How to fix Windows update error 0x80070433?

Error 0x80070433 is Windows error 1075: a service cannot start because a service it depends on does not exist or is marked for deletion. In Windows Update it means that the Windows Update service (wuauserv) or BITS names a missing service in its dependency list. List the dependencies with sc.exe qc wuauserv, then check that each name on the list is installed.

Facts checked on 14 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What error 0x80070433 means in Windows Update

0x80070433 is not a code of its own. It is the ordinary Windows system error 1075 in the eight-digit form that Windows Update prints. Microsoft's list of system error codes gives 1075 the name ERROR_SERVICE_DEPENDENCY_DELETED and one line of text: "The dependency service does not exist or has been marked for deletion."

The first half of the code, 0x8007, says that a plain Windows error was wrapped into the format that update components use. The second half, 0433, is 1075 written in hexadecimal. Microsoft documents this wrapping in the HRESULT_FROM_WIN32 macro, so the same rule decodes every Windows Update code that starts with 0x8007.

How service dependencies work, and where wuauserv keeps its list

Every Windows service is a record in the database of the Service Control Manager. Microsoft documents that this database lives in the registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services, with one subkey for each installed service. The record can hold a list of services that must be started first. That list is the dependency list.

When something asks for a service, Windows goes through its list first. Microsoft's description of the StartService function names three different endings, and each one has its own code. Knowing which one you have saves time, because the repairs differ.

• In a command window: sc.exe qc wuauserv. Microsoft's reference for the qc command lists DEPENDENCIES among the fields it prints.
• In the Services window: open the service and select the Dependencies tab. The tab shows the list, but it cannot change it.
• In the registry: the value DependOnService in the subkey of the service. Microsoft's documentation of the CreateService function describes it as the services on which this service depends. A second value, DependOnGroup, holds groups of services.
• In PowerShell: Get-Service wuauserv -RequiredServices. Microsoft documents this switch as the way to get the services that a service requires.

What causes 0x80070433, from most to least likely

By its definition the error has two possible causes only: the service named on the list is gone, or it is waiting to be deleted. What differs is how it got that way. Microsoft's own entry for this code, written for BITS, puts it in one sentence: a service that appears in the dependency list cannot be started, so make sure the list is correct.

How to fix Windows Update error 0x80070433

Fix 1 is the diagnosis and everybody starts there: it costs five minutes and changes nothing. Its result sends you to Fix 2, Fix 3 or Fix 4. Fix 5 and Fix 6 are the general repairs for the case where the dependency lists are healthy, or where nothing else brought a deleted service back.

Fix 1. List the dependencies of the failing service and find the missing one

5 minutesNo riskAlways first: you see 0x80070433 or error 1075 and do not yet know which service name is broken.

Error 1075 always points at one name in one dependency list. Microsoft's own resolution for this situation starts the same way: read the list with sc qc, then compare it with the services that really exist. These commands only read.

1. Restart the PC and try the update once more. A service that was marked for deletion is removed at restart, so a temporary case ends here.
2. On Windows 11, right-click Start and select Terminal (Admin). On Windows 10, type cmd in the search box and select Run as administrator.
3. Test the two services that Windows Update needs. The one that answers with "System error 1075 has occurred" is the failing service.

   net start bits
   net start wuauserv

4. Print the configuration of the failing service and read the line DEPENDENCIES. Each name on it is one service that must exist.

   sc.exe qc wuauserv

5. Check every name from that line, one at a time. Replace rpcss with the name you are checking.

   sc.exe query rpcss

6. A name that exists answers with its STATE, for example 4 RUNNING. A name that is not installed answers with error 1060: "The specified service does not exist as an installed service." That name is your missing dependency.
7. For every name that exists, read its start type and its own dependencies. Look at the line START_TYPE.

   sc.exe qc rpcss

8. Write down the full DEPENDENCIES line and the name that failed. You need both in the next fix.

The same check as one script, for PowerShell opened as administrator. It reads the DependOnService value of the service and tests whether each name has its own subkey, which is how the Service Control Manager's database records an installed service.

PowerShell (administrator): list the dependencies and mark the missing ones

$svc = 'wuauserv'   # then run it again with 'bits'
$base = 'HKLM:\SYSTEM\CurrentControlSet\Services'
$list = (Get-ItemProperty "$base\$svc").DependOnService
if (-not $list) { "$svc has no dependency list" }
foreach ($name in $list) {
  if (Test-Path "$base\$name") {
    "{0}: exists, Start = {1}" -f $name, (Get-ItemProperty "$base\$name").Start
  } else {
    "{0}: MISSING" -f $name
  }
}

Fix 2. Remove a leftover name from the dependency list with sc.exe config

5 minutesRead the warningFix 1 found a name on the list that is not installed, and that name is not a Windows service.

