0x80070422 and 0x80070426: The Software Protection Service Will Not Start

Fix it now

Neither code is an activation code. 0x80070422 is Win32 error 1058, which Microsoft publishes as a service that cannot be started because it is disabled; 0x80070426 is Win32 error 1062, the service has not been started. The service is Software Protection, sppsvc, and until it runs nothing on the machine can activate.

sc qc sppsvc
sc config sppsvc start= delayed-auto
net start sppsvc
slmgr /dlv

1. Read the START_TYPE line from sc qc sppsvc before you change anything. DISABLED is the whole answer for 0x80070422 and tells you somebody or something set it that way.
2. Note the space after start= in the second command. Microsoft documents that space as required, and without it sc.exe fails rather than doing nothing visible.
3. If net start sppsvc returns an error of its own, stop and read it. That is a different fault from a disabled service and the next section separates the two.
4. To see the text behind any code on this machine, run slui.exe 0x2a 0x80070422. That is Microsoft’s documented way to read an activation code rather than looking it up.

Finding sppsvc stopped is not a fault. It is configured to start on demand and shut down when idle, so what matters is the start type, not the state.

If slmgr /dlv now returns a licence status you can stop here. If the service will not stay started, the next section covers the four reasons it does not.

Why it happens

Both codes are ordinary Windows service errors that reach you through an activation dialogue. Microsoft publishes 0x80070422 as Win32 error 1058, ERROR_SERVICE_DISABLED, “The service cannot be started, either because it is disabled or because it has no enabled devices associated with it”, and 0x80070426 as Win32 error 1062, ERROR_SERVICE_NOT_ACTIVE, “The service has not been started”. Nothing in either sentence mentions licensing, which is why the same pair turns up in Windows Update and the Store.

The service they are complaining about is Software Protection. It owns the licence store, evaluates licences, talks to activation services and answers every question Windows asks about its own state. With it disabled, the components that depend on it return whatever the service control manager handed them, and you get a licensing-shaped error for a service-shaped problem.

The distinction that saves the most time is between the start type and the running state. Software Protection is configured to start automatically after a delay and to stop itself once it has nothing to do, so a stopped service on a healthy machine means nothing at all. A start type of DISABLED means something set it deliberately. A start type that is correct while the service still refuses to start means the service is failing, and those two situations have nothing in common except the code on screen.

One code in this article is worth treating with suspicion. Microsoft publishes no description for 0xC004F07B on any support or documentation page, and neither does it publish anything for the Security-SPP events 902, 903 and 16394 that people are routinely told to read. You can still read what your own machine says about a code: slui.exe 0x2a <code> is documented and prints the text Windows itself holds.

Full reference

What each command in this article is for

A wrong start= value is one of the easier ways to make a machine worse. sc config will accept disabled just as readily as delayed-auto, and there is no confirmation prompt.

The registry value behind the start type

The service configuration lives at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppsvc. The Start value holds the start type: 2 for automatic, 3 for manual, 4 for disabled. Reading it is a reasonable check; writing it is not the right tool, because sc config does the same job with validation.

Export the key before changing anything under Services. A wrong value there can leave a machine unable to boot, and that is a far larger problem than an activation error.

If sc config reports success and the value returns to 4, the fault is not on this machine. Something with higher precedence is writing it: a policy, a management tool, or a scheduled script. Editing the value again only resets the clock on the next refresh.

Codes and events in this family that Microsoft does not publish

Four of the six entries this article covers have no published description anywhere on learn.microsoft.com or support.microsoft.com. That is worth knowing before you spend an afternoon on a code someone has glossed for you confidently.

Microsoft does document a handful of events from this source, and where you need an event to base a decision on, those are the ones to look for rather than the numbers above. When an undocumented code is all you have, the honest approach is to treat it as a symptom and diagnose the service state directly, which is what the commands in this article do.

When the service starts and immediately stops

• Check the Application log filtered on the Security-SPP source for entries written at the moment it stopped.
• Check your endpoint protection product’s own log for a block or a quarantine at the same timestamp. Activators patch licensing binaries, so a detection here is not automatically a false positive.
• If the product supports it, add the vendor’s recommended exclusion rather than turning protection off and leaving it off.
• Report a genuine false positive to the vendor. A machine left unprotected to make an activation error go away is a worse outcome than the error.

Confirming this was never a licensing problem

Once the service starts, slmgr /dlv returns a full status rather than an error, and that output tells you what the machine actually holds: the edition, the channel, the partial key and the licence status. If that output was already correct before the service was disabled, nothing about your entitlement changed while it was down. A machine that cannot check its licence is in a different position from one that has a bad licence, and only the second is a purchasing question.

Every code this article covers

Confirm the fix worked

1. sc qc sppsvc reports a start type other than DISABLED.
2. net start sppsvc completes, or reports that the service is already running.
3. slmgr /dlv returns a full licence status rather than an error.
4. Settings, System, Activation loads and reports a state.
5. Reboot, then repeat the sc qc check, which is what proves nothing is putting the service back to Disabled.

Questions people ask about this