What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Windows Server 2016 error 0x80070422 means the Windows Update service (wuauserv) is disabled or not running. The title’s 0x800070422 contains an extra zero. Open services.msc with administrator rights, set Windows Update to a startup mode permitted by your server policy, start it, and try Windows Update again. If the service is already enabled or access is denied, reset the Windows Update components in stages and check local or domain policy before changing registry permissions.
What error 0x80070422 means on Windows Server 2016
Microsoft identifies 0x80070422 as ERROR_SERVICE_DISABLED. Its support wording is: “The service cannot be started because it is disabled.” In practice, Windows Update cannot run because the Windows Update service, named wuauserv, is stopped, disabled, or prevented from starting by policy or damaged update components.
As an Amazon Associate I earn from qualifying purchases.
The code is commonly mistyped as 0x800070422. Treat that spelling as a likely transcription error and troubleshoot the canonical eight-digit code, 0x80070422. This article is for the Windows Server 2016 operating system; the exact update source may be Microsoft Update, Windows Server Update Services (WSUS), or another domain-controlled service.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBefore changing anything: capture the server’s state
Make a short record while the failure is visible. It helps distinguish a disabled service from a package-specific or policy problem and gives an administrator useful evidence if escalation is required.
#1 Best Overall
- [MISSING OR FORGOTTEN PASSWORD?] Are you locked out of your computer because of a lost or forgotten password or pin? Don’t’ worry, PassReset USB will reset any Windows User Password or PIN instantly, including Administrator. 100% Success Rate!
- [EASY TO USE] 1: Boot PC from the PassReset USB drive. 2: Select the User account to reset password. 3: Click “Remove Password”. That’s it! Your computer is unlocked.
- [COMPATIBILITY] This USB will reset any user passwords including administrator on all versions of Windows including 11, 10, 8, 7, Vista, Server. Also works on all PC Brands that have Windows as an operating system.
- [SAFE] This USB will reset any Windows User password instantly without having to reinstall your operating system or lose any data. Other Passwords such as Wi-Fi, Email Account, BIOS, Bitlocker, etc are not supported.
- Record the exact error code and the update or KB number shown in Windows Update.
- Record the Windows Server 2016 build and whether the server is managed by a domain, WSUS, or another update policy.
- Note whether you are signed in with a local administrator or a domain account with equivalent rights.
- Save the current Windows Update service state and any relevant entries from
CBS.logbefore performing a reset.
Do not edit the registry or service security descriptors merely because the message says “access denied.” First establish whether a policy is deliberately enforcing the service state.
Fix 1: enable and start Windows Update in Services
Open the Services console as an administrator
- Sign in with an account that can administer services on the server.
- Press
Win+R, enterservices.msc, and press Enter. If User Account Control appears, approve it. - In the list, locate Windows Update. Its service name is
wuauserv.
Choose a startup mode that matches policy
- Double-click Windows Update to open its properties.
- Look at Startup type. If it is Disabled, change it to a mode allowed by your organization’s server policy. Do not override a domain or WSUS policy without approval.
- Select Apply, then select Start. If Start is unavailable or returns an access-denied message, stop and follow the policy branch below rather than repeatedly changing the setting.
- Select OK, wait for the service to remain running, and retry Windows Update.
A service that starts successfully but later returns to Disabled is usually being reset by policy, an administrator’s configuration, or a management tool. That behavior is different from a one-time service stoppage and requires finding the controlling setting.
Fix 2: inspect the service from an elevated command prompt
The graphical console can hide useful state details. Open Command Prompt with Run as administrator and inspect the service:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →sc query wuauservReview whether the service is running, stopped, or marked as disabled. Then attempt a manual start:
net start wuauservIf the command reports that the service is disabled, return to its startup setting in Services and check policy. If it reports access denied, do not assume the service file is missing. The denial can come from insufficient elevation, a service security descriptor, local security policy, or domain policy.
When enabling the service is denied
- Close the prompt and reopen it explicitly with Run as administrator; being a standard member of the Administrators group is not always enough when User Account Control has not elevated the process.
- Check whether a domain Group Policy or WSUS configuration intentionally disables or controls Windows Update. Ask the domain or server administrator to confirm the intended startup mode before changing it.
- Check whether the setting reverts after a policy refresh or reboot. A reversion points to management policy rather than a simple service-state error.
- Do not copy an arbitrary service security descriptor from a forum or blog. An incorrect access-control list can create a new service-access problem.
