Skip to content
October 19, 2026 • Mid-Level (3-5 years) Error Reference

0x800F081F: .NET Framework 3.5 Source Files Not Found

By Last updated

0x800F081F (CBS_E_SOURCE_MISSING) on .NET Framework 3.5 means Windows found no usable NetFx3 source. Fix the sxs path, OS version match and share access.

Quick answer

0x800F081F is CBS_E_SOURCE_MISSING. When you enable .NET Framework 3.5 (NetFx3) with an alternate source, Microsoft says the path is missing the files, the installer can't read it, or the files are corrupted, incomplete or wrong for that Windows version. Point /Source at sources\sxs from RTM media for the same Windows version, check access as the account doing the install, and retry with /LimitAccess. On Windows 11 26H1 (build 28000) and later, NetFx3 isn't a Windows component, so use the standalone installer.

Free PDF

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes

A free cheat sheet covering ten enrollment errors, each with the symptom, the most likely cause, the fix, and a link to the full guide.

  • Ten real error codes and failures, including 0x80180014, 0x8018002b, 0x801c03f3, 0x800705b4, the ODJConnector logon failure, and the Win32 detection error 0x87d1041c.
  • Every cause and fix checked against Microsoft's own documentation.
  • A link from each entry to the full zakitpro.com article.

You get the free PDF. By subscribing you also agree to receive occasional emails from zakitpro about Intune and Autopilot troubleshooting. Emails are sent through MailerLite. You can unsubscribe anytime with the link in every email. See the privacy page for how your email is handled.

Step-by-step guide

You run DISM /Online /Enable-Feature /FeatureName:NetFx3 /All or tick .NET Framework 3.5 in Windows Features, and it fails with 0x800F081F. DISM says “The source files could not be found.” Microsoft’s name for the code is CBS_E_SOURCE_MISSING.

Every cause Microsoft documents for this code is about the source. Windows ships only the NetFx3 metadata; the payload comes from Windows Update or from a source you point it at. If that source is the wrong build, unreadable by the account doing the install, or missing files, you get 0x800F081F.

My fix order: confirm the Windows version, build a source from matching RTM media, test it locally with /LimitAccess, then fix how your fleet gets that source.

Quick Fix checklist

  1. Run winver. If the build is 28000 or later (Windows 11 26H1), stop here: Microsoft says .NET Framework 3.5 is only available as a standalone installer on those builds.
  2. Confirm it’s the .NET 3.5 code path. Open C:\Windows\Logs\DISM\dism.log and check that the failure is on NetFx3, not a cumulative update.
  3. Check the feature state with DISM /Online /Get-FeatureInfo /FeatureName:NetFx3.
  4. Get installation media for the same Windows version. Microsoft says to use RTM media, not refresh media.
  5. Mount the ISO and test from the device: DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /Source:D:\sources\sxs /LimitAccess.
  6. If that works, your old source was the problem. Fix the share, the Group Policy or CSP source path, or package the files with the deployment.
  7. If you use a network share, test read access as the identity doing the install, not as yourself.

What 0x800F081F means in Microsoft’s words

Microsoft’s .NET Framework 3.5 installation errors article (KB 2734782) says the code can occur when an alternative installation source is specified and one of these is true:

  • The location that is specified by the path does not contain the files that are required to install the feature.
  • The user who tries to install the feature does not have at least READ access to the location and to the files.
  • The set of installation files is corrupted, incomplete, or invalid for the version of Windows that you are running.

The .NET Framework 3.5 deployment errors table gives the resolution: “The source argument should point to the \sources\sxs folder on the installation media or the Windows folder for a mounted image.”

The reason a source matters at all is in Microsoft’s deployment considerations page. Only the metadata is in the default image, the binaries aren’t, and Microsoft calls that state “disabled with payload removed”. The payload comes from Windows Update or the \sources\sxs folder on installation media.

When you don’t pass /Source, Microsoft’s DISM feature article says DISM looks in the location set by Group Policy first, then contacts Windows Update. /LimitAccess stops it from contacting Windows Update. With multiple /Source arguments, DISM uses the first location where it finds the files and ignores the rest.

