What Is Catroot2? Fix Windows Update Errors (Complete Guide)

Windows Update stuck at 99%? A hidden folder called Catroot2 might be the culprit. It's a name that sounds vaguely suspicious—like something a malware author would dream up—but it's actually one of the most critical pieces of the Windows Update machinery. Over the years, I've lost count of how many systems I've rescued by resetting this single folder. Let's dig into what it is, why it matters, and how to fix it when things go sideways.

What Is Catroot2 Folder and Why Does Windows Need It?

The Catroot2 folder lives at C:\Windows\System32\catroot2 and serves as the signature storehouse for Windows Update components. When Windows downloads an update, it doesn't just trust the file blindly—it needs cryptographic proof that the package came from Microsoft and hasn't been tampered with. That's where Catroot2 comes in.

Think of it like the ID checker at a nightclub. The bouncer (Cryptographic Services) checks each guest's ID (update signature) against a list of known-valid credentials stored in Catroot2. No folder, no verification, no entry.

Catroot2's Role in the Windows Update Process

Here's how the flow works in practice:

1. Windows Update downloads update files to the SoftwareDistribution folder
2. Cryptographic Services reads the signature data from catroot2\edb.log
3. The signatures are verified against Microsoft's catalog
4. If everything checks out, the update is approved for installation

The edb.log file inside Catroot2 is essentially a database transaction log that tracks which signatures have been processed. It's a behind-the-scenes player, but when it gets corrupted or stuck, updates can hang indefinitely.

I've seen systems where the update progress bar sits at 99% for hours. The update isn't broken—it's just waiting on a signature verification that never completes because the Catroot2 data is corrupted.

Catroot2 vs Catroot: What's the Difference?

This confuses a lot of people, and honestly, Microsoft hasn't made it easy. Here's the breakdown:

I'll say this plainly: do not touch the Catroot folder. There's no scenario where renaming or deleting it helps you, and plenty of scenarios where it makes things worse.

How to Reset Catroot2 Folder to Fix Windows Update Problems

When Windows Update starts throwing errors like 0x800f081f or 0x80070005, resetting Catroot2 is often the first thing I try. It's non-destructive, takes about two minutes, and resolves a surprising number of issues.

Step-by-Step: Reset Catroot2 Using Command Prompt

Before you do anything, run Command Prompt as Administrator. Not as a regular user—as Administrator. The commands won't work otherwise.

Here's the sequence:

net stop cryptsvc

This stops the Cryptographic Services. You'll see a message confirming the service stopped successfully.

ren catroot2 catroot2.old

This renames the folder. Windows will create a fresh Catroot2 the next time it needs it.

net start cryptsvc

This restarts the Cryptographic Services.

That's it. Three commands, and you're done. The next time Windows Update runs, it'll create a brand-new Catroot2 folder with default permissions and start fresh.

One thing worth noting: I've seen guides that suggest deleting the folder outright instead of renaming it. Renaming is safer because it gives you a fallback if something goes wrong. You can always delete the .old folder later once you've confirmed everything works.

What to Do If You Get 'Access Denied' or 'Open in Another Program' Errors

If you try to rename or delete Catroot2 and get an "Access Denied" or "The action can't be completed because the folder or a file in it is open in another program" error, it means Cryptographic Services is actively using the folder.

The fix is straightforward: stop the service first.

But here's a gotcha I've hit more than once: Cryptographic Services can restart itself. If you stop it and don't immediately rename the folder, the service might spin back up and lock the folder again.

My approach:

1. Open Task Manager and check for any Windows Update-related processes
2. Stop the Cryptographic Services (net stop cryptsvc)
3. Immediately rename the folder
4. Restart the service

If you're still getting errors, check for these background services:

• BITS (Background Intelligent Transfer Service)
• Windows Update service itself

You can stop all three with:

net stop cryptsvc
net stop bits
net stop wuauserv

Then rename the folder, and restart everything:

net start cryptsvc
net start bits
net start wuauserv

Is It Safe to Delete Catroot2 Folder? What You Need to Know

Short answer: it's safe to delete the contents of Catroot2, but I'd advise against deleting the folder itself. Renaming is the better approach.

Why Deleting Catroot2 Is Different from Resetting It

Here's the nuance that most guides miss:

• Deleting the contents of Catroot2: Safe. Windows will rebuild what it needs.
• Deleting the folder itself: Technically safe because Windows recreates it, but riskier than renaming.
• Renaming the folder: Safest option. You get a fresh folder without losing the old one as a backup.

