Strange issue with the kb5120249 update on Windows 10

Question

Strange issue with the kb5120249 update on Windows 10

Lars-Erik Østerud 45

Have a really strange issue with the kb5120249 update on Windows 10.

If installed from "Windows Update" it fails with 0x80070643.
If I manually download and run it it says the update is allready installed.
If it is allready installed why does "Windows Update" try to download it again?

The 0x80070643 has earlier been linked to the recovery partition.
But this very old Windows 10 PC har no separate recovery partition.
The recovery environment is on the C: drive (and works as it should).

Have of course tried both "sfc" and "dism" to repair but no change.

0 comments

2 answers

Your answer

Answer 1

Adam J. Marshall 11,031 MVP

Move and rebuild the Recovery partition to the end of the drive and increase the size of it.

reagentc /disable
diskpart
list disk
select disk <#>
list partition
select partition <#>   ← the recovery partition
delete partition override
list volume
select volume <#>    ← the volume you want to expand/extend
Extend
shrink desired=1024
create partition primary size=1024
format quick fs=ntfs label="Recovery"
set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
gpt attributes=0x8000000000000001
exit
reagentc /enable

Then try checking for updates and see if it is successful.

Lars-Erik Østerud 45 Reputation points

2026-09-02T00:25:24.1033333+00:00

Allready tried earlier. Did not help. So I supect the "recovery update" really is the "secure boot" sertificate update beeing pushed to my system, and that it fails because the BIOS is to old. So how to stop this updates. I can block them with "Windows Update Show Hide.diagcab", but MS push a new one every month (new KB numer) so they keeping coming back and adding up.
Adam J. Marshall 11,031 Reputation points MVP

2026-09-02T01:35:01.85+00:00

Have you tried to force it to update?

https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/09/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates#bkmk_registry_keys

What was the error code in EventViewer?

https://support.microsoft.com/en-us/servicing/os/windows/2022/06/secure-boot-db-and-dbx-variable-update-events
Lars-Erik Østerud 45 Reputation points

2026-09-02T01:58:43.4233333+00:00

Is this safe when the BIOS is not updated (and don't have new keys)?
I won't be locked out from booting if I try to force the key update?

This isn't a critical computer so I can turn of secure boot.
But I still need to know how to stop those updates from coming :-)
Adam J. Marshall 11,031 Reputation points MVP

2026-09-02T02:09:02.01+00:00

No, it won't cause boot issues.
Lars-Erik Østerud 45 Reputation points

2026-09-02T02:27:08.35+00:00

OK. I'll check the registry keys on the system and try to set them to manually update and see...

Answer 2

Ramesh Srinivasan 87,175 Independent Advisor

Hi Lars-Erik Østerud,

You're right. The 0x80070643 usually occurs when installing the WinRE Security Update or the Defender Security intelligence update. If this error occurs for the cumulative update or if KB5120249 is repeatedly offered for your system although it's installed already, please reset the Windows Update cache using this batch file to see if that fixes the issue:

https://gist.github.com/winhelponline/af9296c106448a664a6229d8146a85fd

Download the zip file from the above link and extract the batch file to the desktop.
Right-click on the batch file, click Properties, click "Unblock" (if present), and OK.
Double-click the batch file to run it.
After it completes execution, don't close it yet.
Right-click on that Command Prompt window, click "Edit" and click "Select all"
Right-click on that Command Prompt window, click "Edit" and click "Copy" (This copies the output to the clipboard.)
Paste the info (Ctrl + V) into your reply window.

Standard Disclaimer: There is a link to a non-Microsoft website. The page appears to provide accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as PUPs (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

Lars-Erik Østerud 45 Reputation points

2026-08-31T18:42:25.56+00:00

I get the several "recovery" updates and they fail with 0x80070643 every time.
But that is because the BIOS is outdated and there is no update.
Is there a way to get rid of those updates (will they go away if I disable "secure boot")?

But the one that crashed now was a cumulative update (that should allready be installed).
Ramesh Srinivasan 87,175 Reputation points Independent Advisor

2026-09-01T01:50:59.0966667+00:00
If possible, post a screenshot of the error message window so that I can understand exactly which update is failing.

Also, run the following command in Command Prompt window and post the output.

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v winreversion
Ramesh Srinivasan 87,175 Reputation points Independent Advisor

2026-09-02T12:46:45.0933333+00:00
Please also post the output of the command I posted earlier.

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v winreversion

Right-click Start, and click Disk Management. Maximize Disk Management, adjust the column widths in the top pane to make all the entries visible. Post a screenshot.