Windows Update is the backbone of keeping your PC secure and running smoothly, but error codes like 0x80070422 can leave you stuck. This specific code typically means the Windows Update service is disabled or blocked, which prevents your system from downloading or installing patches. I will walk you through a complete troubleshooting sequence that resolves the root cause and covers several other frequent update failures.
Before You Start: If you are managing a Windows 11 Pro, Enterprise, or Education device through corporate group policy, some of these steps may be restricted by your IT administrator. You will need local administrator rights to modify services and reset update components. Close all running applications before you begin, and keep a backup of any critical files just in case.
Step 1: Verify the Windows Update Service Is Running
Press Win + R, type services.msc, and hit Enter. This opens the Services console, which displays every background process your operating system relies on. Locate Windows Update in the alphabetical list and double-click it to open its properties window.
Check the Startup type dropdown and change it to Automatic (Delayed Start) if it currently shows Disabled or Manual. Next, look at the Service status field. If it says Stopped, click Start and then click Apply before selecting OK. You will see the status change to Running within a few seconds. If the Start button remains grayed out, your system policies are actively blocking the service, and you should proceed to Step 2.
Step 2: Check Group Policy and Registry Restrictions
Open gpedit.msc and navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update. This section controls how your organization or local policy manages patch delivery. Look for the setting named Configure Automatic Updates and verify it is set to Not Configured or Enabled.
If the policy shows Disabled, your machine cannot download updates regardless of service status. Double-click the setting, switch it to Enabled, and select option 4 (Auto download and schedule the install). Click OK and close the editor. For registry-based restrictions, press Win + R, type regedit, and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate. Delete any DisableOSUpdate or DoNotConnectToWindowsUpdateInternetSites entries if they exist. Restart your PC after making these changes to ensure the policy refreshes.
Step 3: Stop the Update Services Temporarily
Open an elevated Command Prompt and run the four service stop commands. You need a clean slate to reset the update engine, and that requires halting the active processes first. Type the following commands one by one, pressing Enter after each:
net stop wuauservnet stop cryptSvcnet stop bitsnet stop msiserver
You will see a confirmation message stating each service stopped successfully. If any command returns an error saying the service is not started, that is normal and you can continue to the next step. These services handle patch downloads, cryptographic verification, background transfers, and installer packaging. Stopping them prevents file-lock conflicts while you clear the cache.
Step 4: Clear the SoftwareDistribution and Catroot2 Folders
Rename the C:\Windows\SoftwareDistribution and C:\Windows\System32\Catroot2 directories. These folders store downloaded update packages and cryptographic signatures. When downloads become corrupted or signatures mismatch, Windows Update throws errors like 0x80070422, 0x80240034, or 0x800F0954.
Since the services are stopped, you can safely rename the folders by typing ren C:\Windows\SoftwareDistribution SoftwareDistribution.old and ren C:\Windows\System32\Catroot2 Catroot2.old in the same elevated Command Prompt. Windows will automatically recreate fresh, empty versions of both folders the next time the services restart. This forces the system to re-download all pending patches from Microsoft servers instead of relying on damaged local copies.
Step 5: Restart the Update Services
Run the four service start commands in the elevated Command Prompt. You just cleared the corrupted cache, so now you need to bring the engine back online. Type the following commands one by one, pressing Enter after each:
net start wuauservnet start cryptSvcnet start bitsnet start msiserver
Each command will return a message confirming the service started successfully. You can close the Command Prompt window after the final command completes. Open Settings > Windows Update and click Check for updates. You should now see the progress bar move past the initial stall point. If the error returns immediately, proceed to Step 6.
Step 6: Run the Built-In Windows Update Troubleshooter
Navigate to Settings > System > Troubleshoot > Other troubleshooters and click Run next to Windows Update. Microsoft includes a diagnostic tool that automatically scans for misconfigured dependencies, broken network bindings, and service state mismatches. The troubleshooter will pause on your screen while it evaluates your system.
When it finishes, review the results panel. If it reports that it fixed a problem, click Close and attempt another update check. If it says it could not fix the issue, do not dismiss the window yet. Click Show detailed information to read the exact component it flagged. This output often points to a corrupted svchost.exe group or a broken network stack, which you can address in the next step.
Step 7: Repair System Files and Reset the Network Stack
Run the Deployment Image Servicing and Management tool followed by the System File Checker. Corrupted system binaries or damaged network configurations can mimic service-disabled errors. Open an elevated Command Prompt and enter the following commands in order, waiting for each to finish before running the next:
DISM /Online /Cleanup-Image /RestoreHealthsfc /scannownetsh winsock resetnetsh int ip reset
The DISM command repairs the Windows component store, sfc replaces damaged system files, and the netsh commands clear corrupted socket and IP configurations. You will see percentage counters and final success messages for each tool. Restart your computer after the final command completes. This sequence resolves lingering corruption that triggers 0x80070422 and several related patching failures.
Troubleshooting: Common Failure Points
The Windows Update service refuses to start. If Step 1 or Step 5 returns an access denied error, your device likely has a third-party security suite blocking service modifications. Open your antivirus or endpoint protection dashboard, locate the System Protection or Service Control section, and temporarily allow wuauserv.exe to run. After updates install, re-enable the restriction.
Error 0x80070422 returns after resetting components. This usually indicates a Group Policy override from a managed environment. Open rsop.msc to view the effective policy configuration. If Configure Automatic Updates shows as Managed by your organization, you will need to contact your IT department to adjust the policy. Local changes will be overwritten at the next policy refresh cycle.
Updates download but fail at 0% or 100%. When the service runs but patches never complete, the issue typically sits in the network layer or DNS resolution. Switch to a public DNS server like 1.1.1.1 or 8.8.8.8 in your adapter settings, or temporarily disable your VPN client. Corporate proxy configurations also frequently interrupt Microsoft server communication.
Pro Tip: Enable the Delivery Optimization feature in Settings > Windows Update > Advanced options if you have multiple PCs on the same network. It allows your devices to share downloaded update files locally, which reduces server load and prevents timeout-related errors on slower connections.
Following this sequence resolves the vast majority of Windows Update error 0x80070422 cases and clears the path for other common patching failures. Keep this guide bookmarked so you can return quickly when the next error code appears. Have you run into error 0x80070422 on your daily driver, or does your organization push updates through a different channel?
Over to you: Have you run into error 0x80070422 on your daily driver, or does your organization push updates through a different channel?
