0x8024000B WU_E_CALL_CANCELLED — Windows Error Code

Q: What does the Windows error code 0x8024000B mean?

It is the Win32 / NTSTATUS code WU_E_CALL_CANCELLED (decimal -2145107957). Operation was cancelled by Windows Update.

Q: How do I decode 0x8024000B in PowerShell?

Run [ComponentModel.Win32Exception]::new(-2145107957).Message in any PowerShell session. For HRESULT-style codes, use err.exe from the Windows SDK or the WinDbg !error command.

Q: Where does Windows typically log this error?

It depends on the originating subsystem (Windows Update → %WinDir%\WindowsUpdate.log; AD/Kerberos → Security event log on the DC; BSOD → minidump under C:\Windows\Minidump; MSI → %TEMP%\msi*.log; WMI → Microsoft-Windows-WMI-Activity). Always cross-reference the timestamp and module name with the Application and System event logs.

Description

WU_E_CALL_CANCELLED (hex code 0x8024000B, decimal -2145107957) is a Windows warning-level error code in the Windows Update & Feature Updates family. Microsoft surfaces this code through the Win32 API, the Common Language Runtime, the kernel, the event log, PowerShell, command-line tools (sfc, dism, gpupdate, sc), and Windows-side applications such as Outlook, Teams, Office, and System Center.

Operation was cancelled by Windows Update.

This page documents what triggers 0x8024000B, the most common scenarios where it appears, the likely root causes, and a step-by-step troubleshooting workflow you can run against affected endpoints. It is intended for system administrators, MSP technicians, helpdesk engineers, and anyone diagnosing Windows behavior in a managed environment.

In-depth explanation

This is a warning-severity code. The operation did not necessarily fail; Windows may have completed it with side effects, conflicts, or a state that requires user attention. It is normally safe to retry, but should still be logged so repeated occurrences can be triaged.

It is part of the Windows Update / WUA error space and typically surfaces in the Settings app, WindowsUpdate.log, the CBS log, or in WSUS / Intune / Configuration Manager reports.

The code can be looked up programmatically in PowerShell with [ComponentModel.Win32Exception]::new(-2145107957).Message (for Win32 / NTSTATUS codes that map cleanly), or with net helpmsg <decimal> for the legacy decimal range. For HRESULT-style codes, decode the facility and code with err.exe from the SDK or via the WinDbg !error command.

Common causes

Corrupted Component-Based Servicing (CBS) store.
WSUS / Intune / SCCM serving the wrong update or a deprecated revision.
Insufficient free space on the system drive (Windows requires several GB free for feature updates).
Antivirus or EDR blocking wuauserv or the cbs.log writer.
Pending reboot from a previous installation locking the WinSxS store.

Troubleshooting steps

Run the official Windows Update Troubleshooter (Settings > System > Troubleshoot).

Stop the relevant services and reset the local cache:

net stop wuauserv bits cryptsvc msiserver
ren %SystemRoot%\SoftwareDistribution SoftwareDistribution.old
ren %SystemRoot%\System32\catroot2 catroot2.old
net start wuauserv bits cryptsvc msiserver

Repair the component store: DISM /Online /Cleanup-Image /RestoreHealth followed by sfc /scannow.
If a feature update fails, free up disk space (15+ GB on C:), unplug non-essential USB devices, and update or roll back the displaying drivers.
For domain-managed clients, verify GPO scoping, WSUS / Intune assignment, and check %WinDir%\WindowsUpdate.log (run Get-WindowsUpdateLog on Windows 10/11).

Decode in PowerShell

# Decode 0x8024000B (-2145107957) in PowerShell
[ComponentModel.Win32Exception]::new(-2145107957).Message

# Or via WinDbg / err.exe (Windows SDK)
# err 0x8024000B

# Or net helpmsg (legacy decimal range only)
# net helpmsg <decimal>

Frequently asked questions

What does the Windows error code 0x8024000B mean?

It is the Win32 / NTSTATUS code WU_E_CALL_CANCELLED (decimal -2145107957). Operation was cancelled by Windows Update.

How do I decode 0x8024000B in PowerShell?

Run [ComponentModel.Win32Exception]::new(-2145107957).Message in any PowerShell session. For HRESULT-style codes, use err.exe from the Windows SDK or the WinDbg !error command.

Where does Windows typically log this error?

It depends on the originating subsystem (Windows Update → %WinDir%\WindowsUpdate.log; AD/Kerberos → Security event log on the DC; BSOD → minidump under C:\Windows\Minidump; MSI → %TEMP%\msi*.log; WMI → Microsoft-Windows-WMI-Activity). Always cross-reference the timestamp and module name with the Application and System event logs.

Is this code recoverable?

Yes — this code is informational or warning-level. The operation can normally be retried after addressing the condition described in the summary.

Should I open a Microsoft support case for this?

Open a case if the error reproduces after applying the troubleshooting steps, particularly if it blocks production workloads, occurs across multiple endpoints, or is associated with a security boundary (BitLocker recovery, Kerberos failure, DCOM hardening, SmartScreen / WDAC). Have a fresh CBS log, minidump, or Get-WinEvent export ready before opening the case.