KB5072653 Explained: How to Fix Windows 10 ESU Update Error 0x800f0922 (KB5068781)

If you’re running Windows 10 with Extended Security Updates (ESU), you may have hit a nasty surprise this month:

“Installation failed – Error 0x800f0922”
when installing the November 2025 ESU security update KB5068781.

Microsoft has now acknowledged this issue and released an out-of-band fix called KB5072653 – officially named:

“Extended Security Updates (ESU) Licensing Preparation Package for Windows 10” マイクロソフト サポート+1

This article explains, in plain English:

• What KB5072653 actually is
• Which Windows 10 ESU devices are affected
• Why error 0x800f0922 (CBS_E_INSTALLERS_FAILED) appears
• How to safely install KB5072653 and then reapply KB5068781
• Extra tips for IT admins using WSUS / ConfigMgr

1. What is KB5072653?

According to Microsoft’s official documentation, KB5072653 is a Licensing Preparation Package for Windows 10 ESU. It’s a very small update (around 361 KB) that adjusts how ESU licensing is handled on certain devices so that they can properly install ESU security updates such as KB5068781. マイクロソフト サポート+1

Key points:

• It’s an out-of-band (OOB) update, released on November 17, 2025 – outside the usual Patch Tuesday cycle. Microsoft Learn+1
• It targets Windows 10, version 22H2 that are enrolled in ESU.
• Its main purpose is to fix licensing-related issues that prevent the November 11, 2025 ESU update KB5068781 from installing on some enterprise devices.

In short:

KB5072653 is not a normal cumulative update – it’s a small “helper” patch that makes ESU work correctly on affected Windows 10 machines.

2. What problem does KB5072653 fix?

The story starts with the November 11, 2025 ESU security update KB5068781 for Windows 10.
This update is critical – it includes multiple security fixes for Windows 10 Enterprise LTSC 2021 and Windows 10 ESU devices.

However, some organizations reported that KB5068781:

• Fails to install,
• Returns error 0x800f0922, with the internal error CBS_E_INSTALLERS_FAILED,
• Affects devices that are correctly enrolled in ESU and should be eligible.

Microsoft has now confirmed:

• The issue affects some Windows 10 devices enrolled in ESU,
• Specifically those activated via Windows subscription activation, such as devices upgraded from:
  • Pro → Enterprise, or
  • Pro Education → Education via subscription. Windows Latest+1

In other words:

If your Windows 10 ESU device was converted to Enterprise via a subscription (e.g., Microsoft 365 E3/E5), it might fail to install KB5068781 with 0x800f0922, even though ESU is properly licensed.

Microsoft’s Windows Message Center and the KB5068781 support article now explicitly say:

This issue is fixed by installing KB5072653, and
“Once you install this preparation package (KB5072653), you will be able to deploy the November 11, 2025 security update (KB5068781).”

3. Who actually needs KB5072653?

This is the key question.

3.1 You need KB5072653 if:

You are running:

1. Windows 10 Version 22H2, and
2. The device is enrolled in Extended Security Updates (ESU), and
3. You are trying to deploy KB5068781 (November 11, 2025 ESU security update), and
4. The install fails with error 0x800f0922 (CBS_E_INSTALLERS_FAILED), especially on devices activated via Windows subscription activation. Microsoft Learn+1

This scenario is most common in:

• Enterprise environments
• Devices licensed via Microsoft 365 (E3/E5, A3/A5, etc.) using Windows subscription activation
• Devices upgraded from Pro → Enterprise instead of being Enterprise from day one Windows Latest+1

3.2 You probably don’t need to worry if:

• Your Windows 10 PC is not enrolled in ESU at all, or
• You already migrated to Windows 11, or
• Your environment:
  • Uses Windows 10 Pro without ESU
  • Does not receive KB5068781 in the first place

Interestingly, Microsoft states that KB5072653 may still appear and install on “all” Windows 10 PCs, even those not using ESU, but in that case it doesn’t change anything for non-ESU devices. Windows Latest+1

So:

If you see KB5072653 on a Home or Pro device, don’t panic — it’s safe and basically a no-op for non-ESU systems.

4. Prerequisites: What must be installed before KB5072653?

Microsoft’s support page for KB5072653 lists clear prerequisites.

To enable Windows 10 ESU correctly, you must apply the following in this order:

1. Windows 10, version 22H2 with
   • KB5066791 (October 2025 security update) or a later update installed.
2. Then install KB5072653 (ESU Licensing Preparation Package).
3. After that, you can successfully install ESU updates such as KB5068781.

