Fix ERROR_PATCH_REMOVAL_DISALLOWED (0x671) in Windows Update

Cause #1: Group Policy Blocks Removing Updates

If you're on Windows 10 Pro, Enterprise, or Education, the most common trigger for ERROR_PATCH_REMOVAL_DISALLOWED (0X00000671) is a Group Policy setting that explicitly forbids uninstalling updates. I've seen this bite people right after an IT department rolls out a mandatory patch—they try to roll back a bad driver update and hit this wall.

The policy that does this is Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update. The specific setting is “Do not allow update removal”. If it's set to Enabled, you can't uninstall any update regardless of what you try.

The Fix: Check and Change the Policy

1. Press Win + R, type gpedit.msc, and hit Enter. (This won't work on Windows 10 Home—I'll cover that below.)
2. Navigate to the path above.
3. Double-click “Do not allow update removal”.
4. Set it to Not Configured or Disabled.
5. Click OK and restart your PC.

After that, try uninstalling the update again via Settings > Update & Security > Windows Update > View update history > Uninstall updates. If it still throws the error, the policy might be enforced by your organization—skip to the registry hack below, but be aware that local changes can get overwritten by domain policy.

Cause #2: Registry Key Forces the Same Restriction

When Group Policy isn't the culprit (or you're on Windows 10/11 Home, which doesn't ship with gpedit), the same restriction lives in the registry. The key is HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate and the value DisableUpdateRemoval set to 1. I've seen this key left behind even after policies are removed—nasty little ghost.

The Fix: Delete or Set the Registry Value

reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableUpdateRemoval /f

If the value doesn't exist, the key might have a different name—check for RemoveUpdates or DisableWindowsUpdateAccess. The latter, if set to 1, can also block uninstall operations.

1. Open Registry Editor (regedit.exe).
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate.
3. Look for DisableUpdateRemoval (REG_DWORD). If it's there, double-click it and change the value to 0, or delete it entirely.
4. Reboot and try the uninstall again.

If you're on a domain, the policy will likely reapply itself at next refresh. In that case, you're fighting your admin—talk to them. But for personal machines, this clears it up.

Cause #3: Windows Update Service Not Fully Initialized

Less common, but I've hit this on a few machines: the Windows Update service (wuauserv) gets into a weird state after a failed update, and the uninstaller can't read the update metadata properly. The error pops up even though no policy is present. This one is sneaky because the registry is clean and gpedit shows nothing.

The Fix: Restart the Windows Update Service and Clear Cache

1. Open Command Prompt as administrator.
2. Run these commands one by one:

net stop wuauserv
net stop cryptSvc
net start cryptSvc
net start wuauserv

Restarting the crypto service too is key—it handles the signature verification for update packages. If the service crashes, the removal check fails with 0x671. I've also seen corrupted cache files cause this, so if the service restart doesn't do it, clear the SoftwareDistribution folder:

net stop wuauserv
rd /s /q C:\Windows\SoftwareDistribution\Download
net start wuauserv

That wipes the downloaded update files—you'll lose the ability to roll back, but you can still uninstall through Settings after a fresh download. This fixed it on a client's Dell Latitude 5490 that was stuck on a botched cumulative update.

Quick Reference

The registry fix is the one that works nine times out of ten. Try it first if you're not sure what's causing yours. And if you're on a work computer, check with your IT team before making changes—they might have a legit reason for blocking rollbacks, like a security patch you shouldn't remove.