Windows Update fails with 0x800F0922

Event[2587]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-12-13T12:17:15.4510000Z
  Event ID: 1796
  Task: N/A
  Level: Error
  Opcode: Info

  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: RackMount
  Description:
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931

Event[2461]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-12-11T12:17:15.4830000Z
  Event ID: 1801
  Task: N/A
  Level: Error
  Opcode: Info

  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: RackMount
  Description:
Secure Boot CA/keys need to be updated. This device signature information is included here.
DeviceAttributes: BaseBoardManufacturer:ASUSTeK COMPUTER INC.;FirmwareManufacturer:American Megatrends Inc.;FirmwareVersion:3621;OEMModelBaseBoard:TUF GAMING B550-PLUS;OEMManufacturerName:ASUS;OSArchitecture:amd64;
BucketId: 9e0cca494862a2dec441819e67d80b17e91ccc62839566296ffb1502b0474db5
BucketConfidenceLevel:
UpdateType: 0
HResult: The operation completed successfully.

Summary
To help keep Windows devices secure, Microsoft adds vulnerable bootloader modules to the Secure Boot DBX revocation list

(maintained in the system UEFI-based firmware) to invalidate the vulnerable modules. When the updated DBX revocation list

is installed on a device, Windows checks to determine whether the system is in a state where the DBX update can be successfully

applied to the firmware and will report event log errors if an issue is detected.


More information

When one of these vulnerable modules is detected on the device, an event log entry is created warning about the situation and

includes the name of the detected module. The event log entry contains details that resemble the following:

Event ID: 1796

When the updated DBX revocation list is applied to a device, and an error occurs that is not covered by the events above, an event

is logged, and Windows will try to apply the DBX list to the firmware on the next system restart.

Event log information

Event ID 1796 occurs when an unexpected error is encountered. The event log entry will include the error code for the unexpected

error.

Event ID: 1801

This is an error event that indicates that the updated certificates have not been applied to the device’s firmware. This event gives

some details about the device, including device attributes and device bucket ID, that will help in correlating which devices still

need updating.

If the confidence level of the device’s ability to accept the updates is known, it will be included in the event. The values include

"High Confidence", "Needs More Data", "Unknown", and "Paused". The UpdateType will be either 0, or 22852 (0x5944).

The value 0x5944 corresponds to “High Confidence”.

Event[1601]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-12-20T12:44:27.3230000Z
  Event ID: 1801
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: RackMount
  Description:
Secure Boot certificates have been updated but are not yet applied to the device firmware. Review the published guidance to complete the update and ensure full protection. This device signature information is included here.
DeviceAttributes: BaseBoardManufacturer:ASUSTeK COMPUTER INC.;FirmwareManufacturer:American Megatrends Inc.;FirmwareVersion:3621;OEMModelBaseBoard:TUF GAMING B550-PLUS;OEMManufacturerName:ASUS;OSArchitecture:amd64;
BucketId: 9e0cca494862a2dec441819e67d80b17e91ccc62839566296ffb1502b0474db5
BucketConfidenceLevel:
UpdateType:
For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.

Event[1551]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-12-20T12:39:28.5380000Z
  Event ID: 1012
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: RackMount
  Description:
There was an error while attempting to read the local hosts file.

Event[1552]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-12-20T12:39:28.8270000Z
  Event ID: 1012
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: RackMount
  Description:
There was an error while attempting to read the local hosts file.