In practice, this means:

• Make sure your device is already on Windows 10 version 22H2.
• Confirm that the October 2025 cumulative update KB5066791 is installed (or a newer one, if Microsoft releases later rollups).
• Only then install KB5072653.

If KB5066791 is missing, KB5072653 may not install, or ESU updates may still misbehave.

5. How to check if your device is affected

Here’s a quick checklist you can follow, whether you’re a home power user or an IT admin.

5.1 Check Windows 10 version

1. Press Win + R, type winver, and press Enter.
2. Confirm the version is 22H2.

Or via Settings:

• Go to Settings → System → About
• Check “Version” and “Edition”.

5.2 Check if ESU is in use

• On enterprise devices, ask your IT department or check your license state:
  • Open Command Prompt as administrator and run: slmgr.vbs /dlv
  • Look for entries related to Extended Security Updates or Enterprise/Education licenses.
• If you are using Windows 10 Enterprise LTSC 2021 or a device explicitly enrolled in Windows 10 ESU, KB5068781 should show up in Windows Update or WSUS. マイクロソフト サポート+1

5.3 Check if KB5068781 is failing with 0x800f0922

• Open Settings → Update & Security → Windows Update → View update history.
• Look for “KB5068781” in the list of quality/security updates:
  • If it shows “Failed” with 0x800f0922, and the device is ESU-enabled, you are almost certainly in the target group for KB5072653.

6. How to install KB5072653 (step-by-step)

You can install KB5072653 in several ways:

6.1 Method 1 – Windows Update (the easiest option)

On most devices, KB5072653 will be delivered automatically through Windows Update as an out-of-band package.

1. Open Settings → Update & Security → Windows Update.
2. Click “Check for updates”.
3. Look for something similar to:
   • “2025-11 Security Update for Windows 10 Version 22H2 for x64-based Systems (KB5072653)”
4. Let Windows download and install it.
5. Restart the device when prompted (this is required).

Tip for IT admins: many organizations will see KB5072653 appear in a “pending restart” state after a scan, even without manually checking for updates. Windows Latest+1

6.2 Method 2 – Microsoft Update Catalog (manual install)

If you manage offline machines, or you prefer manual control, you can:

1. Visit the Microsoft Update Catalog website.
2. Search for KB5072653.
3. Download the correct .msu package for:
   • Windows 10 Version 22H2 x64
   • (or x86 / ARM64, depending on your environment)
4. Copy the file to the target machine.
5. Double-click the .msu file and follow the prompts.
6. Reboot when asked.

This method is also useful for WSUS or ConfigMgr environments when you want to test the patch on a pilot group before approving it broadly.

6.3 Method 3 – WSUS / ConfigMgr (for enterprises)

If you use WSUS or Microsoft Endpoint Configuration Manager (ConfigMgr):

• Sync your update catalog (or let it auto-sync).
• Ensure KB5072653 is downloaded into WSUS.
• Approve the update for relevant computer groups (e.g., ESU-enrolled Windows 10 22H2 devices).
• Monitor installation via:
  • ConfigMgr compliance reports, or
  • WSUS computers view.

Note: Microsoft also mentions that organizations using scan cab files for compliance will receive updated scan cabs that include KB5072653 metadata.

7. After installing KB5072653: what to do next

Once KB5072653 is installed and the device has rebooted, you are not done yet. The goal is to get KB5068781 installed.

7.1 Re-run Windows Update

1. Go back to Settings → Windows Update.
2. Click “Check for updates” again.
3. Allow KB5068781 to download and install.

If KB5072653 did its job, KB5068781 should now install successfully without error 0x800f0922.

7.2 Verify installation

On the affected device:

• Open View update history and confirm:
  • KB5072653 shows as “Successfully installed”.
  • KB5068781 also shows as “Successfully installed”.

For IT admins:

• Use your regular reporting tools:
  • ConfigMgr compliance reports for KB5068781.
  • WSUS status reports by update.
• Focus especially on:
  • Devices with subscription activation
  • Devices that previously failed with 0x800f0922

According to Microsoft, once KB5072653 is installed, those devices should be able to accept KB5068781 normally.

8. Troubleshooting if KB5072653 won’t install

In some environments, even the preparation package may not install correctly at first. Here are basic troubleshooting steps.

