Share via

Windows 11 Feature Update fails with 0x80240440 when UpdateServiceUrlAlternate is set to localhost:8005

P, Thomas Mathew 0 Reputation points
2026-02-13T21:11:08.74+00:00

We are managing Windows updates using Configuration Manager (SUP/WSUS).

Clients have the following Windows Update policy configured:

WUServer       = https://SUPSERVER:8531
WUStatusServer = https://SUPSERVER:8531
UpdateServiceUrlAlternate = http://localhost:8005

Issue observed:

  • Some Windows 11 devices fail Feature Updates (23H2 → 24H2 / 25H2)

UpdatesHandler.log shows:

Updates scan completion received, result = 0x80240440

Other devices with the same deployment succeed

Cache size and content distribution are healthy

Port 8005 is listening on affected devices, but Feature Update content does not download

Understanding so far:

Port 8005 is automatically configured by Configuration Manager for delta/express content

Feature Updates use UUP and may follow a different download path

Suspecting UpdateServiceUrlAlternate (localhost:8005) causes scan/download failures for Feature Updates

Questions:

Is UpdateServiceUrlAlternate (localhost:8005) supported/recommended for Feature Updates?

Can Feature Updates fail if the delta endpoint is reachable but not functional?

Is bypassing delta download the recommended approach for Feature Updates?

Looking for Microsoft guidance or best practices.We are managing Windows updates using Configuration Manager (SUP/WSUS).

Clients have the following Windows Update policy configured:

WUServer       = https://SUPSERVER:8531
WUStatusServer = https://SUPSERVER:8531
UpdateServiceUrlAlternate = http://localhost:8005

Issue observed:

Some Windows 11 devices fail Feature Updates (23H2 → 24H2 / 25H2)

UpdatesHandler.log shows:

Updates scan completion received, result = 0x80240440

Other devices with the same deployment succeed

Cache size and content distribution are healthy

Port 8005 is listening on affected devices, but Feature Update content does not download

Understanding so far:

Port 8005 is automatically configured by Configuration Manager for delta/express content

Feature Updates use UUP and may follow a different download path

Suspecting UpdateServiceUrlAlternate (localhost:8005) causes scan/download failures for Feature Updates

Questions:

Is UpdateServiceUrlAlternate (localhost:8005) supported/recommended for Feature Updates?

Can Feature Updates fail if the delta endpoint is reachable but not functional?

Is bypassing delta download the recommended approach for Feature Updates?

Looking for Microsoft guidance or best practices.

Windows for business | Windows Client for IT Pros | Devices and deployment | Install Windows updates, features, or roles
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. VPHAN 25,000 Reputation points Independent Advisor
    2026-02-26T16:46:44.36+00:00

    Hello P, Thomas Mathew,

    Has your issue been resolved yet? If it has, please consider accepting the answer so that others sharing the same problem would benefit too. If not, please get me updated. Thanks

    VP

    0 comments
  2. VPHAN 25,000 Reputation points Independent Advisor
    2026-02-15T08:25:36.4266667+00:00

    Hello again P, Thomas Mathew,

    Just following up. The UpdateServiceUrlAlternate listener on port 8005 is fundamentally incompatible with the Unified Update Platform (UUP) architecture used by Windows 11 Feature Updates, leading directly to the WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST (0x80240440) error. The legacy Delta content provider cannot interpret the UUP metadata structure, so you must strictly disable "Allow clients to download delta content when available" in your Configuration Manager Client Settings to remove the local proxy and restore direct communication with the Distribution Point; this is the authoritative best practice for managing UUP on-premises.

    However, to ensure the solution is complete, I must ask for a specific detail regarding your Distribution Point's IIS configuration which is absent from your description. Have you verified that the MIME Types for .wim and .msu are correctly registered in the IIS settings on your Distribution Points? UUP content introduces these specific file extensions, and if your IIS instance is not configured to serve them, the agents will simply trade the current scan error for a download failure (HTTP 404) once the proxy issue is resolved.

    Hope you found something useful in the answer. If it helped you get more insight into the issue, please consider accepting it. Thank you.

    VP

    0 comments
  3. VPHAN 25,000 Reputation points Independent Advisor
    2026-02-14T08:03:49.18+00:00

    Hello P, Thomas Mathew,

    This error code (WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST) indicates that the Windows Update Agent received metadata it could not parse or verify, which occurs when the local Delta proxy (listening on port 8005) intercepts UUP traffic it was never designed to handle. Windows 11 Feature Updates utilize UUP to perform differential downloads natively, making the Configuration Manager "Delta content" setting not only redundant but actively harmful to the update path.

    To resolve this, you must modify your Configuration Manager Client Settings under Administration > Client Settings > Default Client Settings > Software Updates. Specifically, set "Allow clients to download delta content when available" to No. It is insufficient to merely disable Express Files; the Delta Content setting controls the local listener on port 8005. Furthermore, verify your Software Update Point (SUP) Component Properties on the site server and ensure "Download both full files for all approved updates and express installation files" is uncheck/disabled to prevent metadata mismatches. Once these changes are propagated via a Machine Policy Retrieval Cycle, the UpdateServiceUrlAlternate registry key at HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate will be automatically deleted, restoring the direct path between the Windows Update Agent and your Distribution Points.

    While the provided log snippet is highly indicative of the Delta proxy issue, please clarify if the affected devices are utilizing a Cloud Management Gateway (CMG) or a VPN split-tunnel configuration. UUP content often requires access to tlu.dl.delivery.mp.microsoft.com and related endpoints even when managed by WSUS; if the Delta proxy removal does not immediately resolve the download, we must investigate if your network boundaries are correctly permitting these UUP range requests.

    Do you find this answer useful? Should you have more questions, feel free to leave a comment. If the answer helps you get more insight into the issue, please consider accepting it. Thank you and have a nice day!

    VP

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.