Windows Server 2025 April 2025 Cumulative Update KB5082063 Install Failure — Remediated by OOB Update KB5091157

Indicators

• KB5082063 shows status 'Failed' in Settings > Windows Update > Update history on a Windows Server 2025 system
• Server 2025 system remains at the pre-April 2025 OS build number after an attempted patch cycle — confirmed via 'winver' or Get-ComputerInfo
• CBS.log at C:\Windows\Logs\CBS\CBS.log contains error entries referencing KB5082063
• WSUS or MECM reporting shows KB5082063 as 'Failed' across affected Windows Server 2025 targets
• Windows Update reports an error and KB5082063 rolls back on Windows Server 2025 after an attempted install

Likely causes

• A defect introduced in the April 2025 cumulative update KB5082063 caused installation failures on a subset of Windows Server 2025 systems — Microsoft acknowledged the issue and issued KB5091157 as an out-of-band fix
• Partial installation of KB5082063 may have left the Windows component store in an inconsistent state, preventing subsequent update attempts until DISM /RestoreHealth is run

Diagnostic steps

1. Open Settings > Windows Update > Update history on the affected server. Locate KB5082063 and confirm its status shows 'Failed'.
   Confirms the failure is specifically caused by KB5082063 and not an unrelated update or pre-existing issue, scoping the remediation to this OOB fix path.
2. Open C:\Windows\Logs\CBS\CBS.log in a text editor and search for 'KB5082063' and any associated error codes (e.g., 0x800f####).
   Provides detailed component-level error information about why the update failed; essential for escalation to Microsoft Support if KB5091157 also fails.
3. In an elevated PowerShell session run: Get-WindowsUpdateLog — then open the generated WindowsUpdate.log file and search for entries referencing KB5082063.
   Supplements CBS.log with Windows Update client-side ETL diagnostics to identify the precise failure point in the update pipeline (download, extraction, installation, finalization).
4. Confirm the current OS build using: winver OR Get-ComputerInfo | Select-Object OsName, OsBuildNumber, OsVersion
   Establishes the exact patch baseline before applying KB5091157, confirming the system did not partially advance its build number and that the OOB fix is being applied to the correct baseline.
5. If CBS.log or DISM output suggests component store corruption from a partial KB5082063 installation, run in an elevated command prompt: DISM /Online /Cleanup-Image /CheckHealth — followed by DISM /Online /Cleanup-Image /RestoreHealth if corruption is detected.
   Repairs the Windows component store before applying KB5091157, preventing the OOB update from failing for the same underlying reason as KB5082063.
6. Verify whether KB5091157 is already available and offered via Windows Update, WSUS, SCCM, or Intune before attempting manual installation.
   Confirms the OOB remediation update is accessible from the patch management channel before resorting to a manual catalog download.

Resolution path

• 1. Download KB5091157 from the Microsoft Update Catalog (https://www.catalog.update.microsoft.com) by searching 'KB5091157', or allow Windows Update / WSUS to offer it automatically once published to your update ring.
• 2. If CBS.log or DISM /CheckHealth indicates component store corruption from a partial KB5082063 installation, first run in an elevated command prompt: DISM /Online /Cleanup-Image /RestoreHealth — wait for completion before proceeding.
• 3. Install KB5091157 — either via Windows Update (Settings > Windows Update > Check for updates) or manually from an elevated command prompt: wusa.exe <full_path_to_KB5091157.msu> /quiet /norestart
• 4. Reboot the server after installation completes to allow the update to fully finalize, then verify successful installation in Windows Update history.
• 5. Verify successful installation: run Get-HotFix | Where-Object {$_.HotFixID -eq 'KB5091157'} and confirm the update appears with an InstalledOn date, and check Windows Update history for 'Successfully installed' status.
• Rollback — if KB5091157 causes issues: run wusa.exe /uninstall /kb:5091157 /quiet /norestart and reboot. If the system is unbootable, boot into Windows Recovery Environment (WinRE) and use 'Uninstall Updates' or startup repair. Restore from a pre-update snapshot if update removal does not recover stability.

Prevention

• Stage cumulative updates in a dedicated test or pre-production environment running Windows Server 2025 before approving deployment to production, to catch install failures like KB5082063 before they impact production workloads.
• Configure WSUS or Microsoft Endpoint Configuration Manager with an approval delay of 1–2 weeks for non-emergency cumulative updates, providing time for Microsoft to identify defects and publish OOB fixes (such as KB5091157) before broad rollout.
• Ensure VM snapshots or backup checkpoints are taken immediately before each patch window on all Windows Server 2025 systems so that a failed cumulative update can be rolled back in minutes rather than hours.
• Subscribe to Microsoft's Windows release health dashboard and security update guide notifications so OOB updates like KB5091157 are identified and approved for deployment promptly when a defective update is superseded.

Tools

• Windows Update / Settings UI (confirm update history, trigger update scan and installation)
• wusa.exe (manual .msu installation: wusa.exe <path_to_KB5091157.msu> /quiet /norestart)
• DISM (repair component store if partially corrupted: DISM /Online /Cleanup-Image /RestoreHealth)
• Get-WindowsUpdateLog PowerShell cmdlet (decode binary Windows Update ETL logs into readable WindowsUpdate.log)
• Microsoft Update Catalog — https://www.catalog.update.microsoft.com (search and download KB5091157 .msu directly)
• Get-HotFix PowerShell cmdlet (verify installed KBs: Get-HotFix | Where-Object {$_.HotFixID -eq 'KB5091157'})

References

• Microsoft Learn — KB5082063 Windows Server 2025 April 2025 Update and KB5091157 OOB Fix
• Microsoft Update Catalog — Search for KB5091157