⚠️ Warning: Never delete or rename the Catroot folder (without the "2"). Windows does not recreate it automatically. Doing so can break Windows Update permanently.

The reason I prefer renaming over deleting is simple: if something goes wrong after the reset, I can rename catroot2.old back to catroot2 and restore the previous state. That's not possible if you've deleted the folder outright.

What Happens After You Delete or Rename Catroot2?

Here's the sequence you can expect:

1. You rename or delete Catroot2
2. Windows Update runs and detects the folder is missing
3. Windows creates a new Catroot2 with default permissions
4. Cryptographic Services starts writing fresh signature data
5. Windows Update proceeds normally

This process is completely normal and safe. I've done it dozens of times across Windows 10 and 11 systems, and I've never seen it cause a problem.

Catroot2 vs SoftwareDistribution: Understanding the Two Update Folders

If you've spent any time troubleshooting Windows Update, you've probably heard of both folders. They work together, but they do different jobs.

How These Folders Work Together

During an update, Windows first downloads files to SoftwareDistribution, then verifies their signatures using Catroot2 data, then installs them.

When to Reset Each Folder

Here's my quick decision guide:

• Reset SoftwareDistribution when: Updates fail to download, get stuck at a certain percentage, or you see errors related to downloaded files
• Reset Catroot2 when: Updates fail during installation, you see cryptographic errors, or signature verification seems to be the bottleneck

In practice, I often reset both together. It's a more thorough approach and covers more bases. The commands are:

net stop wuauserv
net stop cryptsvc
net stop bits

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old

net start wuauserv
net start cryptsvc
net start bits

Catroot2 Folder in Windows 10 vs Windows 11: Key Differences

Good news: there's not much difference between how Catroot2 works in Windows 10 and Windows 11. The folder location, the reset process, and the underlying mechanics are essentially identical.

Location and Permissions Across Versions

Common Errors and Fixes in Each Version

Windows 10:

• 0x800f081f: Source files not found. Reset Catroot2, then run DISM /Online /Cleanup-Image /RestoreHealth
• 0x80070002: File not found. Reset both Catroot2 and SoftwareDistribution
• 0x80240034: Update not applicable. Reset Catroot2 and check for pending reboots

Windows 11:

• 0x80070005: Access denied. Stop Cryptographic Services before resetting Catroot2
• 0x800f0922: Update failed to install. Reset Catroot2 and check disk space
• 0x8024200B: Update component corrupted. Reset Catroot2 and run System File Checker

The troubleshooting steps are largely the same across both versions. The error codes might differ slightly, but the underlying fix—resetting Catroot2—remains the go-to solution.

FAQ

What is Catroot2 used for?

Catroot2 stores the cryptographic signatures for Windows Update packages. When Windows downloads an update, Cryptographic Services uses the data in Catroot2 to verify that the update is legitimate and hasn't been tampered with. It's an essential part of the Windows Update components that ensures only trusted updates are installed.

Can I delete the Catroot2 folder?

You can delete the contents of Catroot2 safely, but I don't recommend deleting the folder itself. Windows will recreate it automatically, but renaming it to catroot2.old is the safer approach because it preserves a backup. Never delete or rename the Catroot folder (without the "2")—Windows won't recreate it.

How do I fix 'Catroot2 access denied' error?

The "Access Denied" error occurs because Cryptographic Services is using the folder. Open Command Prompt as Administrator and run:

net stop cryptsvc
ren catroot2 catroot2.old
net start cryptsvc

If the error persists, also stop the BITS and Windows Update services before renaming.

What is the difference between Catroot and Catroot2?

Catroot2 is the current folder used by Windows Update for signature storage and is automatically recreated by Windows. Catroot is a legacy folder that is not recreated if renamed or deleted. Never touch the Catroot folder—there's no benefit and significant risk.

Conclusion

Catroot2 is one of those behind-the-scenes components that you never think about until something breaks. But when Windows Update starts misbehaving, knowing how to reset this folder can save you hours of frustration.

The key takeaways:

• Catroot2 stores update signatures and is essential for Windows Update
• Resetting it (by renaming) is safe and effective for fixing update errors
• Never touch the Catroot folder—it won't be recreated
• The process is identical in Windows 10 and Windows 11

If you found this guide helpful, share it with someone who's struggling with Windows Update errors. And if you're still stuck, drop a comment below with your specific error code for personalized help. I've seen just about every Windows Update failure mode over the years, and I'm happy to help you sort yours out.