Short answer: 0x800f0989 is an install failure code that Microsoft does not document for the October 2026 cumulative update KB5127648. Because the code points to no single cause, the most useful approach is to match your symptom to a fix, check the component store and servicing stack, and read CBS.log and DISM.log to see what actually failed.
Last reviewed: October 25, 2026.
Key takeaways
- Microsoft's KB5127648 page (released October 13, 2026) lists three known issues: Smart App Control, Remote Desktop with Administrator protection, and some USB audio devices. It does not list 0x800f0989.
- We found no Microsoft statement of a root cause for this code, so we do not claim one.
- Use the symptom table below to pick your first fix instead of working through every step.
- DISM can repair the component store from a matching Windows 11 ISO using a local source and /LimitAccess.
- Create a restore point and back up files before any risky step, and treat an in-place repair upgrade as the last resort.
What 0x800f0989 tells you, and what it does not
Windows Update shows "Install error - 0x800f0989" when an update fails to install. The code is a result value from the update and servicing machinery, but Microsoft has not published a plain-English definition of this exact value on the pages we checked as of 2026-10-25.
Some third-party coverage in October 2026 associates this code with KB5127648 installs, alongside 0x800f0845 and 0x80070306. We could not confirm that from Microsoft's own page, so treat the link as a user report. Whatever the trigger, the fixes below target the parts of Windows that install updates, which is where servicing failures are normally diagnosed.
Which fix first, by symptom
| What you see | Start here | Why |
|---|---|---|
| Fails at download or at "Installing" within minutes | Step 2 (disk space), then Step 5 (catalog install) | Staging and download problems show up early |
| Restarts, then "Undoing changes" | Steps 3 and 4 (component store, logs) | The failure happened during servicing, so CBS.log has the detail |
| DISM RestoreHealth itself fails | Step 4 (local source and /LimitAccess) | DISM could not get repair files from Windows Update |
| Catalog install refuses to run | Step 5 (prerequisites) | Missing servicing stack or checkpoint update |
| Repairs finish but the update keeps failing | Step 6 (in-place repair) | Last resort that keeps files and apps |
How the component store and servicing stack work
Two pieces matter here, and both are easy to misunderstand.
The component store is the WinSxS folder. Windows keeps its own system files there in many versions, and the files you see in System32 are linked to it. When an update installs, Windows stages new versions in the store first. If the store has a damaged or missing component, the install can fail.
The servicing stack is the part of Windows that installs updates. Microsoft ships servicing stack updates (SSUs) separately, and says on its KB pages that the latest SSU should be installed before the cumulative update when installing from the Microsoft Update Catalog. A very old servicing stack can therefore be a reason a package refuses to install.
In short: the cumulative update is the cargo, the servicing stack is the truck, and the component store is the warehouse. Checking all three tells you more than the error code does.
Step 1: Restart, then run the troubleshooter
Restart fully (not Fast Startup shutdown), then open Settings, System, Troubleshoot, Other troubleshooters, and run Windows Update. It clears pending states for some PCs and costs nothing.
Step 2: Check disk space
Servicing stages files before it commits them. A practical rule of thumb is 20 GB free; this is not a Microsoft requirement for this update. Use Settings, System, Storage, Temporary files to remove Windows Update Cleanup files and the Recycle Bin.
Step 3: Check the component store with DISM and SFC
Before you go further: back up important files and create a restore point (Start, type "Create a restore point"). The commands below are Microsoft-documented, but you should always have a way back.
Open Command Prompt as administrator and run:
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /CheckHealthAccording to Microsoft's "Repair a Windows Image" documentation, CheckHealth reports whether the image is healthy, repairable or non-repairable. If it is repairable, run:
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannowRestoreHealth can appear stuck at some percentages for a long time. Wait at least 30 minutes before deciding it hung.
Not sure what is wrong? Get a diagnosis first.
Our certified tech can connect remotely, check your software, drivers and backups, and tell you honestly whether the problem needs a hands-on repair.
Step 4: Read CBS.log and DISM.log properly
The logs tell you which component failed, which is far more useful than the error code. The two main ones:
- C:\Windows\Logs\CBS\CBS.log: records servicing activity, including SFC results and update installs.
- C:\Windows\Logs\DISM\dism.log: records what DISM tried and why it failed.
CBS.log is large and also holds SFC output. To pull out the SFC lines into a file on your Desktop, Microsoft's documented method uses findstr on the [SR] tag:
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > "%userprofile%\Desktop\sfclogs.txt"Lines tagged [SR] are System File Checker entries. If SFC reports it found corrupt files it could not fix (the message commonly seen is that Windows Resource Protection found corrupt files but was unable to fix some of them), the [SR] lines name the files, and "Cannot repair" entries identify the ones it could not restore. That is your cue to repair the store with DISM first, then run SFC again.
