself may be damaged. Right-click Start and choose Terminal (Admin). Run
DISM.exe /Online /Cleanup-image /Restorehealthand wait for it to finish — this repairs the component store, which includes the cryptographic components. Then runsfc /scannowto repair protected system files. Restart your PC afterward and retry the update.
Did this fix it? Quick checklist
- Windows Update downloads and installs without 0x800b0109
- The system date, time, and time zone stay correct after a reboot
- No stuck or repeatedly failing updates in Update history
- DISM and SFC complete with no unrepairable errors
If the error still appears after all six steps, install the failing update by hand: find its KB number under Settings, then Windows Update, then Update history, search that KB number on the Microsoft Update Catalog website, and install the downloaded package directly — the catalog copy often verifies fine where the automatic download did not. On a work or school PC, skip all of this and talk to your IT admin instead: you likely need the company's WSUS signing certificate pushed to your machine via Group Policy.
Frequently asked questions
What does error 0x800b0109 mean?
Error 0x800b0109 means a cryptographic signature check failed while Windows was verifying downloaded update files. Every update package carries a digital signature proving it really came from Microsoft and was not tampered with. When Windows cannot validate that signature — because the signature data is damaged, the system clock is wrong, or security software interfered with the download — the update is refused with 'Some update files aren't signed correctly.'
Can the wrong date and time really cause 0x800b0109?
Yes — it is one of the most common causes. Certificates have a valid-from and valid-to window, and the signature check happens against your system clock. If your PC's date is months off (which often happens after a CMOS battery dies or a long shutdown), perfectly good signatures look invalid and Windows rejects the files. Syncing the clock fixes it instantly.
Will resetting the Windows Update components delete my files?
No. Renaming SoftwareDistribution and catroot2 only clears update caches, signature catalogs, and metadata. Your documents, apps, and settings are untouched. Windows rebuilds both folders automatically with fresh files the next time it checks for updates.
What if 0x800b0109 only happens on my work or school PC?
On managed PCs, third-party updates published through WSUS or SCCM are signed with an internal certificate. If that certificate is missing from the PC's Trusted Root and Trusted Publishers stores, every install fails with 0x800b0109. That needs the IT admin to deploy the signing certificate via Group Policy — you cannot fix it from the Settings app.