Fix Windows Update Error 0x800f0922 on Windows 11 (CBS/DISM Walkthrough)

Windows Update error 0x800f0922 on Windows 11 typically appears when a cumulative update, .NET update, or feature update reaches the final stage and then rolls back. It’s critical to fix because it leaves your system without security fixes, can block future updates, and often indicates underlying servicing store or partition issues that will resurface. This guide goes beyond generic advice with a full CBS/DISM walkthrough, safe and advanced fixes, and practical diagnostics to pinpoint the root cause.

—

Understanding the Error

Windows Update error 0x800f0922 is a servicing/installation failure reported by the Component-Based Servicing (CBS) engine during an update. In plain language, it means Windows got very close to finishing an update but failed to apply or finalize one or more components.

What this often translates to on Windows 11:

• The update cannot write to or update the System Reserved partition (SRP) or EFI System Partition (ESP) because there isn’t enough free space.
• The Windows servicing store (WinSxS) is corrupted or out of sync.
• The system can’t reach Microsoft Update servers (VPN/proxy/firewall/TLS issue).
• .NET features or updates cannot be installed because the payload is blocked or the local component store is damaged.
• Update cache/services are stuck in a bad state.

Common scenarios that trigger 0x800f0922:

• Cumulative update gets to 98–100% then fails and rolls back.
• .NET Framework update or .NET 3.5 on-demand feature install fails repeatedly.
• Devices managed by WSUS or with strict proxies/VPNs can’t fetch needed payloads.
• Older systems upgraded to Windows 11 still have a small SRP/ESP.

—

Quick Reference Table

Cause	Symptom	Recommended Fix
VPN/proxy/firewall blocks Microsoft Update endpoints	Update fails near 100%; Windows Update troubleshooter shows connectivity issues	Disconnect VPN, disable proxy, allow Microsoft Update URLs, retry
Insufficient SRP/EFI free space	Cumulative updates fail at finalizing; CBS log mentions partition space issues	Extend SRP/ESP to at least 260–500 MB; or temporarily free EFI space (with caution)
Corrupted component store (WinSxS)	DISM shows corruption; 0x800f0922 persists across multiple updates	Run SFC and DISM RestoreHealth (optionally with offline source), then retry
.NET servicing failure or blocked payload	.NET update or NetFx3 feature install fails; Group Policy blocks source	Enable .NET using DISM with local ISO source; set GP “Specify settings for optional component installation”
Stuck Windows Update cache/services	Updates download repeatedly then fail; errors in WindowsUpdateClient	Reset Windows Update components (stop services, rename SoftwareDistribution/Catroot2), then retry
Third‑party AV/security interference	Update fails only with security software installed	Temporarily uninstall or disable AV/firewall; use clean boot; retry update
Disk or file system errors	CHKDSK reports errors; updates fail inconsistently	Run CHKDSK and fix errors, then SFC/DISM; ensure enough C: free space
TLS/legacy protocols disabled	Corporate images; handshake failures to Microsoft endpoints	Ensure TLS 1.2 is enabled for WinHTTP/.NET; confirm endpoint access
Pending actions or incomplete previous updates	“Pending” statuses in servicing; update reattempts fail	Clear pending state, StartComponentCleanup, or perform in-place repair upgrade

—

Common Causes

• Network and policy:

  • VPN, proxy, or strict firewall rules blocking Microsoft Update CDN.
  • WSUS or Group Policy preventing feature payloads (especially .NET 3.5).
  • TLS 1.2 disabled in older images or hardened environments.

• Partition and disk layout:

  • Small System Reserved partition (MBR) or EFI System Partition (GPT), commonly <260 MB free.
  • Full or near full C: drive; insufficient free space for the update staging area.

• Servicing store and system files:

  • Corrupted WinSxS component store.
  • Leftover pending operations from previous updates.
  • Damaged or misconfigured .NET Framework components.

• Services and cache:

  • Windows Update services not running or misconfigured.
  • Corrupted SoftwareDistribution or Catroot2 folders.

• Security and third‑party software:

  • AV/firewall drivers or web protection intercepting update traffic.
  • Endpoint security blocking script hosts or update executables.

• Hardware and storage:

  • File system inconsistencies; bad sectors; failing storage.
  • Unstable overclocks interfering with boot finishing an update.

—

Preliminary Checks

• Booting to Safe Mode (for maintenance tasks)

  • Note: Windows Update doesn’t run in Safe Mode, but Safe Mode is useful to run repairs or uninstall conflicting software.
  • Steps:
    1. Settings > System > Recovery > Advanced startup > Restart now.
    2. Troubleshoot > Advanced options > Startup Settings > Restart.
    3. Press 4 for Safe Mode or 5 for Safe Mode with Networking.
    4. To exit Safe Mode, reboot normally.