For the update itself, generate a readable Windows Update log:
Get-WindowsUpdateLogSearch the Desktop file for KB5127648 and 0x800f0989 and read the lines above the error. Share only a few lines if you ask for help, since logs can include computer names.
If RestoreHealth fails: use a local source with /LimitAccess
RestoreHealth normally pulls repair files from Windows Update. If that fails, point DISM at a matching Windows 11 image instead. Microsoft's documentation shows the general form:
Dism /Online /Cleanup-Image /RestoreHealth /Source:c:\test\mount\windows /LimitAccessAccording to Microsoft, /LimitAccess prevents DISM from using Windows Update as a repair source. To use an ISO:
- Download a Windows 11 ISO from Microsoft that matches your installed version and language, and double-click it to mount it as a drive (for example D:).
- Check which file exists:
D:\sources\install.wimorD:\sources\install.esd. - List the image indexes:
DISM /Get-WimInfo /WimFile:D:\sources\install.wimand choose the index matching your edition (for example Home or Pro). - Run the repair with the wim: prefix, path and index (use esd: for an .esd file):
DISM /Online /Cleanup-Image /RestoreHealth /Source:wim:D:\sources\install.wim:1 /LimitAccessThe wim:path:index form is the commonly used syntax; confirm it for your build with DISM /? if DISM complains. A mismatched version or edition is the usual reason this fails, so double-check the ISO version and edition.
Step 5: Install the update from the Microsoft Update Catalog
A catalog install bypasses the Windows Update download and often gives a clearer error. Microsoft's KB page says catalog installs need the latest servicing stack update and the KB5043080 checkpoint update installed first, in order. Skipping those is a common reason a manual install fails.
- Go to catalog.update.microsoft.com and search for the latest servicing stack update for your version, then KB5043080, then KB5127648.
- Download only the packages for your architecture (x64 or Arm64).
- Install them in that order. For each .msu:
wusa.exe "C:\Users\YourName\Downloads\package-name.msu"Keep the quotes because folder names with spaces break unquoted paths. Do not add /quiet while diagnosing, so you can see any error message.
Resetting Windows Update components
Clearing the SoftwareDistribution and catroot2 caches can help when downloads are corrupt. Take the restore-point precaution first. We cover the full stop, rename and restart sequence in our Windows Update stuck or failing guide, so we will not repeat it here. The short version: stop the update services, rename those two folders to .old, and restart the services.
Step 6: In-place repair upgrade (last resort)
An in-place repair reinstalls Windows over itself and keeps files and apps. Back up first and create a restore point before starting.
- Mount the matching Windows 11 ISO from Microsoft.
- Run setup.exe from the mounted drive.
- Choose to keep personal files and apps.
- When it finishes, check for updates again.
Use this only after Steps 3 to 5, because it takes an hour or more and rarely needs to be your first move.
Common mistakes
- Using an ISO that does not match your edition or language for /Source.
- Running SFC only, without repairing the component store with DISM.
- Deleting WinSxS files by hand. Never do this.
- Installing the cumulative update from the catalog without the servicing stack update.
- Downloading "fixer" tools from unofficial sites.
Related errors and pages
The same update has user reports for other codes, covered on 0x800f0845, 0x80070306 and 0x80073712. For Microsoft-listed issues in the same release, see our October 2026 Patch Tuesday known issues page. If you would rather have someone work through the logs with you, see Windows support or remote repair.
Frequently asked questions
Does Microsoft say what causes 0x800f0989?
Not on any page we found as of 2026-10-25. Microsoft's KB5127648 page does not list this code, so we do not claim a cause.
What does /LimitAccess do in the DISM command?
According to Microsoft, it prevents DISM from using Windows Update as a repair source, so DISM uses only the source you give it.
What do the [SR] lines in CBS.log mean?
They are System File Checker entries. Filtering for them with findstr gives you a short list of the files SFC checked or could not repair.
Which Windows ISO should I use as a repair source?
One downloaded from Microsoft that matches your installed Windows 11 version, language and edition. A mismatch is a common reason the repair fails.
Why does a catalog install fail without the servicing stack update?
Microsoft's KB page says the latest servicing stack update and the KB5043080 checkpoint update should be installed first, in order. Without them the package can refuse to install.
Can I fix this without reinstalling Windows?
Often, yes: component store repair, a clean cache and a catalog install are all non-destructive. An in-place repair keeps your files and apps if reinstalling is needed.
Why did SFC succeed but the update still fail?
SFC repairs system files, not the component store itself. Running DISM RestoreHealth first and then SFC is the order Microsoft documents.