# A New iPhone Stuck at 1%: Error 1109, Apple Devices on Windows 11, and the iTunes Workaround

> A brand-new iPhone 17e got stuck on the Apple logo at 1% when I updated it through the Apple Devices app on Windows 11. The log showed error 1109, a failed WKMS key fetch, and the restore-mode USB network interface failing to start. Reinstalling with classic iTunes fixed it in 14 minutes.

Source: https://chanmeng.org/blog/iphone-restore-error-1109-windows-11
Author: Chan Meng — https://chanmeng.org
Published: 2026-10-23
Tags: DevOps

---

On 22 October 2026 I plugged a brand-new iPhone 17e into my Windows 11 laptop and clicked **Update** in Apple's **Apple Devices** app. The app reported that the update failed. The phone was left on a black screen with a white Apple logo and a progress bar stuck at 1%.

A second attempt gave the same result. What fixed it was uninstalling Apple Devices, installing classic **iTunes**, and restoring the phone with iTunes. This post records what the logs showed, what did not work, and the exact steps that did, so the next person can skip the guesswork.

## 0. Summary

- **What you see:** the phone shows the Apple logo with a progress bar frozen at 1%. Apple Devices either reports that the update failed or sits on "Verifying iPhone software update" indefinitely.
- **Root error in the log:** `AMRestoreErrorDomain code:1109 description:Error retrieving WKMS decryption key`, preceded by a series of HTTP request timeouts.
- **What I saw in Device Manager:** in restore mode the iPhone exposes a USB network interface (NCM). On this machine that interface failed to start (Code 10), and its data interface had no driver at all (Code 28).
- **What did not help:** retrying Update, choosing Restore in the same app, and forcing the phone out of recovery mode.
- **What fixed it:** uninstalling Apple Devices, installing iTunes 12.13.11.1 plus Apple Mobile Device Support, and choosing **Restore** in iTunes. The restore finished with `status: 0` in about 14 minutes, counted from the start of the restore log.
- **Lesson:** update an iPhone over Wi-Fi on the phone itself. Only use a Windows PC when the phone can no longer boot.

## 1. Setup

| Item | Version |
|---|---|
| iPhone | iPhone 17e (`iPhone18,5`), new out of the box |
| Target iOS | iOS 27.0.1 (build `24A446`) |
| Windows | Windows 11 Home, build 10.0.26300 |
| Apple Devices app | 1.1540.24088.0 (Microsoft Store) |
| iTunes | 12.13.11.1 (64-bit installer from apple.com) |
| Apple Mobile Device Support | 20.0.0.35 |
| Apple USB driver (`appleusb.inf`) | 538.0.0.0, dated 14 June 2023 |

The laptop was on ordinary home Wi-Fi. The system proxy was off, and no VPN or proxy client was running.

## 2. What happened

1. **Update in Apple Devices.** The app downloaded the update and put the phone into restore mode. Then it reported that the update had failed. The phone stayed on the Apple logo at 1%.
2. **Force restart.** The key sequence for this model is: press and release volume up, press and release volume down, then hold the side button. After it, the phone came back up in **recovery mode**, the screen with a computer and a cable. The original system no longer booted.
3. **Exit recovery from the PC.** I sent `setenv auto-boot true`, `saveenv` and `reboot` with `irecovery`. The phone went straight back to recovery, which confirmed that the failed update had already modified the system partition.
4. **Second Update in Apple Devices.** It stalled on "Verifying iPhone software update" while the phone sat at 1% again.
5. **iTunes.** I uninstalled Apple Devices, installed iTunes and Apple Mobile Device Support, put the phone back into recovery mode and chose Restore. iTunes downloaded an 11.9 GB restore image (`iPhone18,5_27.0.1_24A446_Restore.ipsw`). The restore then ran to completion, and the phone booted to the setup screen on iOS 27.0.1.

The phone was new, so erasing it cost nothing. With data on the phone, try **Update** before **Restore**: Update reinstalls iOS and keeps your data, while Restore erases the phone.

## 3. Diagnosis

### 3.1 The restore log

Apple Devices writes its updater log to:

```text
%LOCALAPPDATA%\Packages\AppleInc.AppleDevices_nzyj5cx40ttqa\LocalCache\Roaming\Apple\AMPDevicesAgent\iPhone Updater Logs\
```

iTunes writes the same kind of log to `%APPDATA%\Apple Computer\iTunes\iPhone Updater Logs\`.

The failed run, trimmed:

```text
Established SOCKS proxy for device
amai: _AMSupportHttpMessageSendSyncNoRetry: CFURLConnectionSendSynchronousRequest() error:
      The request timed out. (kCFErrorDomainCFNetwork -1001)      <- repeated 5 times over 2.5 minutes
WKMS: No authorization token available for wkms.sd.apple.com; failing
CFError domain:AMRestoreErrorDomain code:1109 description:Error retrieving WKMS decryption key
Failed to send file done message to device.
failed to send source boot object file to device
Restore failed (result = 1109)
Depth:2 Code:9 Error:Failed to handle source boot object request
Restore completed, status: 9
```

During a restore the host computer runs a SOCKS proxy for the phone, which has no Wi-Fi in restore mode. The phone has to fetch a decryption key from `wkms.sd.apple.com`, and without it the restore cannot continue.

