cloudflare/cloudflared · error

Error during update : %s;

Error message

Error during update : %s;

What it means

cloudflared's Windows service updater (WorkersService) applies an update by running a generated .bat file via `cmd /C`. When cmd.exe exits non-zero, the updater wraps the batch's captured stderr in this error so the user knows why the update failed. It is thrown from runWindowsBatch, called by the WorkersService Apply method during a self-update.

Source

Thrown at cmd/cloudflared/updater/workers_update.go:250

	}

	t, err := template.New("batch").Parse(windowsUpdateCommandTemplate)
	if err != nil {
		return err
	}
	return t.Execute(f, data)
}

// run each OS command for windows
func runWindowsBatch(batchFile string) error {
	defer os.Remove(batchFile)
	cmd := exec.Command("cmd", "/C", batchFile)
	_, err := cmd.Output()
	// Remove the batch file we created. Don't let this interfere with the error
	// we report.
	if err != nil {
		if exitError, ok := err.(*exec.ExitError); ok {
			return fmt.Errorf("Error during update : %s;", string(exitError.Stderr))
		}
	}
	return err
}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Read the stderr text embedded in the message to identify which batch step failed
2. Stop the cloudflared service manually (net stop cloudflared), apply the update, then restart it
3. Re-run the update from an elevated (Administrator) command prompt
4. Check antivirus/EDR logs for blocked script execution and whitelist the batch file
5. If self-update keeps failing, download and install the new cloudflared MSI manually

Example fix

// before
_, err := cmd.Output()
if err != nil {
	if exitError, ok := err.(*exec.ExitError); ok {
		return fmt.Errorf("Error during update : %s;", string(exitError.Stderr))
	}
}
// after
var stdout, stderr bytes.Buffer
cmd.Stdout, cmd.Stderr = &stdout, &stderr
if err := cmd.Run(); err != nil {
	if exitErr, ok := err.(*exec.ExitError); ok {
		return fmt.Errorf("update batch failed (exit %d): %s", exitErr.ExitCode(), stderr.String())
	}
	return fmt.Errorf("failed to run update batch: %w", err)
}

// PowerShell pre-check before attempting self-update
if (-Not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { Write-Error 'Update requires elevation'; exit 1 }
if (Get-Process cloudflared -ErrorAction SilentlyContinue) { Write-Error 'Stop running cloudflared processes first'; exit 1 }

// Go caller
if err := update.Apply(); err != nil {
	var exitErr *exec.ExitError
	if errors.As(err, &exitErr) {
		log.Error().Bytes("stderr", exitErr.Stderr).Msg("update batch failed; falling back to manual install")
	}
	return err
}

When it happens

Trigger: The generated batch file (e.g. stopping the service, copying the new binary, restarting) exits with a non-zero status; cmd.Output() returns *exec.ExitError and the error text is the batch's stderr output.

Common situations: The new binary is locked by a running cloudflared process so the copy step fails; insufficient privileges to stop/restart the Windows service; antivirus blocking the batch script; the batch file itself is missing or its path contains quoting problems.

Related errors

• cloudflared service is already installed at ${service}; if y
• create token security descriptor: %w
• convert path to UTF-16: %w
• create token file: %w
• close token file: %w

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/312d71cf4a27b8da. Report an issue: GitHub.