Troubleshoot Windows Update failures on Azure VMs caused by outbound connectivity, DNS, firewalls and proxy configuration.
Start with Test Windows Update connectivity and work through the six diagnostic checks in order.
Record results before changing configuration and validate the original symptom after each controlled change.
Quick checks
Start with the basic checks in this runbook before moving to deeper troubleshooting.
- Confirm the affected service or component is available.
- Check recent configuration or connectivity changes.
- Run the relevant commands and compare the result with the expected state.
Test Windows Update connectivity
Confirm the VM can establish HTTPS connectivity to the Windows Update endpoints required by the operating system.
Check outbound NSGs
Review outbound NSG rules on the NIC and subnet for required HTTPS traffic.
Check Azure Firewall or NVA
If traffic uses Azure Firewall or an NVA, verify the required Microsoft update destinations are permitted.
Check proxy configuration
Check WinHTTP proxy settings and confirm the configured proxy is intentional and reachable.
Check DNS
Verify Windows Update endpoint names resolve correctly from the affected VM.
Collect Windows Update logs
Generate Windows Update logs after reproducing the issue and correlate errors with the network tests.
Useful commands
Run these checks from an appropriate administrative session and replace example values with your environment.
Update endpoint
Test-NetConnection windowsupdate.microsoft.com -Port 443Proxy
netsh winhttp show proxyQuick troubleshooting path
Use this sequence to isolate the failing dependency before changing production configuration.
- Test Windows Update connectivity → Confirm the VM can establish HTTPS connectivity to the Windows Update endpoints required by the operating system.
- Check outbound NSGs → Review outbound NSG rules on the NIC and subnet for required HTTPS traffic.
- Check Azure Firewall or NVA → If traffic uses Azure Firewall or an NVA, verify the required Microsoft update destinations are permitted.
- Check proxy configuration → Check WinHTTP proxy settings and confirm the configured proxy is intentional and reachable.
- Check DNS → Verify Windows Update endpoint names resolve correctly from the affected VM.
- Collect Windows Update logs → Generate Windows Update logs after reproducing the issue and correlate errors with the network tests.
What good troubleshooting looks like
Good infrastructure troubleshooting is evidence-driven. Capture the original state, test the dependency that can prove or disprove your hypothesis, make the smallest safe change and repeat the original test.
Symptom → hypothesis → direct test → result → controlled change → validation → documentation