8.1 Confirm prerequisites

• Confirm the device is on Windows 10 Version 22H2.
• Confirm the October 2025 patch KB5066791 (or later) is installed.

If KB5066791 is missing, apply it first, reboot, then try KB5072653 again.

8.2 Repair system files

On some machines, generic component store corruption can cause unexpected failures:

1. Open Command Prompt as administrator.
2. Run: DISM /Online /Cleanup-Image /RestoreHealth sfc /scannow
3. Reboot after completion.
4. Try installing KB5072653 again.

8.3 Temporarily pause third-party security software

In rare cases, certain third-party endpoint security or antivirus solutions can interfere with update installations. If company policy allows:

• Temporarily reduce protection level or
• Put the machine into maintenance mode
  while installing ESU-related updates, then restore protections afterward.

Always follow your organization’s security guidelines when doing this.

9. Best practices for IT admins managing Windows 10 ESU

If you’re responsible for ESU in a corporate environment, KB5072653 is a reminder that ESU is not “set and forget”. A few best practices:

1. Track Message Center and Release Health
   • Microsoft announced the KB5068781 issue and the KB5072653 fix through the Windows Message Center and Windows release health pages.
   • Make sure someone in your team actively monitors these channels. Microsoft Learn+1
2. Pilot ESU updates before broad deployment
   • Use rings or deployment groups:
     • Pilot group (IT / lab PCs)
     • Early adopters
     • Broad deployment
   • KB5068781’s issue mainly hit subscription activation devices, which may only be a subset of your fleet.
3. Document which devices use subscription activation
   • Keep an inventory of:
     • Devices upgraded from Pro to Enterprise via Microsoft 365
     • Devices with standard, non-subscription Enterprise licensing
   • Issues like 0x800f0922 in this case only impacted the subscription-activated group.
4. Keep ESU prerequisites and preparation packages up to date
   • ESU often relies on:
     • Specific Servicing Stack Updates (SSUs)
     • Preparation packages like KB5072653
   • Plan time for these to be applied before regular Patch Tuesday deployment windows.
5. Communicate to stakeholders
   • When ESU patches fail, end-users may see repeated reboots or error dialogs.
   • Brief helpdesk/support teams about:
     • What KB5072653 is
     • What 0x800f0922 means in this context
     • The expected fix behavior

10. FAQ: Common questions about KB5072653

Q1. Is KB5072653 required for all Windows 10 users?

No.
It’s specifically designed for Windows 10 devices enrolled in ESU, especially those activated via Windows subscription activation, and mainly matters if you’re trying to deploy KB5068781.

However, Microsoft may still deliver KB5072653 to all Windows 10 devices via Windows Update. On non-ESU systems, it doesn’t change behavior and is safe.

Q2. Does KB5072653 itself include security fixes?

KB5072653 is primarily a licensing and preparation package, not a traditional security fix. The real security content is in ESU updates like KB5068781.

Think of it like this:

KB5072653 = “ESU enabler / fixer”
KB5068781 = “actual November 2025 security update”

Q3. Should I just move to Windows 11 instead of dealing with ESU?

From a long-term perspective, yes, Windows 11 is the more future-proof option. ESU is meant as a temporary bridge for organizations that need more time to migrate. PCWorld+1

However:

• If you must keep Windows 10 for specific apps, hardware, or regulations,
• Then ESU + fixes like KB5072653 are essential to stay secure.

Many organizations use ESU as a 2–3 year migration window, not as a permanent solution.

11. Summary

If your Windows 10 ESU devices are failing to install the November 2025 security update KB5068781 with error 0x800f0922, you’re not alone. This is a known Microsoft issue affecting some subscription-activated ESU devices.

The fix is:

1. Ensure you’re on Windows 10 Version 22H2.
2. Confirm KB5066791 (October 2025 update) or later is installed.
3. Install KB5072653 (ESU Licensing Preparation Package).
4. Reboot.
5. Re-run Windows Update or your management tool to install KB5068781 again.

Once KB5072653 is in place, the 0x800f0922 install failure should disappear, and your ESU devices will continue to receive critical security fixes.

Related Articles

・Windows 11 KB5068865 (November 2025 Update): What It Fixes, Who Needs It, and How to Install It Safely

・How to Fix Windows Update Error 0x800f0922

タグ: Windows update, Windows 10, error 0x800f0922, Enterprise IT, Windows 10 ESU, KB5068781, KB5072653, WSUS / ConfigMgr