Once the policy issue is resolved, run sc query wuauserv again, start the service with net start wuauserv, and retry the update. If the service is enabled and running but updates still fail, continue with the staged component reset.
Fix 3: perform Microsoft’s basic Windows Update reset
Use this reset when the service setting is correct but the update engine may have a stopped dependency or a damaged BITS job database. Run every command in an elevated prompt. Stop only services that are safe to stop on this server and schedule a maintenance window if applications depend on them.
Rank #2
- Native Windows Server IoT 2025 for Storage Workgroup edition.
- Pre-tested NAS-grade hard drives included with RAID pre-configured.
- No CAL (Client-Access Licenses) required.
- Cost-effective small business NAS with Windows Server enhanced data management and security features.
- Cloud service integration with Azure, OneDrive, and other Microsoft-compatible services enables to create a hybrid cloud for additional security and flexibility.
- Stop Background Intelligent Transfer Service (BITS):
net stop bits - Stop Windows Update:
net stop wuauserv - Stop Cryptographic Services:
net stop cryptsvc - Delete the BITS job database files Microsoft specifies:
Del "%ALLUSERSPROFILE%Application DataMicrosoftNetworkDownloaderqmgr*.dat" - Start BITS again:
net start bits - Start Windows Update:
net start wuauserv - Start Cryptographic Services:
net start cryptsvc
A “service was not started” response while stopping a service can simply mean it was already stopped. The important check is that each required service can be started again and remains available. After the restart, run Windows Update and note whether the same code or a different KB-specific error appears.
Fix 4: reset the update cache when the basic reset fails
Windows Update stores downloaded packages and working data in its cache. Microsoft’s extended reset procedure for Windows Server 2016 includes deleting or renaming the SoftwareDistribution data after the update-related services have been stopped. Renaming preserves the old folder for recovery and is safer than immediately deleting it.
- Run the three stop commands from the basic reset and verify that BITS, Windows Update, and Cryptographic Services are stopped.
- Rename or remove the
SoftwareDistributiondata exactly as described in Microsoft’s Windows Update reset procedure. Use an elevated prompt and the path under%windir%. - Start BITS, Windows Update, and Cryptographic Services again with the three
net startcommands. - Retry the update. Windows Update will rebuild the working cache as needed.
Do not rename cache folders while the services are still using them. If a file is locked, stop the services again and confirm their state with sc query before retrying. Keep the renamed data until the server has completed a successful update cycle and you no longer need it for rollback or investigation.
Fix 5: use the extended reset only when service and cache checks are insufficient
Microsoft’s extended Windows Update procedure adds several invasive operations:
- Resetting the default security descriptors for BITS and Windows Update with
sc.exe sdset. - Re-registering the Windows Update and BITS dynamic-link libraries from
%windir%system32. - Resetting Winsock with
netsh winsock reset. - Resetting the Windows Update Agent data, including the
SoftwareDistributioncontent.
Use Microsoft’s complete command list exactly as published for this procedure. The security-descriptor strings are long and version-sensitive; substituting a shortened or copied string from an untrusted source can remove required permissions and make the original access-denied problem worse. Run the sequence in an elevated command prompt, stop the required services before modifying their files, and restart them in the order specified by Microsoft.
When an extended reset is appropriate
- The service is enabled, starts successfully, and is not being reset by policy.
- The basic BITS, Windows Update, and Cryptographic Services reset did not change the error.
- The update cache appears damaged or repeatedly fails while rebuilding.
- Logs indicate registration, service-permission, or Winsock problems rather than a single bad update package.
- A maintenance window is available and you have a current backup or documented rollback plan.
When to stop instead of forcing the reset
- The server is a production system with no maintenance window.
- Domain policy or WSUS is deliberately controlling Windows Update.
- You cannot verify the exact Microsoft command sequence, especially the
sc.exe sdsetvalues. - The failure names a specific KB and the service itself is healthy; a package-specific investigation may be more appropriate.
Check policy, WSUS, and service permissions before registry edits
“Access denied” while changing Windows Update often indicates an authorization or management boundary rather than a missing Windows file. Confirm these conditions with the person responsible for the server:
- Elevation: the Services console and command prompt must be running with administrative rights.
- Domain policy: a Group Policy can enforce Windows Update settings or prevent local administrators from changing them.
- WSUS control: the server may be configured to receive approvals and scheduling from an internal update server instead of directly from Microsoft Update.
- Service ACLs: a damaged security descriptor can block start or configuration operations. Repair it only with Microsoft’s documented reset commands.