This is the resolution Microsoft gives for a service that depends on a nonexistent service: set the list again with only the valid names. Once the dead name is off the list, nothing blocks the start of the service.

1. In the administrator command window, save the key of the service to the desktop. For BITS, replace wuauserv with bits in both places.

   reg export "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "%USERPROFILE%\Desktop\wuauserv-backup.reg"

2. Take the DEPENDENCIES line you wrote down in Fix 1 and cross out only the name that failed with error 1060.
3. Set the list again with the names that are left, separated by forward slashes. The example keeps one valid name. With two names it would read depend= rpcss/EventSystem.

   sc.exe config wuauserv depend= rpcss

4. Check the answer. Success reads [SC] ChangeServiceConfig SUCCESS.
5. Print the configuration again and confirm that the dead name is gone and every real name is still there.

   sc.exe qc wuauserv

6. Start the service.

   net start wuauserv

7. Open Settings > Windows Update and select Check for updates.

• The space is part of the syntax. Microsoft's reference states that each option includes the equal sign and that a space is required between the option and its value: depend= rpcss, never depend=rpcss.
• Do not edit DependOnService by hand. Microsoft's documentation of the services database says to use the functions of the Service Control Manager and not to modify the database directly. sc.exe config is that route.
• An empty list. Microsoft's page says to enter a null value for depend= when no valid name is left, but it does not print the syntax. We could not confirm it from a Microsoft page, and a Windows Update service with an empty list would be unusual. Compare with a healthy PC before you do that.
• To undo: double-click the .reg file from step 1, confirm the import and restart the PC.

Fix 3. Switch a disabled dependency back on

5 minutesLow riskFix 1 showed that a service on the list exists, but its start type is Disabled.

Microsoft's reference describes Disabled as a service that cannot be started until the start type is changed to another value. A disabled dependency therefore stops every service above it. Microsoft handles this case under the same entry as 0x80070433.

1. Press Win + R, type services.msc and press Enter.
2. Find the service by its display name. The table below gives the display names of the ones that matter for updates.
3. Double-click it. On the General tab, open the Startup type list.
4. Select the usual type from the table below: Automatic or Manual.
5. Select Apply, then Start, then OK.
6. Do the same for Windows Update and Background Intelligent Transfer Service if they show Disabled.
7. Restart the PC and check for updates.

The same in a command window, for a service whose usual type is Manual: sc.exe config bits start= demand. For Automatic the value is auto. In the registry the start type is the value Start of the service's subkey, and Microsoft documents its numbers: 2 is Automatic, 3 is Demand (shown as Manual), 4 is Disabled.

• The Startup type list is greyed out, or you get Access is denied. Windows protects some of its services, and on a work PC an administrator's policy may hold the setting. Do not force it through the registry. Ask the administrator, or go to Fix 4.
• The setting returns to Disabled after a restart. Something on the PC sets it back: a tool that blocks updates, a privacy or tweaking utility, or malware. Remove the tool, and scan the PC: How to scan for malware with Microsoft Defender
• More about the Services window: Check and restart Windows services

Fix 4. Bring back a deleted Windows service with System Restore

30 minutesRead the warningThe missing name is a Windows service, or wuauserv or BITS itself is no longer installed, and the PC has a restore point from before the error.

An installed service is a registry key. Microsoft states that System Restore reverts system files, registry settings and installed programs to the state of the restore point. A restore point made before the service was deleted therefore brings its key and its dependency list back.

1. Remember when the error first appeared: Windows Update lists failed attempts with their dates under Update history.
2. Open System Restore with the steps below and pick a restore point dated before that day.
3. Let Windows restart and finish the restore.
4. Open an administrator command window and check that the service is back.

   sc.exe query wuauserv
   sc.exe qc wuauserv

5. Run the check from Fix 1 once more, then select Check for updates.

1. Open System Restore. Press Windows+R, type the command below and press Enter. You can also open Control Panel > Recovery > Open System Restore. If a first page opens, select Next.

   rstrui.exe

2. Choose a restore point. Select a restore point from a time before the problem started. The Description often names the event, such as a driver or app install. If the one you need is missing, select Show more restore points (shown only when there are more).

   

3. See what will change. Select Scan for affected programs. The upper list shows programs and drivers that will be removed; the lower list shows those that might come back and may need to be reinstalled. Select Close.

