windows update error 0x80070422 service disabled how to fix

TL;DR

Error 0x80070422 means a service Windows Update depends on is disabled, most often Windows Update itself after tweaking tools, debloat scripts, or a group policy turned it off. Set the service back to Manual or Automatic, start it, and check its companion services and policy settings so it does not get disabled again. Then scan again - no cache repair is needed when the service simply never ran.

windows update error 0x80070422 service disabled how to fix

Use this when

• Checking for updates fails almost instantly with 0x80070422.
• The Windows Update service shows Disabled in the services console.
• The machine recently ran a debloat, privacy, or update-blocking script, or came from an image built with updates turned off.

Not for this skill when

• All update services are running and the scan fails later with a different code. Follow that later code.
• The service starts, then stops within seconds with its own error in the system log. That is a service crash, not a disabled state.

Steps

1. Open the services console and record the startup type and state of Windows Update, Background Intelligent Transfer Service, Cryptographic Services, and Delivery Optimization. Write down which ones are Disabled, because changing only the first one you see often leaves a companion still off and the same error returns on the next scan. Verify: you have a list of every disabled update-related service, with Windows Update identified at minimum
2. Set Windows Update startup to Manual, which is the normal default that lets the system start it on demand, or Automatic if your policy standard requires it. Apply the change, then start the service and watch that it stays running for at least a minute rather than stopping straight back to disabled. Verify: the service starts, remains running, and its startup type still reads Manual after you refresh the console
3. Start or correct the companion services the same way: BITS to Manual, Cryptographic Services to Automatic, and Delivery Optimization to its default. A disabled cryptographic service in particular can re-trigger update failures that look unrelated because signature checks cannot run. Verify: all companion services are out of the Disabled state and start without errors
4. Find out who disabled it so the fix lasts. Check local group policy under Windows Update settings, any scheduled task or logon script that stops services, and recently installed tuning utilities. On managed machines, confirm with the team that owns the baseline image whether updates were disabled deliberately for a maintenance reason. Verify: the disabling source is identified and either removed, corrected in policy, or confirmed as intentional with an owner and an end date
5. Restart the machine once if a service change does not take effect, then run Check for updates and let a full scan and one install complete. Review update history to confirm the 0x80070422 entries stop and new updates show success or a normal pending restart state. Verify: a full scan completes, an update installs or reports pending restart, and no new 0x80070422 entries appear

Why it happens

Windows Update is not a single program; it is a set of cooperating services that detect, download, verify signatures for, and install packages. If the core service startup type is Disabled, the client cannot even begin and reports 0x80070422, a code that specifically means the service is disabled or has not started. The setting usually comes from outside Windows Update itself: hardening baselines, privacy tools, classroom or kiosk images, or administrators who disabled updates during a freeze and never re-enabled them. Restoring the startup types fixes the immediate error, and tracing the source prevents the silent re-disable that makes this error famously keep coming back.

Variants and edge cases

0x80070422 returns after every reboot

Something reapplies the disabled state at startup. Audit group policy results, scheduled tasks, and third-party tuning tools with a policy results report on the affected machine.

0x80070422 on a server that should use WSUS only

The service still needs to run; WSUS changes where it points, not whether it runs. Re-enable the service and confirm the WSUS policy target separately.

Startup type is greyed out and cannot be changed

Policy or a protection tool owns the setting. Change it in the owning group policy or temporarily through the service registry value with administrator rights, then find the owner before closing the ticket.

Compatibility: Applies to Windows 10, Windows 11, and Windows Server 2016 and later. Service changes need administrator rights and may need policy owner approval on managed fleets.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst2XTxfTnnGYgSipNgqSBLQ