Any of the following conditions can cause this issue:

• The RPC Endpoint Mapper service (RpcEptMapper) is stopped or disabled.
• The Remote Procedure Call (RPC) service (RpcSs) is stopped or disabled.
• The Windows Firewall service is stopped or disabled (the Windows Update agent depends on the firewall service for network communication).
• A Group Policy setting or security configuration disabled required services.
• The Windows Firewall registry configuration is corrupted.

Resolution: Troubleshoot Windows Update Error 0x800706D9 untested here · 0 fixed, 0 not

Important

Before you troubleshoot this issue, back up the operating system disk. For information about this process for virtual machines (VMs), see About Azure Virtual Machine restore.

Step 1: Start the required services

To start the services that Windows Update depends on and configure those services to automatically start, run the following commands at the command prompt:

sc config RpcEptMapper start= auto
sc start RpcEptMapper

sc config RpcSs start= auto
sc start RpcSs

sc config MpsSvc start= auto
sc start MpsSvc

Important

Even if you use Azure Network Security Groups (NSGs) to filter network traffic, you still have to configure and run the Windows Firewall service (MpsSvc). The Windows Update agent depends on the firewall service for internal communication.

After the commands finish running, try again to install the update. If the update still doesn't install, go to step 2.

Step 2: Check the Windows Firewall configuration

If the Windows Firewall service doesn't start, the registry configuration might be corrupted. To check the registry entry, run the following command at the command prompt of the affected computer:

reg query "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy" /s

If the key is missing or corrupted, reset the firewall service to its default configuration. At the command prompt on the affected computer, run the following command:

netsh advfirewall reset

After the commands finish running, try again to install the update. If the update still doesn't install, go to step 3.

Step 3: Reregister Windows Update components

To reregister the DLLs that the Windows Update agent needs, run the following commands at the command prompt:

net stop wuauserv
net stop cryptSvc
net stop bits

regsvr32 /s wuaueng.dll
regsvr32 /s wuaueng1.dll
regsvr32 /s wucltui.dll
regsvr32 /s wups.dll
regsvr32 /s wups2.dll

net start bits
net start cryptSvc
net start wuauserv

After the commands finish running, restart the computer, and try again to install the update. If the update still doesn't install, take one of the following actions:

• If the affected computer is a VM, go to step 4.
• Contact Microsoft Support for assistance.

Step 4: Use the Run Command reset tool (Azure)

If the previous steps don't resolve the issue on an Azure VM, try the Azure VM Windows Update Reset Tool. You can run the tool directly from the VM's Azure portal page by using Operations > Run command. When you use this method, you don't have to sign in to the VM.

This tool resets the Windows Update servicing stack. This action clears memory-related lock states in the update agent.

After you run the tool, try again to install the update. If it still doesn't install, go to step 5.

Step 5: Use a repair VM (Azure)

If the reset tool doesn't fix the issue, or the VM doesn't start:

1. Create a repair VM by using Azure VM repair commands.

2. Attach the affected operating system disk to the repair VM.

3. Configure the offline registry hive so that the following services start automatically:

   • RpcEptMapper
   • RpcSs
   • MpsSvc

4. Reattach the repaired disk to the original VM.

5. Try again to install the update. If the update still doesn't install, contact Microsoft Support for assistance.

Log how it went

(Enterprise subscription only)