What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
0x80070057 means “The parameter is incorrect.” In a WSUS update failure it does not, by itself, prove that the WSUS server is broken. Start on the Windows client with the Windows Update troubleshooter, a restart, DISM and SFC repairs, and then a controlled Windows Update cache reset. If the same update installs manually, shift your investigation to WSUS policy, connectivity, or server logs.
What 0x80070057 means in a WSUS update
Microsoft uses 0x80070057 for an invalid parameter. Windows Update and upgrade operations can surface it when files are corrupted, permissions are wrong, or system configuration is inconsistent. The code is broad: the operation that failed and the Windows Update logs matter more than the number alone.
As an Amazon Associate I earn from qualifying purchases.
There is no authoritative statistic showing one dominant cause, and Microsoft does not define a single WSUS-only defect behind this code. A client can report it while repairing its component store, reading a damaged update cache, applying a bad policy, or communicating incorrectly with a WSUS service.
Record the failure before changing anything
Write down the update’s KB number (if one is shown), whether the failure happened during a scan, download, installation, or reboot, and the exact time. Save the relevant Windows Update and, when applicable, WSUS client/server logs. This information lets an administrator match the client error with the operation that actually failed and gives you a recovery point before a cache reset.
#1 Best Overall
- Dual USB-A & USB-C Bootable Drive – compatible with nearly all Windows PCs, laptops, and tablets (UEFI & Legacy BIOS). Works with Surface devices and all major brands.
- Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
- Complete Windows Repair Toolkit – includes tools to remove viruses, reset passwords, recover lost files, and fix boot errors like BOOTMGR or NTLDR missing.
- Reinstall or Upgrade Windows – perform a clean reinstall of Windows 7 (32bit and 64bit), 10, or 11 (amd64 + arm64) to restore performance and stability. (Windows license not included.). Includes Full Driver Pack – ensures hardware compatibility after installation. Automatically detects and installs drivers for most PCs.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
Fix the Windows client first
Perform these steps in order. The first two are low risk. DISM and SFC repair local Windows components. Renaming the update cache is more disruptive and should be done only if the earlier repairs do not resolve the error.
1. Run the Windows Update troubleshooter
- On Windows 11, open Settings > System > Troubleshoot > Other troubleshooters.
- Find Windows Update and select Run.
- Allow the diagnostics to finish and apply any proposed repair.
- Read the result instead of closing it immediately; note any service, cache, or permission issue it identifies.
On Windows 10, the equivalent troubleshooter is under Settings > Update & Security > Troubleshoot. Microsoft describes this built-in tool as an automated diagnostic that attempts to correct common update problems; it does not establish that your WSUS server is healthy.
2. Restart Windows and retry
Restart the computer normally after the troubleshooter. A reboot can clear a pending service state and complete repairs that require a restart. After signing in, run the same update check again and record whether the code appears during detection, download, or installation.
Recommended Free Tools
3. Repair the component store with DISM and SFC
Use an elevated Command Prompt, not a normal user window:
- Open Start, type Command Prompt, right-click it, and choose Run as administrator.
- Run
DISM.exe /Online /Cleanup-Image /RestoreHealthand wait for it to reach completion. - When DISM finishes, run
sfc /scannow. - Restart Windows, then retry the update.
DISM repairs the Windows component store that servicing depends on. SFC checks protected system files against that repaired store. If either command reports that it could not complete, keep the exact result and error text; do not repeatedly interrupt it or delete files manually.
4. Reset the Windows Update cache
If the troubleshooter, restart, DISM, and SFC do not help, reset the local update cache. You need local administrator rights. Preserve logs first because renaming the cache removes the immediate working state that may explain the failure.
- Open Command Prompt with Run as administrator.
- Stop the update services:
net stop wuauservnet stop bits- Rename the cache folder so Windows can create a clean one:
ren C:WindowsSoftwareDistribution SoftwareDistribution.old - Start the services again:
net start bitsnet start wuauserv- Restart Windows and run the update check again.
Renaming is preferable to deleting because the old folder remains available for inspection or removal after the system is stable. If a service refuses to stop, note the message, close applications that may be using Windows Update, and retry from an elevated prompt rather than forcing a process termination.
Determine whether WSUS is actually involved
A Windows PC may be configured for WSUS, Microsoft Update, or more than one update service. Confirm the source before editing a server or changing policy.
Use the manual-installation isolation test
- Identify the exact update that fails in Windows Update.
- Obtain the same update package from Microsoft’s official catalog or support channel appropriate to your Windows edition and architecture.
- Install it manually while logged on with an account that can approve the installation.
- Compare the result with the original attempt.
If the manual installation succeeds, the update payload and basic client servicing path are probably usable, so WSUS configuration or communication becomes more likely. If manual installation fails with a comparable error, continue treating the client, component store, permissions, or package applicability as the primary suspects. This test narrows the fault; it is not proof that every WSUS setting is correct.
Inspect the registered update services
Microsoft documents PowerShell inspection through the Microsoft.Update.ServiceManager COM object. In PowerShell, run:
$manager = New-Object -ComObject Microsoft.Update.ServiceManager
$manager.Services | Select-Object Name, OffersWindowsUpdates, IsDefaultAUServiceLook for a service named Windows Server Update Service. When that service reports OffersWindowsUpdates: True, it is serving Windows updates to the client. If it is absent or not offering updates, the machine may be using a different source, or its registration may be incomplete.
Check WSUS policy and the network path
When the isolation test or service inspection points toward WSUS, check the client policy and reachability before asking for server-side changes. These checks normally require a local administrator for policy inspection and a WSUS administrator for server remediation.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
Review the configured policy
- Open an elevated Command Prompt.
