A black desktop PC tower with a blue power light on an oak office desk beside a monitor, keyboard and notebook, with autumn maple trees outside the window

KB5132061 Failed to Install? How to Fix 0x800f0993

by

If KB5132061 failed to install on one of your office PCs, you are not alone. Microsoft released this Windows 11 security update on November 10 as part of Patch Tuesday, and within hours people were reporting downloads and installs that stopped with error 0x800f0993, 0x800f0989 and a few other codes. One user has traced their failure to Windows Sandbox. Here is what we know, what we would check first, and what a BC business should not skip while it waits.

What KB5132061 is

KB5132061 is the November 2026 cumulative security update for Windows 11 versions 24H2, 25H2 and 26H2 (OS builds 26100.9974, 26200.9974 and 26300.9974). Windows 10 22H2 and 21H2 PCs get their own update, KB5131096.

Apart from security fixes, Microsoft’s release notes list a few changes that matter in an office:

  • NTLM signing: Windows now offers message signing by default on NTLM connections, which makes a common network attack harder.
  • PowerShell script signing: signed scripts with invalid UTF-8 text may now fail signature checks. If you run signed login or maintenance scripts, test them.
  • Printers and Remote Desktop: fixes for an error 87 when adding a printer published in Active Directory, and for Remote Desktop connections failing after the October preview update.

This is a security update, so leaving it uninstalled is not a good long-term answer.

Why the KB5132061 install fails

As of November 11, Microsoft’s page for the update says it is not aware of any issues. The failures are coming from user reports, not from an official known-issue notice.

The most useful lead so far comes from a user on a Windows 11 enthusiast forum. Their update failed on one desktop but installed fine on their other desktop and laptop. The difference was that the failing machine had Windows Sandbox turned on.

Their Windows servicing log (CBS.log, in C:\Windows\Logs\CBS) showed the update looking for a file that Sandbox uses to rebuild its small virtual machine image, and not finding it. With Sandbox switched off, the update installed on the next try, and the usual repair scans came back clean afterwards. That suggests nothing was actually corrupted.

Two cautions. This is one person’s finding, and Microsoft has not confirmed it. And the 0x800f0993 code is not new: earlier this year Microsoft acknowledged the same code on some PCs that had been upgraded from older versions of Windows, for a different reason. A matching error number does not always mean a matching cause.

What this means for your business

Windows Sandbox is only available on Windows 11 Pro, Enterprise and Education, and it is off by default. Most office PCs will never have it turned on. The ones that do are usually the machines belonging to whoever tests software or opens suspicious attachments, which in a small office is often the owner, the bookkeeper or the “computer person”.

What we tell clients across the Fraser Valley is simple: one PC failing an update is a nuisance, but one PC failing quietly for three months is a security gap. Updates that fail tend to retry and fail again in the background, and nobody notices until something else breaks. If you have more than a handful of PCs, someone should be looking at update status, not waiting for a user to mention a strange message.

How to fix the KB5132061 install error

  1. Confirm the error. Go to Settings > Windows Update > Update history and note the exact code next to KB5132061.
  2. Restart and try once more. A plain restart clears more update failures than you would expect.
  3. Check whether Windows Sandbox is on. Search the Start menu for Turn Windows features on or off and look for Windows Sandbox in the list. If it is not ticked, skip to step 6.
  4. Turn Sandbox off, restart and install. Untick Windows Sandbox, click OK, restart the PC, then run Windows Update again. In an administrator PowerShell window, the same change is Disable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM.
  5. Turn Sandbox back on if you use it. Once the update shows as installed, you can tick it again. If nobody uses it, leave it off.
  6. Run the standard repairs. In an administrator Command Prompt, run DISM /Online /Cleanup-Image /RestoreHealth, then sfc /scannow, restart and try the update again.
  7. Do not pause updates indefinitely. If it still fails, pause for a few days at most, and check Microsoft’s release notes for an official fix.

If you manage several PCs, check them all for the error and fix the failing ones on purpose rather than one complaint at a time.

Want someone else watching your updates?

Patch Tuesday comes every month, and it is easy for a busy office to miss the one PC that did not update. Our managed IT support keeps track of update status and fixes failures before they become a risk, for offices that use IT support in Abbotsford, IT support in Langley and across the Fraser Valley. Our cyber security services cover the bigger picture. Call 604-375-2629 to talk it through.

Related guides