How to Fix KB5063709 Failing to Install and What’s Included in the Update

If you’ve been stuck watching the KB5063709 update roll back at 95%, getting slapped with an 0x8007000d error, or watching the progress bar freeze before Windows quietly undoes everything — you’re not alone. This August 2025 cumulative update tripped up a surprising number of Windows 10 machines, and the reasons vary enough that a single fix rarely works for everyone. This guide walks through exactly what KB5063709 contains, why it fails, and a proven troubleshooting sequence to get it installed.

What Is KB5063709 and What Does It Include?

Microsoft’s KB5063709 support page confirms this as the August 12, 2025 Patch Tuesday cumulative update for Windows 10 versions 21H2 and 22H2. After a successful install, your build number will move to 19045.6216 (22H2) or 19044.6216 (21H2).

It is a mandatory security update. Skipping it means staying exposed to the vulnerabilities the August 2025 Patch Tuesday cycle addressed across more than 100 CVEs. Here is a summary of what the update actually delivers:

Security Fixes

The primary payload is a broad set of security patches Microsoft describes as “miscellaneous security improvements to internal Windows OS functionality.” The August 2025 Patch Tuesday round addressed over 100 flaws, including a zero-day Kerberos Elevation of Privilege vulnerability (CVE-2025-53779). Third-party vulnerability scanners map KB5063709 to several high-severity CVEs, making it a priority in any compliance-driven environment.

Extended Security Updates Enrollment Fix

This is arguably the most significant non-security change in the update. With Windows 10 mainstream support ending October 14, 2025, Microsoft rolled out a consumer Extended Security Updates (ESU) program so users could extend security coverage beyond that date. KB5063709 fixes a bug where clicking “Enroll now” in the ESU wizard caused the window to open briefly and then close immediately — the result of incomplete app registration that blocked the enrollment flow entirely. If you were trying to sign up for ESU and getting nowhere, this patch is the prerequisite.

Core File System Stability Fix

After the May 2025 security update, a subset of devices started becoming unresponsive in specific scenarios. KB5063709 addresses that regression in the core file system, reducing the risk of spontaneous freezes or stop responses.

Input Method and IME Corrections

The update bundles fixes for three input-related regressions introduced by earlier patches:

• Microsoft Changjie Input Method — users could not select words after typing
• Emoji panel search — searches returned no results regardless of the query
• Hindi and Marathi phonetic keyboards — these keyboards stopped functioning correctly after a recent update

Secure Boot Anti-Rollback Improvements

KB5063709 adds SKUSiPolicy hooks to Secure Boot, preventing protected component versions from being downgraded. This is part of Microsoft’s broader Secure Boot and firmware security posture work leading into 2026 certificate lifecycle changes that administrators should be aware of.

Combined LCU + Servicing Stack Update

The package delivers the Latest Cumulative Update (LCU) alongside an embedded Servicing Stack Update (SSU). Bundling them improves installation reliability, but it does mean the LCU portion cannot be removed with the standard wusa /uninstall command — DISM-based removal is required if rollback becomes necessary.

Why KB5063709 Fails to Install

Before diving into fixes, it helps to understand what’s actually going wrong. The failure modes break down into a few distinct categories:

Error 0x8007000d — Corrupted Update Data

This is the most commonly reported error with KB5063709. It indicates that one or more update files are corrupt — either downloaded incorrectly, or the Windows component store has existing corruption that prevents the new files from being staged properly. No amount of retrying the same download will fix it.

Rollback at 95% — Third-Party Software Conflicts

If the update downloads and installs successfully but your machine reboots, proceeds to 95%, and then rolls back with an “unable to complete the update” message, you’re almost certainly hitting a software conflict. The most frequently implicated culprits reported across Microsoft Q&A and community forums are Malwarebytes, Norton Antivirus, Windows Sandbox, and Hyper-V. The App Readiness service being stuck or misconfigured is another common trigger in this scenario.

Missing Intermediate Updates

Some users hitting this issue were running a Windows build several months behind — for example, still on build 19045.5854 from May 2025. The August 2025 cumulative update may not apply cleanly if several monthly updates were skipped. The update catalog ships cumulative patches, but some dependency chains can break if the component store has gaps.

Corrupted Windows Update Cache

The SoftwareDistribution folder stores downloaded update packages and metadata. If this cache becomes corrupted — a fairly common occurrence after repeated failed installs — the update will keep failing from the same broken starting point regardless of what else you try.

How to Fix KB5063709 Failing to Install

Work through these steps in order. Each one builds on the previous, and the solution often clicks at a different step depending on what’s causing your specific failure.

Step 1: Run SFC and DISM to Repair System Files

This addresses corruption in the Windows component store — the most common root cause of the 0x8007000d error. Open an elevated Command Prompt (right-click the Start button and choose “Windows Terminal (Admin)” or “Command Prompt (Admin)”) and run these commands in sequence:

sfc /scannow

Wait for the scan to complete. Then run:

DISM /Online /Cleanup-Image /CheckHealth

DISM /Online /Cleanup-Image /ScanHealth

DISM /Online /Cleanup-Image /RestoreHealth

The RestoreHealth command connects to Windows Update to pull clean copies of any corrupted files. It can take 10–20 minutes. Once complete, restart your machine and attempt the update again before moving on.

