| Previous | Next |
| WU_E_METADATA_XML_BASE64CERDATA_MISSING | WU_E_METADATA_UNSUPPORTED_HASH_ALG |
WU_E_METADATA_BAD_SIGNATURE
WU_E_METADATA_BAD_SIGNATURE belongs to Windows Update metadata integrity handling. It is not a general Office-style document-signing error: WUA is validating the signature associated with a specific update-metadata revision obtained from an update service.
Preserve the integrity context
Modern Windows diagnostic data for update metadata integrity identifies fields such as the endpoint URL, service GUID, update or revision identity, signature algorithm, metadata signature, leaf-certificate identifier, and hashes related to leaf or intermediate certificate data. Those fields show what was being verified and are more useful than replacing the local trusted-root store at random.
- Determine whether one revision fails or every revision from the same endpoint fails.
- Compare the service GUID and endpoint with a known-good client using the same update source.
- Check for TLS inspection, proxy rewriting, or a private publishing pipeline only when the failure boundary matches that path.
Do not treat a signature failure as a download retry code
Deleting cached payloads and downloading them again does not explain a repeatable metadata-signature failure for the same revision. Keep the Windows Update ETW evidence and the metadata integrity event around the first failure so the invalid signature can be correlated with its source and revision.
References
- Microsoft: Windows Update metadata integrity diagnostic fields
- Microsoft: Windows Update log files
- Microsoft: Windows Update metadata error range
Looking for a different code? Search another status or error code.