Why the obvious diagnosis can be wrong

The same code means component store corruption elsewhere

Microsoft’s common Windows Update errors page lists 0x800f081f as “source for package or file not found, ResolveSource() unsuccessful” with the description “Component Store corruption”, and its mitigation is Dism.exe /Online /Cleanup-Image /Restorehealth plus Sfc.exe /Scannow.

That’s the right path when a cumulative update fails. For NetFx3, Microsoft’s resolution is about the source: correct path, read access, a valid and complete file set. So check which operation failed before you start a component store repair.

The share opens for you, but not for the install

Microsoft’s KB says the user who installs the feature needs at least read access to the location and files. Its PowerShell guidance for a network share names the target computer account: “The target computer account DOMAIN\SERVERNAME$ must have at least read access to the network share.”

Anything running as LocalSystem “acts as the computer on the network” and “presents the computer’s credentials to remote servers”, per Microsoft’s LocalSystem account reference. A share that opens in your own Explorer session doesn’t tell you whether the install’s account can read it. For system-run deployments, grant the computer account read access, or skip the share.

The source is the wrong build

Here the path is right and the files are there, and it still fails. Microsoft’s repair source guidance has two rules:

  • “Only use RTM media regardless of whether the source is a WIM or a mounted Windows image. Refresh media has older file versions excluded from the media and the target operating system may need these files.”
  • “Make sure the source is patched to the latest Cumulative Update. If the target OS is patched to a higher level than the source, adding features or repairing Operating Systems may fail because the target OS needs updated files that are not present in the source.”

The .NET Framework 3.5 install article adds a warning: if you’re not using Windows Update, “strictly use sources from the same corresponding Windows operating system version”, because a different version will install a mismatched .NET Framework 3.5 or fail, “leaving the system in an unsupported and unserviceable state.”

So a shared sxs folder copied from a 23H2 ISO years ago is a bad source for a 24H2 or 25H2 fleet. I’d keep one source per Windows version and label it with the version.

You’re on Windows 11 26H1, where NetFx3 isn’t a Windows component

Microsoft’s .NET Framework 3.5 on Windows 11 FAQ says: “Starting with Windows 11 26H1 (build 28000), .NET Framework 3.5 is only available as a standalone installer. You can’t install .NET Framework 3.5 as a Windows component.” For offline images on those builds, it says DISM and other image tools “can’t manage .NET Framework 3.5.”

On 25H2 and earlier it’s still an optional component you enable through Features on Demand. On 26H1 and later, a better source path won’t help, because Microsoft says you can’t install it as a Windows component. Use the standalone installer from Microsoft’s Install .NET Framework 3.5 on Windows 11 page; the FAQ says it supports /q and /quiet for unattended installs, and that the installers “only work with the version of Windows specified.”

Neighboring codes have different causes

CodeNameMicrosoft’s causeWhere to look
0x800F081FCBS_E_SOURCE_MISSINGAlternate source is missing files, unreadable, or wrong for this Windows versionThe source path, its build, and access
0x800F0906CBS_E_DOWNLOAD_FAILUREThe computer can’t download the files from Windows UpdateNetwork, proxy, firewall, or WSUS servicing policy
0x800F0907CBS_E_GROUPPOLICY_DISALLOWEDNo valid alternate source and the policy is set to Never attempt to download payload from Windows UpdateThe Specify settings for optional component installation and component repair policy
0x800F0922CBS_E_INSTALLERS_FAILEDListed in the same KB for a Windows 10 upgrade; Microsoft notes it isn’t specific to .NET FrameworkRead & Execute on the sxs folder, then RestoreHealth

All four rows come from the KB and the deployment errors table. If you hit 0x800F0922 installing a monthly update, my 0x800f0922 update failure guide is the closer match.

Evidence to inspect

DISM and CBS logs

The KB’s error table gives the DISM log location: C:\Windows\Logs\DISM\dism.log. Microsoft’s Windows Update corruption article gives the CBS log as %windir%\Logs\CBS\CBS.log. Check the timestamp of the failed attempt in both, and confirm the operation was enabling NetFx3.

