Microsoft's November security update for Windows 11 is failing to install on some PCs. Update KB5132061, released on 10 November, stalls during download or installation with errors including 0x800f0993 and 0x800f0989, and users have traced the fault to Windows Sandbox. Disabling Sandbox, restarting the PC and trying again fixed it for the user who found the cause, although Microsoft has not officially acknowledged the problem. ## What is going wrong KB5132061 is the November Patch Tuesday cumulative update for Windows 11 versions 26H2, 25H2 and 24H2, taking them to builds 26300.9974, 26200.9974 and 26100.9974. Microsoft released it on 10 November, alongside KB5131087 for Windows 11 and KB5131096 for Windows 10. Users across the web, and readers of Neowin, report that the update fails during download or installation with error 0x800f0993, while others see 0x800f0989. More error codes have been reported by different users, including 0x800f0915 and 0x80070306. Microsoft lists no known issues for KB5132061, so the company has not officially acknowledged the failures or offered a fix of its own. Windows Report's coverage of the same reports, published on 11 November, confirms the same error codes and the same lack of an official response. ## Windows Sandbox is the prime suspect The usual advice, running DISM repairs and System File Checker scans, did not explain the failures. A user on the Windows 11 Forum dug into the Component-Based Servicing log, with help from the AI assistant Claude, and found the update failed only on the desktop PC where Windows Sandbox was enabled. The user's other Windows 11 desktop and laptop installed it normally. The log, at C:\Windows\Logs\CBS\CBS.log, showed a STATUS_OBJECT_PATH_NOT_FOUND error for a missing Professional.xml file inside the WinSxS folder, along with the message 'Failed to recreate container base images: HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND)'. That file is needed by Windows Sandbox to recreate the base image of the virtual machine it runs. The servicing process was looking for an older version of the file, and the missing path stopped the installation. This is a user's finding, not a Microsoft diagnosis, so it should be treated as a workaround rather than an official fix. ## The workaround The fix the user found is surprisingly simple: turn off Windows Sandbox, restart the PC, and install KB5132061 again. This time the update went through, and later DISM and SFC scans came back clean, suggesting there was no underlying system file corruption to repair. To disable Sandbox through the Windows Features dialog, open Start and search for 'Turn Windows features on or off', find Windows Sandbox in the list, uncheck it and click OK. Alternatively, open an elevated PowerShell window, run as administrator, and enter: Disable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM. Then restart the PC and try installing KB5132061 again. Other steps that have helped some users include running DISM.exe /Online /Cleanup-Image /RestoreHealth followed by sfc /scannow, running the Windows Update troubleshooter, or downloading the update manually from the Microsoft Update Catalog. Windows Sandbox is a lightweight, isolated desktop for safely running untrusted applications, and it is disposable: everything inside it is deleted when it closes. If you do not use it, disabling it costs nothing, and you can switch it back on afterwards. ## Why it matters KB5132061 is a security update, so a PC that cannot install it is left without November's fixes. It arrived in the same Patch Tuesday release that patches the actively exploited Outlook flaw CVE-2026-124194, which is fixed through Office updates and can leak a user's NTLMv2 hash, so users who cannot install should not simply ignore the update. Until Microsoft acknowledges the problem or issues a fix, the Sandbox workaround is the best-documented route. Read the user reports at [Neowin](https://www.neowin.net/news/user-finds-fix-for-windows-11-kb5132061-install-fail-a-microsoft-feature-may-be-culprit/) and [Windows Report](https://windowsreport.com/windows-11-kb5132061-not-downloading-and-installing-with-0x80070306-0x800f0993-and-0x800f0989-errors-temporary-fix-available/). ## Frequently asked questions **Which PCs are affected?** Reports so far concern Windows 11 versions 26H2, 25H2 and 24H2. Not every PC is affected: the Sandbox link appeared only on a machine with Windows Sandbox enabled. **Is it safe to disable Windows Sandbox?** Sandbox is an optional, isolated desktop for running untrusted apps. If you do not use it, disabling it removes nothing you need, and you can re-enable it afterwards. **What if the workaround does not help?** Run DISM and SFC repairs, use the Windows Update troubleshooter, or install the update manually from the Microsoft Update Catalog. Microsoft has not yet acknowledged the issue.