Install a Windows update offline with DISM

Why use Windows PE?

Windows PE runs separately from the Windows installation on the SSD. DISM can therefore service that installation as an offline image.

dism /Image:D:\ ...

Do not use DISM /Online in Windows PE for the broken installation. /Online targets the running PE environment.

Prerequisites

Continue only if:

• data and recovery copies are protected;
• the SSD is reliable enough for writes;
• BitLocker can be unlocked;
• the actual Windows volume has been identified;
• Windows release and architecture are known;
• the exact Microsoft package and all prerequisites have been identified;
• enough free space is available for the package, logs and scratch files.

The examples use D: for Windows and E: for a writable recovery drive.

1. Identify Windows and check BitLocker

diskpart
list volume
exit
dir D:\Windows
dir D:\Program Files
dir D:\Users
manage-bde -status

Stop unless D: is clearly the intended, unlocked Windows installation.

2. Record the current state

dism /Image:D:\ /Get-CurrentEdition
mkdir E:\logs
dism /Image:D:\ /Get-Packages /Format:Table
dism /Image:D:\ /Get-Packages /Format:Table > E:\logs\packages-before.txt

Keep this output for comparison after the package operation.

3. Select the matching official package

Use Microsoft Update Catalog and the support page for the specific KB.

Check at least:

• Windows release, such as 24H2 or 25H2;
• x64 or Arm64;
• build family;
• exact KB number;
• publication date and package variant;
• required servicing or checkpoint packages.

From Windows 11 24H2 onwards, checkpoint cumulative updates can require earlier checkpoint MSUs. Follow the documentation for the specific KB.

4. Verify the downloaded file

If a trustworthy SHA-256 value is available:

Get-FileHash 'E:\packages\windows-update-x64.msu' -Algorithm SHA256

Do not use the file if the hash does not match. Also confirm that the package came from an official Microsoft source.

5. Create scratch space

mkdir E:\scratch

Make sure the location has enough free space.

6. Apply the verified package

dism /English /Image:D:\ /Add-Package /PackagePath:E:\packages\windows-update-x64.msu /ScratchDir:E:\scratch /LogPath:E:\logs\dism-add-package.log /LogLevel:4 /NoRestart

Expected: DISM accepts the package as applicable and completes the offline package operation without error.

If Microsoft documents prerequisites in a specific order, apply only those packages in that order.

7. Check package state and component-store health

dism /Image:D:\ /Get-Packages /Format:Table
dism /Image:D:\ /Get-Packages /Format:Table > E:\logs\packages-after.txt
dism /Image:D:\ /Cleanup-Image /ScanHealth /LogPath:E:\logs\dism-scanhealth-after.log

Compare packages-before.txt and packages-after.txt.

A targeted file check can be useful in a specific diagnosis:

sfc /verifyfile=D:\Windows\System32\winlogon.exe /offbootdir=D:\ /offwindir=D:\Windows

8. Let Windows finish configuring

A package added successfully offline may still configure during the next normal boot.

• do not interrupt a long first boot too quickly;
• allow for several automatic restarts;
• record a new stop code if startup still fails;
• test more than one successful boot.

After offline servicing, updated boot files may need to be copied to the system partition again:

Repair EFI and BCD with BCDBoot →

‘Package is not applicable’

Do not force the package. Recheck:

• Windows release and build;
• architecture;
• edition;
• packages already installed or superseded;
• required checkpoint or servicing packages.

Real-world example

On one Windows 11 PC, rollback did not restore a working installation. Package state and logs pointed to an update that had not completed locally.

The complete verified package could be applied offline. Windows then finished the remaining configuration during subsequent boots.

Read the anonymised case →

Stop if

• the package or prerequisites are not known exactly;
• BitLocker cannot be unlocked;
• the SSD is unreliable;
• there is not enough free space;
• DISM cannot open the image reliably.

Keep the logs and package lists for further diagnosis.