• Back up important data

  • Create a restore point: Control Panel > System > System Protection > Create.
  • Back up critical files to external storage or cloud.
  • Consider a full image backup (e.g., with built-in System Image Backup or third-party tools) before partition changes or in-place repair.

• Run basic health checks

  • Check disk and file system:

    chkdsk C: /scan

    For fixes on reboot (if needed):

    chkdsk C: /f

  • System file check:

    sfc /scannow

  • DISM basic health:

    DISM /Online /Cleanup-Image /CheckHealth
    DISM /Online /Cleanup-Image /ScanHealth

    If corruption is reported, plan to run RestoreHealth later in the steps below.

Ensure you have at least 10–20 GB free on C: before proceeding.

—

Step-by-Step Troubleshooting

Work through these in order. Test Windows Update after each major step.

1. Confirm the failing update and error details

• Settings > Windows Update > Update history > Learn more/View error details.
• Event Viewer: Applications and Services Logs > Microsoft > Windows > WindowsUpdateClient > Operational.
  • Look for Event ID 20 or 25 with error 0x800f0922 and the specific KB number.

2. Eliminate network blockers (VPN/proxy/firewall)

• Disconnect VPN and corporate proxies temporarily.

• Check proxy settings:

  netsh winhttp show proxy
  netsh winhttp reset proxy

  If you rely on a proxy, reconfigure after testing.

• Ensure these Microsoft Update endpoints are reachable (allow in firewall/content filters):

  • .windowsupdate.com, .update.microsoft.com
  • .download.windowsupdate.com, .dl.delivery.mp.microsoft.com
  • *.emdl.ws.microsoft.com

• If using a corporate network, try a home network or mobile hotspot to test.

3. Run the Windows Update Troubleshooter

• Settings > System > Troubleshoot > Other troubleshooters > Windows Update > Run.
• Apply any suggested fixes and retry the update.

4. Reset Windows Update components
   Open an elevated Command Prompt (Run as administrator) and run:

net stop bits
net stop wuauserv
net stop cryptsvc
net stop appidsvc

ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
ren %systemroot%\System32\catroot2 Catroot2.old

net start appidsvc
net start cryptsvc
net start bits
net start wuauserv

Reboot and try Windows Update again.

5. Run SFC and DISM RestoreHealth (CBS/DISM walkthrough)

• SFC:

  sfc /scannow

• DISM RestoreHealth (online):

  DISM /Online /Cleanup-Image /RestoreHealth

• If DISM cannot find source files or fails, use a local ISO source matching your Windows 11 build and edition:

  1. Download the ISO (Media Creation Tool or Visual Studio Subscription).

  2. Mount it (right-click > Mount). Suppose it’s mounted as drive X:.

  3. Find install.wim or install.esd in X:\sources.

  4. Run:

     DISM /Online /Cleanup-Image /RestoreHealth /Source:WIM:X:\sources\install.wim:1 /LimitAccess

     If it’s an ESD:

     DISM /Online /Cleanup-Image /RestoreHealth /Source:ESD:X:\sources\install.esd:1 /LimitAccess

• Run SFC again:

  sfc /scannow

Retry Windows Update.

6. Repair .NET Framework servicing

• If the failing KB is a .NET update or you see .NET-related errors:

  • Turn Windows features on/off: ensure “.NET Framework 3.5 (includes .NET 2.0 and 3.0)” is not in a broken state. If installing NetFx3 fails with 0x800f0922, install it from ISO:

    DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /Source:X:\sources\sxs /LimitAccess

  • Consider repairing .NET 4.x with Microsoft’s .NET Repair Tool (if applicable).

  • Group Policy for optional component installation (Pro/Enterprise):

    • gpedit.msc > Computer Configuration > Administrative Templates > System
      

      Specify settings for optional component installation and component repair

    • Enable and check “Contact Windows Update directly to download repair content.”
      Retry Windows Update.

7. Free or expand the System Reserved/EFI partition (critical for 0x800f0922)

• Check partition size:

  • Disk Management (diskmgmt.msc) or:

    diskpart
    list disk
    sel disk 0
    list part
    exit

  • On GPT systems, the EFI System Partition (ESP) is FAT32, commonly 100–260 MB.

  • Windows 11 updates are more reliable with an ESP of 260–500 MB (with at least ~100 MB free).

