Fix RSAT Installation Errors on Windows 11

In this blog post, I will show you how to fix RSAT installation errors on Windows 11. RSAT tools such as Group Policy Management Console or Active Directory Tools can be installed easily through Optional features in the Settings app. However, if the RSAT tools fail to install, an error code will be displayed, which you can find in the Optional features history.

Below screenshot shows two error codes (0x80240438 and 0x800F0841) that you may encounter while installing RSAT tools on Windows 11. You might see a different error 0x80244017 or 0x800f0954 code on your device, but you can still use this guide to fix the underlying issue.

For complete list of Windows Update error codes by components, see: Windows Update error code list by component | Microsoft Learn

RSAT Installation Error 0x80244017 and 0x800f0954

Error codes 0x80244017 and 0x800f0954 correspond to WU_E_PT_HTTP_STATUS_DENIED (HTTP 401) or indicate that the Feature on Demand installation is attempting to download from WSUS and failing. This issue can occur due to an authentication problem or a network block between the client and the WSUS server. Review and confirm the points below to resolve the issue.

1. Verify the WSUS URL is reachable.
2. Bypass WSUS temporarily by setting UseWUServer=0.
3. Reset WU components and try again.

1. Verify the WSUS URL is reachable

Verify that the WSUS server is configured correctly and that the client can communicate with it. Check the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate to find the URL of the WSUS server, and then try accessing that URL from the client machine to confirm connectivity.

2. Bypass WSUS

Update UseWUServer registry key and set its value to 0 temporarily to check if it is causing the issue. To update the registry key, open a PowerShell console as an administrator and run the following commands. The first command updates the registry key, and the second command restarts the Windows Update service.

Bypass WSUS

#Set UseWUServer to 0 to bypass WSUS
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name UseWUServer -Value 0 -Force

#Restart Windows update service
Restart-Service wuauserv

You can also manually update the registry key by opening Registry Editor on your device and navigating to HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, then setting UseWUServer to 0.

3. Reset Windows update (WU) components

Run the following commands one by one in an elevated PowerShell console to reset the Windows Update (WU) components on your device. After completing the reset, reboot your device and check if you can install the RSAT tools successfully. If you prefer using Command Prompt, run the equivalent set of commands designed for it. Execute either Option 1 or Option 2, but not both, as they perform the same task of resetting the Windows Update components.

You can also download and use the scripts from my GitHub repo: Reset-WU.cmd and Repair-Health.cmd to reset the Windows update components and repair system health.

Option 1: Reset WU components (via PowerShell console)

# 1) Stop update-related services
$svc = 'wuauserv','bits','cryptsvc','msiserver','UsoSvc','DoSvc'
foreach ($s in $svc){ Stop-Service $s -Force -ErrorAction SilentlyContinue }

# 2) Clear BITS transfer queue (safe)
Get-ChildItem "$env:ALLUSERSPROFILE\Microsoft\Network\Downloader\qmgr*.dat" -ErrorAction SilentlyContinue |  Remove-Item -Force -ErrorAction SilentlyContinue

# 3) Rename SoftwareDistribution and Catroot2
$sd = Join-Path $env:SystemRoot 'SoftwareDistribution'
$cr = Join-Path $env:SystemRoot 'System32\catroot2'
if (Test-Path $sd){ Rename-Item $sd ($sd + '.old_' + (Get-Date -f yyyyMMddHHmmss)) -ErrorAction SilentlyContinue }
if (Test-Path $cr){ Rename-Item $cr ($cr + '.old_' + (Get-Date -f yyyyMMddHHmmss)) -ErrorAction SilentlyContinue }

# 4) Reset network stacks used by WU (proxy + winsock)
Start-Process cmd.exe -Verb RunAs -ArgumentList '/c','netsh winhttp reset proxy' -Wait
Start-Process cmd.exe -Verb RunAs -ArgumentList '/c','netsh winsock reset' -Wait

# 5) Start services again
foreach ($s in $svc){ Start-Service $s -ErrorAction SilentlyContinue }

Write-Host "Windows Update components reset complete. Reboot is recommended."

Option 2: Reset WU components (via command prompt)

:: 1) Stop services
net stop wuauserv
net stop bits
net stop cryptsvc
net stop msiserver
net stop usosvc
net stop dosvc

:: 2) Clear BITS queue
del /q /f "%ALLUSERSPROFILE%\Microsoft\Network\Downloader\qmgr*.dat" 2>nul

:: 3) Rename WU caches
ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
ren %systemroot%\System32\catroot2 catroot2.old

:: 4) Reset proxy and Winsock
netsh winhttp reset proxy
netsh winsock reset

:: 5) Start services
net start bits
net start wuauserv
net start cryptsvc
net start msiserver
net start usosvc
net start dosvc

echo Done. Reboot recommended.

RSAT Installation Error 0x800f0954

Below are some common causes for RSAT installation error code 0x800f0954.

• Group Policy “Specify settings for optional component installation and component repair” is not enabled to allow downloads directly from Windows Update.
• Device is pointed to WSUS, which does not serve Features on Demand or language packs.
• UseWUServer=1 is still set in the Windows Update AU policy key, so the client refuses to contact Windows Update.
• System or WinHTTP proxy is misconfigured or requires authentication, blocking the SYSTEM account from fetching RSAT features on demand.
• Firewall, VPN, or SSL inspection blocks egress to Microsoft Update endpoints.

RSAT Installation Error 0x800F0841

This is a generic Windows Update installation failure error code. It may occur due to a broken Windows Update component or one of its dependent services.

1. Open the Settings App > System > Troubleshoot > other trouble-shooters and run the Windows Update troubleshooter.

2. If the above steps don’t resolve the issue, reset Windows Update components using PowerShell or Command Prompt with the commands provided in the previous section.