Windows Update Disabled by Unknown Policy – Fix in 3 Steps

The 30-Second Fix: Check the Registry

If Windows Update settings are grayed out or you get error 0x80070422, the most common culprit is a registry key left behind by a debloater tool or a previous tweak. Had a client last month whose nephew thought disabling updates would speed up his gaming laptop. Spoiler: it didn't.

1. Press Win + R, type regedit, hit Enter.
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
3. If you see a DisableWindowsUpdateAccess DWORD set to 1, double-click it and change it to 0.
4. If that key doesn't exist, check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate — same fix.
5. Close Regedit and restart Windows Update service: run services.msc, find Windows Update, right-click, Restart.

This works 80% of the time. If updates still show as disabled, move to the next step.

The 5-Minute Fix: Remove Local Group Policy Settings

If the registry fix didn't stick, a local group policy is overriding it. This happens when IT admins push a policy, or you imported a security template that blocked updates.

1. Press Win + R, type gpedit.msc, hit Enter. (This only works on Pro/Enterprise editions. If you're on Home, skip to the advanced fix.)
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update.
3. Look for Configure Automatic Updates and Remove access to use all Windows Update features. Double-click each one.
4. Set them to Not Configured (not Enabled or Disabled). Click OK.
5. Close Group Policy Editor. Open a command prompt as admin and run gpupdate /force.
6. Reboot, check Windows Update again.

Side note: If you see policies labeled Enabled but you didn't set them, your system might have been hit by a script that wrote to both registry and policy. Clear both. I've seen this with cheap PC cleaner tools that disable updates to show you a "fast" system.

The 15+ Minute Fix: Deep Malware Check and Reset

If you're still stuck, some malware deliberately locks Windows Update to prevent security patches from being installed. Real story: a dental office I worked for had a ransomware variant that disabled Windows Update, then encrypted files a week later. The malware used scheduled tasks to reapply the policy every 10 minutes.

1. Check scheduled tasks: Open Task Scheduler (taskschd.msc). Look under Task Scheduler Library for anything named like UpdateBlock, DisableUpdates, or random strings. Disable or delete any suspicious tasks.
2. Scan for malware: Use a second opinion scanner like Malwarebytes or ESET Online Scanner. Don't rely on Windows Defender alone—malware can hide from it.
3. Reset Windows Update components: Run this command in an admin command prompt:
   

   net stop wuauserv
   net stop cryptSvc
   net stop bits
   net stop msiserver
   ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
   ren C:\Windows\System32\catroot2 catroot2.old
   net start wuauserv
   net start cryptSvc
   net start bits
   net start msiserver

   This clears all cached update files and forces a fresh download.
4. Check for persistent policies: Some malware writes to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer or HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop to block system changes. Scan those keys and delete any entries that mention updates.

If nothing works: You can use the Windows Update Troubleshooter built into Windows (Settings > Update & Security > Troubleshoot > Additional troubleshooters > Windows Update). It's a blunt tool, but I've seen it nuke a stubborn policy that manual steps missed.

Pro tip: After any of these fixes, check the Windows Update Log at C:\Windows\Logs\WindowsUpdate\WindowsUpdate.log for 80070422 errors. That code means the service is disabled or blocked. If you still see it, run sc query wuauserv in CMD to see if the service startup type is Disabled. If so, fix it with sc config wuauserv start=auto and sc start wuauserv.