- Query the policy branch with
reg query "HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdate". - If present, also inspect the automatic-update subkey with
reg query "HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU". - Record the configured update server, status server, and automatic-update settings. Compare the server names and protocols with the organization’s intended WSUS design.
Do not delete policy values simply because they look unfamiliar. A domain policy may reapply them at the next refresh, and removing them can move a managed computer to an unintended update source. If the values point to an old host, an unreachable name, or a server with the wrong protocol, give the details to the administrator who owns the policy.
Test DNS, ports, proxy, firewall, and TLS
WSUS scan failures commonly result from the path between the client and server rather than from the update file itself. Verify all of the following against your organization’s documented WSUS endpoint:
- DNS: the WSUS hostname resolves to the intended address from the affected client.
- Port: the configured HTTP or HTTPS port accepts a connection from that network segment.
- Proxy: the client’s proxy settings allow the Windows Update services to reach WSUS, and authentication does not block background service traffic.
- Firewall: outbound client rules and inbound WSUS rules permit the configured service.
- TLS and certificates: an HTTPS deployment presents a trusted, valid certificate and uses protocols supported by the client.
Use the WSUS administrator’s documented host and port rather than assuming a universal value. A browser request to the published Selfupdate, ClientWebService, and SimpleAuthWebService endpoints can show whether the server responds, while a connection test can distinguish a blocked port from an application-level failure. A successful TCP connection alone does not prove that the WSUS web services are functioning.
Free tools Windows power users keep installed
One-click scans. No signup required.
Match client and server evidence
Compare the time of the failure with Windows Update client logs and the WSUS server logs. Look for rejected requests, authentication or certificate errors, policy mismatches, and synchronization or metadata faults. Give the administrator the KB number, client hostname, timestamps, policy output, and the result of the manual-installation test. This is more useful than reporting only “WSUS error 0x80070057.”
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Do not confuse 0x80070057 with 0x80244007
WSUS has a separate documented failure involving a SyncUpdates invalid-parameter/SOAP fault: 0x80244007. Microsoft’s server procedure for that condition changes WSUS web.config limits, raising maxInstalledPrerequisites from 400 to 800 and maxCachedUpdates from 22,000 to 44,000, then running IISReset.
Those values are not a general remedy for 0x80070057. Do not edit WSUS web.config merely because the client displays 0x80070057. Use that server procedure only when client and server logs specifically show the 0x80244007 SyncUpdates condition and a WSUS administrator has approved the change. Editing the file affects the server and all clients that depend on it, so it belongs after evidence-led diagnosis, not at the start of this guide.
Choose the next action by evidence
| Remedy | Where it acts | Evidence needed | Privilege | Risk and reversibility |
|---|---|---|---|---|
| Windows Update troubleshooter | Client diagnostics and common repairs | Update failure or stalled scan | Standard user may launch it; elevation may be requested | Low risk; changes are generally automated and limited |
| Restart | Client service and reboot state | Pending update or repair state | Standard user with permission to restart | Low risk; reversible by normal operation |
| DISM followed by SFC | Client component store and protected files | Possible corruption or servicing failure | Local administrator | Low to moderate; supported repairs, but allow both commands to finish |
| SoftwareDistribution rename | Client Windows Update cache | Persistent failure after basic repair | Local administrator | Moderate; preserve logs and retain the renamed folder |
| Policy and endpoint checks | Client configuration and network path | Manual install succeeds, or service inspection shows WSUS | Local administrator; network or WSUS administrator for changes | Low when read-only; changing policy can affect managed devices |
| WSUS web.config limits for 0x80244007 | WSUS server | Logs explicitly show the separate 0x80244007 SyncUpdates fault | WSUS administrator | Server-impacting; evidence and a rollback plan are required |
Common failure branches
The troubleshooter reports no problem
That result does not clear the client or WSUS. Continue with the restart, DISM, SFC, and the cache procedure if the error remains. Then perform the manual-installation isolation test so you can separate client servicing from WSUS delivery.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11DISM or SFC finds corruption
Allow the command to complete, restart, and retry the update once. If corruption returns, preserve the command output and Windows Update logs for an administrator; repeated cache resets will not repair a component store that remains damaged.
The cache reset changes nothing
A clean cache does not fix an unreachable WSUS host, a wrong policy, a blocked proxy, or a server-side metadata fault. Move to service-source inspection and endpoint checks instead of repeating the same reset.
Manual installation succeeds but scans still fail
Treat this as evidence favoring WSUS configuration or communication. Verify the registered service, policy registry branch, DNS, configured port, proxy, firewall, and TLS requirements. Escalate with timestamps and logs if the endpoint responds but the scan still returns an error.
Manual installation also fails
Keep the investigation on the client: confirm the package matches the Windows edition and architecture, review DISM and SFC results, and inspect the update logs for applicability, permission, or component-store messages. A WSUS web.config edit is not justified by this branch alone.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhen to involve a WSUS administrator
Escalate after the supported client sequence when the computer is managed by domain policy, the WSUS service is confirmed as the update source, or endpoint tests fail. Provide the administrator with the exact code, update identifier, operation stage, timestamps, policy output, service inspection result, manual-installation outcome, and relevant client logs. Ask for server-log correlation before requesting any server configuration change.
Quick Recap
As an optional shortcut after the manual steps, Outbyte PC Repair can address more than 100 common Windows issues where possible, including broken system elements and shared DLL problems, while also offering settings tweaks, temporary-file cleanup, privacy and vulnerability checks, a real-time boost, file shredding, and an app-crash log. It runs on Windows 11, 10, 8, and 7; its free trial is offered by category for at least two days before a paid subscription. It complements an antivirus and does not replace one, results vary, and no tool repairs every crash.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