Feature state

DISM /Online /Get-FeatureInfo /FeatureName:NetFx3
Get-WindowsOptionalFeature -Online -FeatureName NetFx3

On 25H2 and earlier, a device that never had the payload is in the state Microsoft calls disabled with payload removed. If it already reports Enabled, NetFx3 is installed and the error came from a different operation.

Windows version and build

Run winver. You need the exact version to pick a matching source, and the build tells you whether you’re on 26H1 (build 28000) or later.

The servicing policy on the device

The Group Policy is Specify settings for optional component installation and component repair, under Computer Configuration\Administrative Templates\System. The ADMX_Servicing Policy CSP maps it to this registry key and MDM path:

Software\Microsoft\Windows\CurrentVersion\Policies\Servicing
./Device/Vendor/MSFT/Policy/Config/ADMX_Servicing/Servicing

Read what’s set without changing anything:

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Servicing

If an Alternate source file path is set, that’s the source DISM tries when you don’t pass /Source. Check that path against the three causes in the KB.

The fix

1. Test with a known-good local source

  1. Download or create installation media for the exact Windows version on the device. Microsoft’s KB resolution for Windows 10 uses the Media Creation Tool to create an ISO for the installed version.
  2. Mount the ISO. Note the drive letter.
  3. In an elevated Command Prompt, run:
DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /Source:D:\sources\sxs /LimitAccess

Replace D: with the mounted drive. /All enables the parent features and /LimitAccess keeps DISM off Windows Update, so a success here proves the source works.

If this still fails with 0x800F081F, check the media against the device version again. The KB’s last step is to try a different installation source.

2. Fix the source your fleet uses

Choose based on how your devices should get the payload:

  • Set an alternate source. Enable Specify settings for optional component installation and component repair and set Alternate source file path to a share holding the sources\sxs contents, or a WIM with the WIM: prefix and image index, such as WIM:\\server_name\share\install.wim:3. The ADMX_Servicing CSP says multiple locations can be separated by a semicolon. Grant the computer accounts read access. Microsoft’s Group Policy FoD article notes that a WIM can be kept current with updates, which helps with the cumulative update rule above.
  • Use Windows Update. The ADMX_Servicing CSP says that when the policy isn’t configured, or the files aren’t at the listed locations, files come from Windows Update “if that’s allowed by the policy settings for the computer.” For WSUS clients, see the WSUS section below.
  • Package the source with the deployment. For Intune, this is the one I’d pick. A laptop off the corporate network can’t reach your share without a VPN, and a package removes the access question.

3. Deploy NetFx3 as an Intune Win32 app with its own source

Copy the sources\sxs folder from RTM media that matches the target Windows version into the package folder, next to this script:

# Install-NetFx3.ps1
# Expects .\sxs from RTM media for the SAME Windows version as the target device.
$source = Join-Path -Path $PSScriptRoot -ChildPath 'sxs'

if (-not (Get-ChildItem -Path $source -Filter '*.cab' -ErrorAction SilentlyContinue)) {
    Write-Output "No .cab files found in $source"
    exit 1
}

try {
    Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All -Source $source -LimitAccess -NoRestart -ErrorAction Stop | Out-Null
    exit 0
}
catch {
    Write-Output "Enable-WindowsOptionalFeature failed: $($_.Exception.Message)"
    exit 1
}

Install command:

powershell.exe -ExecutionPolicy Bypass -File .\Install-NetFx3.ps1

The cmdlet parameters are from Microsoft’s Enable-WindowsOptionalFeature reference: -LimitAccess prevents contacting Windows Update, and -NoRestart suppresses the reboot. I checked that the script parses in PowerShell 7. I haven’t run it against a Windows device for this article, so pilot it first.

For detection, use the registry key Microsoft documents in How to determine which .NET Framework versions are installed:

Key path:   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5
Value name: Install
Rule:       Integer, Equals, 1

Two packaging notes:

  • One package per Windows version, because the source has to match. Use requirement rules or assignment groups to keep each package on its own version.
  • Keep this package away from 26H1 (build 28000) and later devices. Those need the standalone installer, deployed with /q.