   

4. Start the restore. Select Next, check the summary and select Finish. Windows restarts and applies the restore point. Do not turn the PC off.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Undo recent changes with System Restore

• No restore point from before the error. System Restore cannot help. Go to Fix 6, which rebuilds Windows and its services while keeping your files and apps.
• Registry files from the internet. In Microsoft's community forum, volunteers point users to .reg files on third-party sites that recreate the Windows Update service. We found no Microsoft page that offers such files. A file made for another Windows build can write wrong values, so we do not recommend it over Fix 6.
• Find out what deleted the service. A service key does not vanish by itself. If you ran no cleanup or tweaking tool, scan the PC before you go on: How to scan for malware with Microsoft Defender
• Full steps and the recovery environment: Undo recent changes with System Restore

Fix 5. Repair the system files, then reset the Windows Update components

30 to 45 minutesLow riskFix 1 found every dependency installed and running, yet the update still ends with 0x80070433.

With healthy lists, what remains is a damaged file behind one of the services or a damaged update cache. DISM and System File Checker replace damaged Windows files, and the reset gives Windows Update a clean download store and restarts its services in the right order.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

Restart the PC after the scans. Then reset the update components. The last commands of that procedure are a test in themselves: if net start bits or net start wuauserv answers with "System error 1075 has occurred", a dependency is still broken and you are back at Fix 1.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

1. Restart the PC once more.
2. Open Settings > Windows Update and select Check for updates.
3. If the same update fails again, open Update history and note its KB number and the code next to it for the next section.

Windows 11 can also run its own update diagnosis from Settings > System > Troubleshoot > Other troubleshooters. It is quick and worth one try at this point, but it does not edit dependency lists: Run the Windows Update troubleshooter

Fix 6. Reinstall the current version of Windows and keep your files and apps

1 to 2 hoursLow riskA Windows service is deleted and no restore point brings it back, or every other fix left the error in place.

A repair install writes the Windows files and the Windows part of the registry again, the service records with their default dependency lists included. Microsoft describes it as reinstalling the same version of Windows while repairing system files and components and preserving apps, files and settings.

1. Windows 11: select Start > Settings > System > Recovery.
2. Under Fix problems using Windows Update, select Reinstall now.
3. Choose whether the PC may restart by itself 15 minutes after the installation, then select OK.
4. Windows Update downloads a repair version of the last update that installed successfully and installs it. Restart when it is done.

1. With installation media (Windows 11 and Windows 10): create installation media for your Windows version on Microsoft's software download page and connect it to the PC.
2. Open File Explorer, select the drive with the media and open setup.exe from its root folder. Select Yes when Windows asks for permission.
3. Select Change what to keep.
4. Select Keep personal files and apps, then Next. The edition on the media must match the edition that is installed.
5. Select Install. The PC restarts several times.
6. When Windows is back, run sc.exe qc wuauserv once to see the restored list, then check for updates.

Microsoft ended support for Windows 10 on 14 October 2025. The repair install still works there, but Windows Update on Windows 10 no longer brings free security updates. All the reset options, including the ones that remove apps: Reinstall Windows without losing files

If 0x80070433 is still there: read what Windows logged

Windows writes down the name it could not find. The Service Control Manager, the part of Windows that starts services, records every failed start in the System log. For this error it writes event 7003, and the event text names both sides: the service that could not start and the service it depends on.

1. Right-click Start and select Event Viewer.
2. Open Windows Logs, then System.
3. Sort the list by the Source column and scroll to Service Control Manager.
4. Look for Event ID 7003 with the level Error. Microsoft's reference gives its text as: "The (name) service depends on the following nonexistent service: (name)".
5. Look also for Event ID 7001: a service depends on another service which failed to start. That one belongs to the sibling code 0x8007042C and to Fix 3.
6. For the update side, build a readable update log in PowerShell. The file WindowsUpdate.log appears on your desktop.

   Get-WindowsUpdateLog

• What to send to support or post in Microsoft's forum: the output of sc.exe qc wuauserv and sc.exe qc bits, the text of event 7003 and your Windows version from Settings > System > About. Add what was installed or removed just before the error.
• When it is not yours to fix: on a PC managed by a workplace or a school, services and their start types can be set by policy. A change you make is set back at the next policy refresh. Report the event text to the administrator.
• When something keeps undoing the repair: the service is disabled or deleted again after each restart. That is the work of a tool that blocks updates or of malware, not of Windows. Remove the tool and scan the PC before repeating the fix.
• Is it hardware? Nothing in Microsoft's description of error 1075 points at hardware. It describes a record in the services database. A failing drive can damage the registry, but then many other services and programs fail too, not one dependency.

