Windows Update Error 0x800f0922: The SecureBootEncodeUEFI Task Fix

A cumulative update fails with 0x800f0922, and the usual SFC / DISM /RestoreHealth / reset-the-cache routine doesn’t budge it. There’s a specific, documented variant worth checking before you resort to an in-place repair install.

How to know it’s this variant: open C:\Windows\Logs\CBS\CBS.log and look for:

[HRESULT = 0x800f0922 - CBS_E_INSTALLERS_FAILED] together with RegisterTask failed ... 0x80070002 (ERROR_FILE_NOT_FOUND)

and, in Event Viewer → Task Scheduler, Event ID 146 referencing a task path ending in …\PI\SecureBootEncodeUEFI. That combination means the SecureBootEncodeUEFI scheduled task is corrupted, and the update can’t re-register it — so the whole package install rolls back.

Note: 0x800f0922 is a generic install-failure code with several causes (a too-small System Reserved partition, a broken .NET/optional feature, VPN connectivity during the install). This fix targets the specific SecureBootEncodeUEFI-task cause confirmed in the CBS log. If your CBS log doesn’t show the lines above, this isn’t your variant.

The fix: remove the staged package and the corrupted task

Run these in an elevated Command Prompt. Take a System Restore point first.

1. List the staged packages so you can find the one that failed to install:

   Dism /online /get-packages /format:table

   Identify the recent package(s) in Install Pending / Staged state tied to the failed update.
2. Remove the staged package (substitute the exact package identity from step 1):

   Dism /online /remove-package /packagename:<PackageIdentity>

3. Find the SecureBootEncodeUEFI task GUID. In regedit, browse under:

   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PI\SecureBootEncodeUEFI

   Note the task’s {GUID} value (the Id).
4. Delete the stale task entries for that GUID under the TaskCache subkeys (Tasks, Plain, and the Tree\…\SecureBootEncodeUEFI node). Export each key first as a backup.
5. Reboot, then re-run Windows Update. Windows recreates a clean SecureBootEncodeUEFI task and the update installs.

If it’s not the SecureBoot variant

Quick checks for the other common 0x800f0922 causes:

• System Reserved partition full (older systems): free space or enlarge it.
• Broken optional feature / .NET: DISM /Online /Cleanup-Image /RestoreHealth then sfc /scannow.
• VPN active during update: disconnect any VPN and retry — 0x800f0922 has historically been triggered by connectivity loss to update servers mid-install.

FAQ

Why didn’t DISM /RestoreHealth fix it? /RestoreHealth repairs the component store image; it doesn’t rebuild a corrupted scheduled task. That’s why this variant survives the standard repair routine.

Is editing the registry safe here? Deleting the specific corrupted TaskCache entries is the documented remediation — but export each key first and create a restore point. Don’t delete the whole TaskCache tree.

Updates still failing afterward? If the failure moves to a different code or a rollback loop, see the “Undoing changes” / failed-update guide.

Sources: Microsoft Learn — Error 0x800f0922 when installing Windows updates (SecureBootEncodeUEFI task)