TL;DR: Windows Update error 0x80070002 or 0x80070003: update fails or will not install

The fix only. No explanation, no diagnosis. Read the full article if any of this does not match what you are seeing.

1. Restart the PC, then try Settings > Windows Update > Check for updates once more. Run the built-in Windows Update troubleshooter if it fails again.
2. Open Command Prompt as administrator (not PowerShell: the commands below use cmd syntax). Stop the three update services.

net stop bits
net stop wuauserv
net stop cryptsvc

3. Rename, do not delete, the two caches. Windows rebuilds them on the next scan.

ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
ren %systemroot%\System32\catroot2 catroot2.old

Rename only catroot2. Leave the folder called catroot alone. If a .old folder already exists, pick another name such as SoftwareDistribution.old2.

4. Start the services again.

net start cryptsvc
net start wuauserv
net start bits

5. Check for updates again. If it still fails, repair the component store, in this order, then restart.

DISM.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannow

6. Still failing? Read the real cause. The error code alone is not enough.

Get-WindowsUpdateLog

Then open C:\Windows\Logs\CBS\CBS.log, search for , error and match the timestamp of the failed install.

On a PC managed by WSUS, Intune or Configuration Manager, a local reset only fixes the client. If many PCs fail on the same update, ask whoever runs the update server.

← Full article, with the diagnosis and the why