How to keep the dependency error from coming back

Each point follows from how the error is made. Microsoft documents that a deleted service stays marked for deletion until it stops and every handle to it is closed, or until the system restarts. It also documents that the services database is meant to be changed through the Service Control Manager only. Tools that edit the keys directly are how a list ends up naming a service that is no longer there.

Frequently asked questions

What does error 0x80070433 mean?

It means a Windows service could not be started because a service it depends on does not exist or has been marked for deletion. The code is the system error 1075, named ERROR_SERVICE_DEPENDENCY_DELETED, in the notation that Windows Update uses. Its first half, 0x8007, marks a wrapped Windows error, and 0433 is 1075 in hexadecimal. In Windows Update the failing service is usually the Windows Update service itself (wuauserv) or the Background Intelligent Transfer Service (BITS). The update is only the place where you notice it. The cause sits in the dependency list of the service.

Why can wuauserv not start with 0x80070433?

Because one name in the dependency list of wuauserv points to a service that Windows cannot find. Before it starts a service, Windows starts every service on that list. If a name on the list is not installed, the start is refused with error 1075 and nothing else is tried. Run sc.exe qc wuauserv in an administrator command window, read the DEPENDENCIES line and test each name with sc.exe query. The name that answers with error 1060 is the cause. If wuauserv has a clean list, run the same check for bits.

What are the default dependencies of the Windows Update service?

Microsoft does not publish a current list for Windows 11 or Windows 10, so we cannot quote one from a primary source. The only lists Microsoft prints are for BITS on older systems: RpcSs and EventSystem on Windows Vista and Windows Server 2003, and Rpcss alone on Windows XP. The practical answer is to read the list from a healthy PC that runs the same Windows version. Run sc.exe qc wuauserv and sc.exe qc bits there and compare the DEPENDENCIES lines with yours. Any name that appears only on the broken PC and fails sc.exe query is the one to remove.

Is 0x80070433 the same as 0x80070422 or 0x8007042C?

No, but they are close relatives and are often mixed up. Code 0x80070422 is error 1058: the service you start is disabled. Code 0x8007042C is error 1068: a dependency exists but failed to start, for example because it is disabled. Code 0x80070433 is error 1075: a dependency does not exist or is marked for deletion. A fourth one, 0x80070424, is error 1060: the service itself is not installed. Microsoft's troubleshooting table for BITS handles 0x80070433 and 0x8007042C in one row with one instruction, which is to make sure the dependency list of the service is correct.

Can I edit DependOnService in the registry by hand?

You can read it there, but you should change it with sc.exe config. The value DependOnService under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services, in the subkey of the service, holds the list. Microsoft's documentation of the services database says to use the functions of the Service Control Manager and not to modify the database directly. The command sc.exe config with depend= does exactly that and takes effect in the database and the registry together. Whichever way you choose, export the key first, because the command replaces the whole list with what you type.

What does "marked for deletion" mean for a service?

It means the service was deleted while it was still running or while a program still had it open. Microsoft documents that the record is then only marked: it is removed after the service stops and all handles to it are closed, and if the service cannot be stopped, at the next system restart. During that time other services that depend on it cannot start and report error 1075. This is why one restart is the first step. After the restart the service is either gone for good, which leaves a dead name on a list, or the error has ended.

Will SFC or DISM fix error 0x80070433?

Only when the services are intact and damaged files are the real reason. System File Checker replaces corrupted protected system files with a cached copy, and DISM repairs the store those copies come from. A missing service is a deleted registry key, which is a different kind of damage. We could not confirm from Microsoft's documentation that either tool recreates a deleted service. Run the dependency check first. If a name fails with error 1060, use the list cleanup, System Restore or a repair install. If every name exists, DISM and SFC are the right next step.

Is error 0x80070433 caused by a virus?

Not by definition, and most cases have an ordinary cause: a program that was removed, a tweak, or a tool meant to stop updates. Microsoft's description of the error mentions only the missing dependency. Malware is one of the things that can delete or disable update services, though, because a PC without updates stays open to it. Two signs make a scan worthwhile: you changed nothing before the error, or a service you repaired is disabled or deleted again after a restart. In that case run a full scan before repeating the repair.

Does this error also appear on Windows 10, and is it worth fixing there?

Yes. The Service Control Manager and its error 1075 work the same on Windows 10 and Windows 11, and so do the sc.exe commands in this guide. Microsoft ended support for Windows 10 on 14 October 2025, so a repaired Windows Update on Windows 10 no longer delivers free security updates. The repair is still worth doing if other things on the PC need the same services, for example the Microsoft Store or app updates. One difference: the Reinstall now option exists only on Windows 11, so a repair install on Windows 10 needs installation media.