• Options:

  • Safest: Use a reputable third‑party partition manager to shrink C: by ~300–500 MB and extend the EFI/SRP so it’s at least 260–500 MB. Do a full backup first.

  • Temporary space recovery (advanced, use with caution):

    • Assign a drive letter to the ESP to inspect space:

      mountvol S: /S
      S:
      dir

    • You may find large font files under S:\EFI\Microsoft\Boot\Fonts. Do not delete arbitrarily. If you must free space urgently, back up the Fonts folder and remove non‑essential language fonts only. Any mistake can render the system unbootable. When done:

      mountvol S: /D

  • After resizing/freeing space, run:

    sfc /scannow
    DISM /Online /Cleanup-Image /RestoreHealth

    Then retry the update.

8. Clean boot and security software checks

• Perform a clean boot to rule out third‑party interference:
  • msconfig > Services tab > Hide all Microsoft services > Disable all.
  • Startup tab > Open Task Manager > Disable all startup items.
  • Reboot and test Windows Update.
• Temporarily uninstall third‑party AV/firewall/web filtering tools. Many vendors provide cleanup tools—use them if standard uninstall leaves drivers behind.
• Re-enable services/startups after testing.

9. Clear pending servicing state and run component cleanup

• If CBS logs show persistent “pending” operations:

  • Open elevated Command Prompt:

    DISM /Online /Cleanup-Image /StartComponentCleanup

  • Advanced (read carefully): In rare cases, removing pending.xml in WinRE can help, but only if advised by CBS entries and you understand the risk. Safer is to proceed to an in‑place repair upgrade.

10. Enable/verify TLS 1.2 and crypto defaults (managed/older images)

• Ensure TLS 1.2 is enabled for WinHTTP and .NET if your environment hardens protocols. Microsoft provides guidance and reg templates for enabling TLS 1.2 system‑wide.
• If you use WSUS, confirm the server uses modern TLS and the client trusts it.

11. In‑place repair upgrade (keeps files and apps)

• This is the most effective “last resort” before hardware/service escalation:
  1. Download the latest Windows 11 ISO.
  2. Mount it and run setup.exe.
  3. Choose “Keep personal files and apps.”
  4. Complete setup; then run Windows Update again.
     This refreshes the servicing stack and component store without wiping your data.

12. If you update via WSUS/Intune

• Ensure the specific KB is approved/assigned and not superseded.
• Verify “Specify settings for optional component installation…” policy is configured if NetFx3 payloads are needed.
• Temporarily allow the client to contact Microsoft Update directly for repair content if your policy permits it.

—

CBS and DISM Log Analysis (What to look for)

Because 0x800f0922 is a servicing failure, your best clues are in logs.

Key log locations:

• CBS log: C:\Windows\Logs\CBS\CBS.log

• DISM log: C:\Windows\Logs\DISM\dism.log

• Windows Update log: Generate with:

  Get-WindowsUpdateLog

  This creates a readable WindowsUpdate.log on your Desktop.

Quick filters:

• Open an elevated Command Prompt:

  findstr /c:”error” /c:”failed” /c:”0x800f0922″ %windir%\Logs\CBS\CBS.log > “%userprofile%\Desktop\cbs_errors.txt”
  findstr /c:”error” /c:”failed” %windir%\Logs\DISM\dism.log > “%userprofile%\Desktop\dism_errors.txt”

What the messages mean:

• Space issues on SRP/ESP:
  • Phrases like “Not enough free space” or failures writing boot files or fonts in EFI paths.
• Component store corruption:
  • “CSI” or “Store corruption detected” lines; DISM “cannot repair” without source.
• .NET payload blocked:
  • Failures in NetFx3 features; references to “Cannot download source files,” “payload not found,” or Group Policy restrictions.
• Pending actions:
  • Repeated mention of “pending.xml,” “reboot required,” or commit failures near finalization.

Once you identify the pattern, return to the appropriate fix above (partition, DISM with ISO source, policy change, etc.).

—

Advanced Diagnostics

Use these with care. Create a restore point or backup first.

• Event Viewer deep dive

  • Applications and Services Logs:
    • Microsoft > Windows > WindowsUpdateClient > Operational
    • Microsoft > Windows > Servicing > (Component‑Based Servicing)
  • Look for repeated errors with the same package KB, failure codes around finalization, or servicing stack complaints.

• Windows Update service check

  • Ensure services are running and set to defaults:

    sc query wuauserv
    sc query bits
    sc query cryptsvc
    sc query trustedinstaller

  • TrustedInstaller (Windows Modules Installer) must be functional; check for service failures in System logs.