The name `wkms.sd.apple.com` does not resolve on public DNS. I checked the system resolver, 8.8.8.8, 1.1.1.1 and 9.9.9.9, and every one returned NXDOMAIN. Every other Apple restore endpoint I tested from the laptop answered on port 443: `gs.apple.com`, `albert.apple.com`, `mesu.apple.com`, `updates.cdn-apple.com` and `static.ips.apple.com`. So the laptop's own connection to Apple was fine. **(inference)** The key request is made by the phone through the host proxy, and it timed out somewhere on that path.

### 3.2 The restore-mode USB devices

While the phone was in restore mode, Device Manager showed:

| Interface | Class | Driver | Status |
|---|---|---|---|
| `USB\VID_05AC&PID_12AC&RESTORE_MODE&MI_00` | USBDevice | `appleusb.inf` (Apple) | OK |
| `USB\VID_05AC&PID_12AC&RESTORE_MODE&MI_01` | Net | `usbncm.inf` (Windows inbox) | **Code 10**, device cannot start |
| `USB\VID_05AC&PID_12AC&RESTORE_MODE&MI_02` | none ("NCM Data") | none | **Code 28**, no driver installed |

The parent device is "Apple Mobile Device USB Composite Device", which uses Apple's composite driver. NCM, the USB Network Control Model, has a control interface and a data interface that one driver is expected to bind together. Here the two interfaces enumerated as separate devices. Windows' inbox `usbncm` driver bound to the control interface and failed to start, and nothing bound to the data interface. **(inference)** If the phone uses this link for its network traffic in restore mode, a link that never comes up would explain the timeouts in section 3.1.

### 3.3 What I did not prove

- I did not record the state of the NCM interfaces during the successful iTunes restore. Installing iTunes added no new network driver: the driver store still held only `appleusb.inf` and Apple's 2013 tether driver `netaapl64.inf`. So I cannot say whether iTunes used the NCM link or took a different path. What I can say is that, on the same machine with the same drivers, iTunes succeeded and Apple Devices failed twice.
- I tested one PC and one phone. Users on the [Apple Community](https://discussions.apple.com/thread/255817751) and [Microsoft Q&A](https://learn.microsoft.com/en-us/answers/questions/3917700/the-apple-devices-app-doesnt-work-after-updating-t) report error 1109 and failed Apple Devices restores after updating to Windows 11 24H2. Some say switching from Apple Devices to iTunes fixed it. Build 26300 is newer than 24H2.

## 4. The fix, step by step

1. **Unplug nothing yet. Close Apple Devices and uninstall it.** It shares Apple Mobile Device Support with iTunes, and the two should not be installed together.
2. **Download the 64-bit iTunes installer from Apple:** `https://www.apple.com/itunes/download/win64`. In my case it redirected to `secure-appldnld.apple.com` and downloaded a 203 MB file. The Authenticode signature should read `CN=Apple Inc.`
3. **Install it from an elevated prompt.** The installer is a bootstrapper. A silent install (`/qn`) from a non-elevated shell fails with exit code 1603. When I ran it elevated, it installed `iTunes64.msi` but **not** Apple Mobile Device Support, the component that actually talks to the phone. If `Apple Mobile Device Service` does not exist afterwards, extract and install that component on its own:

   ```powershell
   .\iTunes64Setup.exe /extract .\extracted
   # extracted\ contains AppleMobileDeviceSupport64.msi, iTunes64.msi, SetupAdmin.exe
   Start-Process msiexec.exe -Verb RunAs -Wait -ArgumentList '/i "extracted\AppleMobileDeviceSupport64.msi" /qn /norestart'
   (Get-Service 'Apple Mobile Device Service').Status   # should be Running
   ```

   Installing the extracted components interactively, by double-clicking each MSI, works too.
4. **Put the phone into recovery mode.** Keep the cable connected. Press and release volume up, press and release volume down, then hold the side button until the computer-and-cable screen appears.
5. **Open iTunes.** It reports a phone in recovery mode. Choose **Update** first if you need your data. Choose **Restore** if Update fails or the phone is empty.
6. **Leave it alone.** iTunes first downloads the full restore image, 11.9 GB in my case, to `%APPDATA%\Apple Computer\iTunes\iPhone Software Updates\`. It then writes the system ("ASR progress: Sending payload" in the log) and reboots the phone. My restore log ran from 23:44 to 23:57 and ended with `Restore completed, status: 0`.
7. **Clean up.** Delete the `.ipsw` afterwards if your system drive is short on space. iTunes downloads it again when it needs it.

## 5. Things that do not help

- **Waiting.** Once the app has reported failure, nothing on the computer is still sending data to the phone, so the 1% bar will not move.
- **Retrying in the same app.** Update and Restore both need the same key from the same server, so both fail at the same point.
- **Forcing the phone out of recovery.** `irecovery -c "setenv auto-boot true"`, `saveenv` and `reboot` only help if the old system is still intact. After a partial update it is not.
- **Disabling the firewall or changing system drivers.** Some forum posts suggest firewall and Defender exclusions or a different DNS server. I made none of these changes, because swapping the installer fixed the problem without touching system security settings.

## 6. Takeaways

- **Update over the air.** Settings → General → Software Update on the phone avoids the whole host-side restore path.
- **On Windows 11, restore with iTunes rather than Apple Devices.** At least do this when a phone needs a restore from recovery mode on a 24H2 or later build.
- **Read the updater log before retrying.** The numeric error and the line before it (`Error retrieving WKMS decryption key`) say more than any dialog box does.
- **Recovery mode is recoverable.** A phone on the computer-and-cable screen still identifies itself over USB (`MODE: Recovery` from `irecovery -q`). It is waiting for a host that can finish the job, not broken.