If you’re new to how Intune runs these, my guides on System vs User install context and HKLM vs HKCU detection rules cover the two settings this package depends on. If the app reports a failure and you only have a decimal code from a log, the Intune App Failure Analyzer has a hex and decimal converter and runs in your browser; 0x800F081F is -2146498529 as a signed decimal.

If the device uses WSUS

Microsoft’s FoD and language packs for WSUS and Configuration Manager page says Windows 11 version 22H2 and later clients get Features on Demand from WSUS through on-premises Unified Update Platform (UUP) updates, so they don’t need the servicing policy for FoD content.

Starting in Windows 11 version 24H2, Microsoft removed two options from the policy:

  • Never attempt to download payload from Windows Update
  • Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS)

The older KB steps still mention those options, so don’t expect to find them on a 24H2 device. The same page says changing this policy doesn’t change where OS updates come from; they keep coming from WSUS or Configuration Manager.

Windows Server

On Windows Server, Microsoft’s equivalent is Install-WindowsFeature:

Install-WindowsFeature Net-Framework-Core -source \\network\share\sxs

The same computer account read access rule applies to the share.

Verify the fix

  1. Run DISM /Online /Get-FeatureInfo /FeatureName:NetFx3 and confirm the state is enabled.
  2. Check HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5 for Install equal to 1.
  3. Restart if prompted, then launch the app that needed .NET Framework 3.5.
  4. For Intune, confirm the Win32 app reports installed on a pilot device before widening the assignment.

What not to waste time on

  • Running RestoreHealth against no source or the same bad source. Fix the source first.
  • Reusing an old sxs copy from a different Windows version. Microsoft warns that a mismatched source can leave the system unserviceable.
  • Testing share access with your own account. Test as the identity that runs the install.
  • Fighting DISM on 26H1 or later. Use the standalone installer.

Prevention checklist

  • Keep one NetFx3 source per Windows version, from RTM media, labeled with the version.
  • Refresh the source when a feature update lands. If you use a WIM, service it with the latest cumulative update.
  • Grant computer accounts read access to any repair share.
  • Package the source inside the Intune Win32 app instead of depending on a share.
  • Exclude 26H1 (build 28000) and later from the DISM-based package and plan the standalone installer for them.
  • Ask the app vendor for a build on modern .NET or .NET Framework 4.8.1. That’s the migration path Microsoft’s FAQ recommends.

Takeaway

For me, 0x800F081F on NetFx3 is a source question. I check the Windows version, test once with matching RTM media and /LimitAccess, and only then touch policy or packaging. If the version is 26H1 or later, I skip DISM and deploy the standalone installer.

Related ZakitPro guides:

Sources

Free PDF

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes

A free cheat sheet covering ten enrollment errors, each with the symptom, the most likely cause, the fix, and a link to the full guide.

  • Ten real error codes and failures, including 0x80180014, 0x8018002b, 0x801c03f3, 0x800705b4, the ODJConnector logon failure, and the Win32 detection error 0x87d1041c.
  • Every cause and fix checked against Microsoft's own documentation.
  • A link from each entry to the full zakitpro.com article.

You get the free PDF. By subscribing you also agree to receive occasional emails from zakitpro about Intune and Autopilot troubleshooting. Emails are sent through MailerLite. You can unsubscribe anytime with the link in every email. See the privacy page for how your email is handled.

Related Articles

senior 9 min read

Intune Win32 Graph Limits: Supersedence and Dependencies

Intune Win32 supersedence or dependency chain stopped working as it grew? Learn documents graph limits, conflict states and Relate permission. Check these first.

mid 9 min read

Verify Installer Hash Before Intune Win32 Packaging

A fake Advanced IP Scanner MSI reached Intune endpoints. Verify the installer source, SHA256 hash and signature with PowerShell before you package a Win32 app.

senior 13 min read

Hybrid Join Error 0x801c03f2: Device Object Not Found Fix

Hybrid join error 0x801c03f2 (DSREG_E_DIRECTORY_FAILURE): the server message separates a sync delay, an out-of-scope OU, a missing userCertificate or bad SCP.

#0x800F081F #.NET Framework 3.5 #NetFx3 #DISM #Features on Demand