• Servicing stack and payload integrity

  • Enumerate installed packages:

    DISM /Online /Get-Packages /Format:Table > “%userprofile%\Desktop\packages.txt”

  • If a specific KB repeatedly fails, consider uninstalling a related dependent package (if recently installed) before reattempting, or move directly to an in‑place repair.

• Network trace (managed environments)

  • Use a temporary netsh trace to confirm reachability to Microsoft endpoints:

    netsh trace start capture=yes tracefile=%userprofile%\Desktop\wutrace.etl

    Attempt update, then:

    netsh trace stop

    Analyze with Microsoft Message Analyzer/Wireshark in environments where this is supported.

Note: Driver Verifier and crash dump analysis are not relevant here because 0x800f0922 is a servicing/update error, not a driver crash. Focus on CBS/DISM and servicing logs.

—

Post-Fix Checklist

After the update succeeds, validate stability:

• Event Viewer is clean:

  • No new errors in WindowsUpdateClient or Servicing logs related to the same KB.

• Run quick health checks again:

  sfc /scannow
  DISM /Online /Cleanup-Image /CheckHealth

• Re-enable any services/startup items disabled during clean boot.

• Reconnect VPN/proxy with proper exclusions for Windows Update.

• Create a fresh restore point now that the system is in a good state.

—

When to Seek Professional Help

Consider professional service or OEM support when:

• You suspect a failing drive (reallocated sectors, SMART errors) or CHKDSK repeatedly finds new issues.
• The EFI/System Reserved partition cannot be safely resized with available tools or you’re uncomfortable doing it.
• DISM RestoreHealth fails even with a correct ISO source and in‑place repair upgrade also fails.
• Systems are domain‑joined with complex WSUS/Intune/SCCM policies you cannot change.

—

Prevention Tips

• Maintain adequate partition sizes:
  • For GPT/UEFI, allocate a 300–500 MB EFI System Partition during installations or upgrades.
• Keep free space:
  • Maintain 20+ GB free on C: to allow updates to stage and complete.
• Run periodic health checks:
  • Monthly SFC and occasional DISM ScanHealth can catch issues early.
• Sensible driver/security hygiene:
  • Use vendor updates via Windows Update/Windows Update for Business where possible.
  • Avoid stacking multiple AV/firewall products; keep one well‑supported solution.
• Patch regularly:
  • Don’t let months go by without updates; long gaps lead to bigger deltas and more complex servicing.
• Backups:
  • Keep routine image backups so you can recover quickly if an update goes wrong.
• For managed devices:
  • Coordinate WSUS/Intune policies to allow component repair content or provide internal sources for NetFx3.

—

Conclusion

Error 0x800f0922 on Windows 11 almost always boils down to one of three things: insufficient EFI/System Reserved partition space, component store corruption, or blocked access to Microsoft Update content (.NET payloads included). Start with the basics—network and cache resets—then move through SFC/DISM, fix .NET and policy issues, and address the EFI/SRP size if needed. When in doubt, an in‑place repair upgrade is an excellent, safe way to reset the servicing stack without losing your apps or files. With the CBS/DISM log clues and the steps above, most systems can be restored to a healthy, updatable state.

—

FAQ

Q1: What causes Windows Update error 0x800f0922 on Windows 11 most often?

• The top culprits are a small EFI/System Reserved partition, corrupted component store, and network/policy blocks that prevent downloading .NET or servicing payloads.

Q2: Is Safe Mode useful for fixing 0x800f0922?

• Windows Update does not run in Safe Mode, but Safe Mode helps you run SFC/DISM and uninstall conflicting software or security tools safely.

Q3: How big should the EFI/System Reserved partition be?

• Aim for 260–500 MB total size with at least ~100 MB free. If it’s smaller (e.g., 100 MB) or nearly full, extend it before retrying updates.

Q4: DISM /RestoreHealth failed online. What now?

• Use a matching Windows 11 ISO as a source:

  • Mount ISO as X:, then:

    DISM /Online /Cleanup-Image /RestoreHealth /Source:WIM:X:\sources\install.wim:1 /LimitAccess

  • Run SFC again and retry the update.

Q5: Will an in‑place repair upgrade delete my files?

• No, if you choose “Keep personal files and apps,” it preserves your data and applications while refreshing the operating system components and servicing stack.

If you follow the steps in order and use the logs for guidance, you’ll almost always resolve 0x800f0922. You’ve got this—take it one step at a time, and don’t hesitate to use the in‑place repair route if the quick fixes don’t stick.