Step 2: Clear the Windows Update Cache

If SFC/DISM didn’t resolve the issue, wipe the cached update data and start fresh. Run each command in an elevated Command Prompt:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver

Now rename the two folders that hold cached update data:

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old

Restart the services:

net start wuauserv
net start cryptSvc
net start bits
net start msiserver

Reboot, then go to Settings → Windows Update and check for updates. Windows will rebuild the cache from scratch and re-download KB5063709.

Step 3: Check and Fix the App Readiness Service

If the update is rolling back at 95%, the App Readiness service is worth checking before anything else. Press Win + R, type services.msc, and press Enter. Scroll to “App Readiness” in the list. If it’s disabled or showing an error, set it to Manual startup, then right-click and start it. Check the event log for any errors it throws on startup — these can point directly at what’s blocking the final stage of installation.

Step 4: Temporarily Remove Conflicting Software

If you have Malwarebytes installed, fully uninstall it using the Malwarebytes Support Tool rather than the standard uninstaller — remnants left behind by a normal uninstall are enough to cause the conflict. For antivirus software like Norton, try disabling real-time protection temporarily before retrying the update rather than uninstalling entirely.

Additionally, if you have Windows Sandbox or Hyper-V enabled, disable them before retrying:

Disable-WindowsOptionalFeature -Online -FeatureName "Containers-DisposableClientVM" -NoRestart
Disable-WindowsOptionalFeature -Online -FeatureName "Microsoft-Hyper-V-All" -NoRestart

Run these in an elevated PowerShell window, then restart and attempt the update again. You can re-enable these features after KB5063709 installs successfully.

Step 5: Install Missing Intermediate Updates First

If your system was running a build from May 2025 or earlier, try installing the intermediate June or July cumulative update before the August one. Open the Microsoft Update Catalog, search for KB5062554 (July 2025, Windows 10 22H2), download the appropriate version for your system architecture, and install it. Once that installs cleanly, retry KB5063709.

Step 6: Download and Install KB5063709 Manually

If Windows Update keeps failing, bypass it entirely. Go to the Microsoft Update Catalog, search for “KB5063709”, and download the correct .msu file for your system (x64 for most modern machines). Run the installer manually by double-clicking the file, or install it silently from an elevated Command Prompt:

wusa.exe KB5063709.msu /quiet /norestart

This bypasses the Windows Update orchestration service entirely and installs the package directly, which often succeeds where the automatic update route fails.

Step 7: Run the Windows Update Troubleshooter

The built-in troubleshooter isn’t always enough on its own, but it can catch specific service configuration issues that the manual steps above miss. Go to Settings → Update & Security → Troubleshoot → Additional troubleshooters → Windows Update → Run the troubleshooter. Apply any fixes it suggests, restart, and retry.

Step 8: In-Place Upgrade Repair (Last Resort)

If you’ve worked through every step above and KB5063709 still won’t install, the component store may have deeper corruption that DISM couldn’t repair over the network. An in-place upgrade repair — running Setup from a Windows 10 ISO while choosing “Upgrade this PC now” — rebuilds the Windows installation without removing your files, apps, or settings. Microsoft Support technicians frequently recommend this as the definitive fix when all other options fail, and multiple users in the Microsoft Q&A threads confirmed it resolved their KB5063709 installation failure. Download the Windows 10 Media Creation Tool from Microsoft’s website, create an ISO, and run Setup directly.

What to Do After KB5063709 Installs

Once the update lands and your system reboots to the expected build number, a few things are worth checking:

• Re-enable Hyper-V or Windows Sandbox if you disabled them during troubleshooting
• Reinstall Malwarebytes if you removed it
• If you’re a Windows 10 home user planning to stay on Windows 10 past October 14, 2025, now is the time to complete ESU enrollment — KB5063709 fixed the wizard bug that was blocking this
• Verify your build number in Settings → System → About — it should now show 19045.6216 (22H2) or 19044.6216 (21H2)

If you’re running Windows 10 on a Proxmox VM or managing legacy Windows workloads in a homelab context, KB5063709 is also a useful forcing function to evaluate your longer-term plan. The Windows 10 EOL migration guide on this site covers how to move those workloads to Linux containers after mainstream support ends.

Understanding the Error Codes

Different failure modes produce different error codes. Here’s a quick reference if you’re trying to look up your specific error:

Final Thoughts

KB5063709 failing to install is frustrating precisely because it’s a mandatory security update you can’t safely ignore — and the error messages it produces rarely point clearly at a solution. The fixes that work most consistently are repairing the component store with DISM, clearing the update cache, and removing Malwarebytes before the install attempt. For the stubborn cases where everything else fails, a manual install from the BleepingComputer’s KB5063709 overview confirms the Microsoft Update Catalog route resolves the majority of remaining failures. And when the update finally lands, make sure to complete your ESU enrollment if you’re staying on Windows 10 — that enrollment bug fix was one of the most operationally significant things this patch delivered.

If you’re also thinking about what comes after Windows 10 for your homelab or home servers, take a look at the debugging Synology Container Manager after OS updates post — the troubleshooting methodology for stuck updates translates well across platforms.