- Change management: changing update behavior on a server can affect reboot schedules, compliance, and application availability.
Do not make untracked registry changes to force a startup mode. First document the existing setting, identify which policy owns it, and obtain approval for any configuration change. If policy is correct but the service ACL is damaged, use the extended Microsoft reset rather than an improvised registry or permission edit.
Rank #3
- The Data Recovery Stick requires no technical skills — simply plug it into your Windows computer, click Start, and the software automatically begins scanning and recovering lost files within minutes. Compatible with Windows Vista, 7, 8, 10, & 11, it's designed to be a reliable first step when accidental deletion occurs.
- Recover photos (JPG, BMP, PNG, TIFF), Microsoft Office documents (Word, Excel, PowerPoint, Publisher, Access), Open Office files, MP3 music files, PDFs, RTF documents, AutoCAD files, and HTML web pages. Whether it's personal memories or critical business files, the Data Recovery Stick covers the file types that matter most.
- Works with hard drives, USB drives, SD cards, memory sticks, and other common storage formats that use FAT or NTFS file systems — making it a single solution for hard drive recovery, USB drive recovery, SD card recovery, and more. Note: a media reader is required for micro SD cards and some mass storage devices.
- No Installation Required - The Data Recovery Stick runs entirely from the USB drive with no software installation on your computer — helping prevent new data from overwriting the files you're trying to recover. This also makes it ideal for use across multiple computers or in emergency situations where installation isn't practical.
- Use the Data Recovery Stick on as many computers as often as needed — simply clear the recovered data between uses to free up storage space. Software updates keep the tool compatible with newer systems and devices, backed by 25+ years of data software expertise from Paraben Consumer Software.
Validate the repair
After each stage, validate before moving to a more invasive stage:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Run
sc query wuauservand confirm that Windows Update is not disabled and can remain running. - Run
net start wuauservif it is stopped. - Open Windows Update and retry the pending update.
- Record whether the error remains
0x80070422, changes to another code, or is replaced by a specific KB failure. - Check the update history and the relevant
CBS.logentries for a package or servicing-stack error.
If the service now starts but one update still fails, the original service-disabled condition has been addressed. Continue with the KB’s prerequisites, servicing-stack requirements, or package-specific logs instead of repeating a global reset.
Choosing between the basic and extended reset
| Option | Best fit | Invasiveness | Maintenance needs | Main caution |
|---|---|---|---|---|
| Service verification and start | Windows Update is disabled or stopped | Low | Usually none beyond administrative access | Policy may immediately reapply the disabled state |
| Basic reset | Service state is correct but BITS, cache, or related services may be stuck | Moderate | Stop and restart BITS, Windows Update, and Cryptographic Services | Do not delete the BITS database while it is in use |
| Extended Microsoft reset | Persistent cache, registration, service-ACL, or Winsock faults | High | Use a planned maintenance window | Run Microsoft’s exact command list; incorrect descriptors can create new failures |
Start with the least invasive option that matches the evidence. Escalate only when the preceding stage has been completed and validated.
What to provide when escalation is necessary
If the server still cannot update, give the administrator or support team a compact evidence package:
- The exact spelling of the code and the affected KB number.
- Windows Server 2016 build information.
- Whether the server uses WSUS or another domain update policy.
- Output from
sc query wuauservand the result ofnet start wuauserv. - Which reset stage was completed and which commands returned errors.
- Relevant
CBS.logentries and the time of the failed attempt.
Those details allow the next investigation to focus on policy, service permissions, cache corruption, or a particular package instead of repeating the same service reset.
Free tools Windows power users keep installed
One-click scans. No signup required.
As an optional shortcut after trying the manual steps, Outbyte PC Repair can address common Windows issues, clean temporary and cache files, check selected Windows settings and missing updates, and provide troubleshooting features on Windows Server-compatible Windows editions. It complements antivirus software rather than replacing it; results vary, and no tool repairs every crash. It offers a free trial by category for at least two days before a subscription is required.
Bottom line
For Windows Server 2016, 0x80070422 points first to a disabled or stopped wuauserv service. Enable and start it from an elevated administrative context, then investigate domain or WSUS policy if the setting is denied or reverts. If the service is healthy, reset BITS, Windows Update, Cryptographic Services, and the update cache. Use Microsoft’s extended security-descriptor, DLL-registration, Winsock, and Windows Update Agent reset only when the staged checks justify it, and preserve the exact command sequence.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
