Windows 11 24H2/25H2 and Server 2025 Cumulative Update Fails at 35–36% with 0x800f0922 — Insufficient EFI System Partition Space (May 2026)

Indicators

• Cumulative update rolls back at exactly 35–36% completion during the reboot phase with user-facing message: 'Something didn't go as planned. Undoing changes.'
• Windows Update or Settings reports error code 0x800f0922 after failed update installation
• Windows Update reports error code 0x80240069 or 0x80240031 after failed update installation
• C:\Windows\Logs\CBS\CBS.log contains string: 'SpaceCheck: Insufficient free space'
• C:\Windows\Logs\CBS\CBS.log contains string: 'ServicingBootFiles failed. Error = 0x70'
• Device is trapped in a repeated failed update/rollback loop — every attempt produces the same 35–36% rollback with no successful installation

Likely causes

• Insufficient free space (≤10 MB) on the hidden EFI System Partition (ESP) prevents bfsvc.exe from staging the large Secure Boot certificate payload required for the June 2026 certificate expiration deadline
• The May 2026 cumulative update carries an unusually large Secure Boot certificate payload (driven by the June 2026 expiration deadline), exceeding available free space even on ESPs that had previously been adequate
• Third-party or OEM tools (UEFI firmware update utilities, secure boot key management tools, custom boot managers) have written language packs, fonts, or vendor directories to the ESP over time, consuming space needed for Windows update servicing

Diagnostic steps

1. Search CBS.log for the space-related failure strings that confirm ESP exhaustion as the root cause. Run the following from an elevated PowerShell prompt: Select-String -Path 'C:\Windows\Logs\CBS\CBS.log' -Pattern 'SpaceCheck: Insufficient free space|ServicingBootFiles failed' Alternatively open the file in a text editor and search manually.
   Confirms the update failure is caused by insufficient EFI System Partition space (rather than network, WSUS, or package corruption) and pinpoints the bfsvc.exe failure. Presence of either string is definitive.
2. Correlate the error codes from Windows Update history with the CBS.log findings. Navigate to Settings > Windows Update > Update History and confirm that error codes 0x800f0922, 0x80240069, or 0x80240031 are listed for the May 2026 cumulative update, and that the rollback occurred at the 35–36% mark during the reboot phase.
   Rules out other possible causes of update failure (network timeout, WSUS connectivity, corrupt download) and confirms this specific known issue as the root cause before committing to remediation.
3. Identify the EFI System Partition number and measure its free space. From an elevated command prompt, run: diskpart list disk select disk 0 list partition Identify the partition of type 'System' (typically ~100–550 MB in size). Then assign a temporary drive letter: select partition <ESP partition number> assign letter=Z exit Then inspect free space: dir Z:\ Note the 'bytes free' figure. If ≤10 MB, this confirms the triggering condition.
   Quantifies available ESP free space to confirm the ≤10 MB threshold and identifies what is consuming space on the partition.
4. Enumerate the full contents of the ESP to identify non-Microsoft bloat. From an elevated command prompt after mounting (drive Z:): dir Z:\ /s /a Look for OEM vendor directories, language pack files, font files, or third-party boot manager directories that are not part of the standard Microsoft EFI layout (\EFI\Microsoft\, \EFI\Boot\). Note sizes of any suspicious directories.
   Identifies safe deletion candidates — non-Microsoft language packs, fonts, and OEM/vendor directories — that can be removed to reclaim ESP space for bfsvc.exe staging.
5. Check whether a KIR Group Policy is already applied for this build. On the affected device, run from an elevated command prompt: gpresult /h C:\Temp\gpreport.html Then open gpreport.html in a browser and search for KIR-related policy names. Alternatively, check Group Policy Management Console on a DC/management machine for any existing KIR GPO linked to the relevant OU.
   Determines whether the KIR Group Policy workaround is already deployed (which would pause enforcement and unblock installation) or still needs to be applied, guiding the correct remediation path without duplicating effort.

Resolution path

• OPTION A — KIR Group Policy (preferred for fleet deployments): Download the Microsoft Known Issue Rollback (KIR) Group Policy specifically tailored for the affected OS build (Windows 11 24H2 or 25H2 / Windows Server 2025) from the Microsoft Windows Release Health Dashboard. Deploy it via Group Policy Management Console to the relevant OU to pause Secure Boot certificate enforcement and unblock cumulative update installation without modifying the ESP. Run 'gpupdate /force' on affected endpoints after deployment.
• OPTION B — ESP Space Reclamation (required if KIR is not applicable, or as a complement for persistently affected devices): Mount the EFI System Partition using diskpart (assign letter=Z as per diagnostic step 3). From an elevated command prompt, safely delete non-Microsoft language packs, fonts, and OEM/vendor directories identified in diagnostic step 4. Target well above 10 MB of free headroom — aim for 50 MB or more where possible. Do NOT delete \EFI\Microsoft\ or \EFI\Boot\bootx64.efi.
• After completing Option A or Option B, remove the temporary ESP drive letter to restore the partition to its hidden state: open diskpart, select disk 0, select partition <ESP partition number>, remove letter=Z, exit.
• Reattempt the cumulative update installation via Settings > Windows Update > Check for updates, or trigger via WSUS/Intune as appropriate.
• Monitor C:\Windows\Logs\CBS\CBS.log during the retry using: Select-String -Path 'C:\Windows\Logs\CBS\CBS.log' -Pattern 'SpaceCheck: Insufficient free space|ServicingBootFiles failed' — confirm these strings are absent for the current servicing operation and that the update progresses past the 35–36% reboot phase.

Prevention

• Proactively monitor EFI System Partition free space on all managed endpoints as part of regular fleet health checks — establish an alerting threshold of <50 MB free on ESP to identify at-risk devices before the next major update cycle.
• Audit and restrict OEM/third-party tools that write to the ESP (UEFI firmware update utilities, secure boot key management tools, third-party boot managers) to prevent uncontrolled growth of the partition over time.
• When provisioning new devices or re-imaging, ensure the ESP is sized appropriately with sufficient headroom for increasing Secure Boot certificate payload requirements — review Microsoft's current ESP sizing guidance in the context of the June 2026 Secure Boot certificate expiration changes.
• Subscribe to the Microsoft Windows Release Health Dashboard for Windows 11 and Windows Server 2025 to receive early notice of known issues and KIR Group Policies before they generate high helpdesk ticket volumes.

Tools

• CBS.log (C:\Windows\Logs\CBS\CBS.log) — primary servicing log; search for space and boot file servicing failure strings
• diskpart — assign/remove drive letters on the hidden EFI System Partition for inspection and cleanup
• mountvol — identify EFI System Partition volume GUID paths
• Group Policy Management Console (GPMC) — deploy the Microsoft KIR Group Policy across the fleet
• gpresult — verify applied Group Policy settings on individual endpoints
• Microsoft Windows Release Health Dashboard — authoritative source for KIR Group Policy downloads and current issue status

References

• Microsoft Windows Release Health Dashboard — Windows 11 24H2 Known Issues (0x800f0922 / ESP Space)