Fix KB5012170 Failed 0x800f0922

If you see error 0x800f0922 when installing KB5012170, the update is failing because the Secure Core DBX update cannot verify or apply its UEFI revocation list. The most reliable fix is to update your device’s UEFI (BIOS) firmware to the latest version from your PC manufacturer, then retry the update from Windows Update.

What Is KB5012170?

KB5012170 is a Microsoft security update that applies a new Secure Core DBX (Database Exchange) revocation list to the UEFI firmware on Windows 10 and Windows 11 systems. This update is not a typical monthly patch; it updates the list of UEFI boot loaders that are considered untrusted, protecting against vulnerabilities such as BlackLotus UEFI bootkit. It was first released in August 2022 and has been reissued several times to address installation issues.

Why Does Error 0x800f0922 Occur?

Error 0x800f0922 is a Windows Update error that generally means the update could not be installed due to a problem with the system’s firmware or a missing prerequisite. For KB5012170 specifically, the most common causes are:

• Outdated UEFI firmware: The update requires a UEFI firmware that supports the Secure Core DBX feature, and older firmware versions may not be compatible.
• Secure Boot disabled: The update requires Secure Boot to be enabled. If it is disabled, the update will fail.
• Insufficient disk space: Although the update is small, Windows Update still requires a certain amount of free space in the system partition.
• Corrupted update cache: Sometimes the Windows Update cache can become corrupted, causing the update to fail.
• Third-party security software: Some antivirus or security tools can interfere with the update process.

Step-by-Step Fixes to Try

Work through these fixes in order. The first one resolves the issue for most users.

1. Update your UEFI (BIOS) firmware: Visit your PC manufacturer’s support website, find your exact model, and download the latest BIOS/UEFI update. Follow the manufacturer’s instructions to install it. This is the most common fix because KB5012170 relies on UEFI features that older firmware may not handle correctly.
2. Enable Secure Boot: Restart your PC and enter the UEFI/BIOS setup (usually by pressing F2, F10, Del, or Esc during startup). Locate the Secure Boot option (often under Boot or Security settings) and set it to Enabled. Save changes and exit. Then try the update again.
3. Free up disk space: Ensure you have at least 10 GB of free space on your system drive (C:). Use Disk Cleanup to remove temporary files if needed.
4. Clear the Windows Update cache: Open Command Prompt as administrator and run the following commands, pressing Enter after each:
   net stop wuauserv
net stop cryptSvc
net stop bits
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
net start wuauserv
net start cryptSvc
net start bits
   Then restart your PC and try the update again.
5. Run the Windows Update Troubleshooter: Go to Settings > System > Troubleshoot > Other troubleshooters, select Windows Update, and run it. This can automatically detect and fix common update issues.
6. Temporarily disable third-party antivirus: If you use a third-party antivirus, disable its real-time protection temporarily, then try the update. Re-enable it after the update completes.

What If the Update Still Fails?

If you have tried all the above and the update still fails, you can try the following advanced steps:

• Install the update manually: Download the standalone package for KB5012170 from the Microsoft Update Catalog and run it manually. Right-click the downloaded .msu file and select Install. This bypasses Windows Update’s automatic process.
• Reset the UEFI settings to default: In the UEFI/BIOS setup, look for an option to load default settings (often called “Load Optimized Defaults”). This can resolve any misconfigured settings that interfere with the update.
• Check for other pending updates: Install all other available Windows updates first, then retry KB5012170. Sometimes a prerequisite update is missing.
• Use DISM and SFC: Run these commands in an elevated Command Prompt to repair system files:
  DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow
  After they finish, restart and try the update again.

Is This Update Mandatory?

KB5012170 is a security update, so Microsoft recommends installing it. However, it is not automatically forced on all systems; it appears in Windows Update as an optional or recommended update. If you cannot install it after multiple attempts, you can postpone it, but you should be aware that your system may be vulnerable to the UEFI bootkit exploits that the update addresses. Microsoft has also reissued this update several times to fix installation issues, so check if a newer version is available.

Common Misconceptions

One common misconception is that error 0x800f0922 means your PC is broken or that you need to reinstall Windows. In most cases, it is simply a firmware compatibility issue that can be resolved with a BIOS update. Another misconception is that disabling Secure Boot will fix the problem; actually, the opposite is true—the update requires Secure Boot to be enabled. Finally, some users think that the update is unnecessary because they don’t use UEFI, but all modern Windows 10/11 systems use UEFI, even if you don’t see it.

Frequently Asked Questions

Will KB5012170 install automatically?

It may appear in Windows Update as an automatic download, but if it fails, it will not retry automatically. You need to manually trigger the update after applying fixes.

Can I uninstall KB5012170 if it causes problems?

Yes, you can uninstall it from Settings > Windows Update > Update history > Uninstall updates. However, this will remove the security protection, so it is not recommended unless absolutely necessary.

Does this update work on Windows 10 and Windows 11?

Yes, KB5012170 is available for both Windows 10 and Windows 11, as well as some Windows Server versions. The error and fixes are the same across these systems.

Why does the update fail on a brand new PC?

Even new PCs may have outdated UEFI firmware if they were manufactured before the update was released. Check the manufacturer’s website for a newer BIOS version, even if the PC is new.

Is it safe to ignore this update?

Ignoring it leaves your system vulnerable to UEFI bootkit attacks. It is strongly recommended to install it, but if you cannot, ensure your antivirus is up to date and be cautious with files you download.

What does 0x800f0922 mean in general?

This error code is generic and can occur with any Windows update. It often indicates a problem with the update installation process, such as insufficient disk space or corrupted files, but for KB5012170 it is most often related to UEFI firmware.

Related

• How to Choose a Cloud GPU Provider for AI Models
• Fix Data Source References Not Valid in Excel
• iPhone Charging on Hold: What It Means & Fixes