0X80093017 OSS_UNAVAIL_ENCRULES: Fix ASN Encoder Rules on Windows

0X80093017 is one of those Windows Update errors that surfaces at the worst time — usually mid-patch on a Tuesday, right after the machine has already downloaded 400MB of CAB files. The full string is OSS_UNAVAIL_ENCRULES, and the plain English is: the component that packs and unpacks ASN.1-encoded payloads (that's the OSS ASN encoder) couldn't load its encoding rules. Windows Update, WSUS, and anything that touches Cryptographic Message Syntax hits this.

What's actually happening is that a process — typically TiWorker.exe or wuauclt.exe — asked the crypto stack to encode or decode an ASN.1 blob, and the encoder library that maps the rules failed to initialize. That can be a dead Cryptographic Services (CryptSvc) handle, a corrupted catalog on disk, or a missing or unregistered encoder DLL. Which fix you need depends on where the failure lands. Work top to bottom.

Step 1 (30 seconds): Restart Cryptographic Services

Nine times out of ten the encoder rules are fine on disk — CryptSvc just wedged itself. The service manages catalog signing and ASN.1 routines for the update stack, and when it hangs, its child RPC calls return OSS_UNAVAIL_ENCRULES instead of a timeout. Restart it and retry the update.

Open an elevated Command Prompt and run:

net stop cryptsvc
net start cryptsvc
net stop bits
net start bits
net stop wuauserv
net start wuauserv

BITS and wuauserv depend on CryptSvc, so restart all three or you'll just re-trigger the same error. If the update still fails, move on. If it succeeds, you're done — the encoder was never broken.

Step 2 (5 minutes): Reset the software distribution cache and re-register the encoder

If the service restart didn't take, the update cache is probably holding a half-written catalog. The reason this matters: Windows Update caches signed manifests in C:\Windows\SoftwareDistribution, and a truncated manifest is exactly the kind of input that trips the ASN encoder rules path. Clear the cache, then verify the encoder library itself is registered.

1. Stop wuauserv, bits, cryptsvc, and msiserver from an elevated prompt.
2. Rename the cache — rename, don't delete. You want a fallback if this goes sideways.
3. Restart the services and re-register the encoder DLLs.

net stop wuauserv
net stop bits
net stop cryptsvc
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
regsvr32 /s cryptui.dll
regsvr32 /s wintrust.dll
regsvr32 /s asn1.dll
net start cryptsvc
net start bits
net start wuauserv
wuauclt /resetauthorization /detectnow

The regsvr32 lines are the part people skip, and they're the part that usually fixes it. asn1.dll exposes the encoder rules the OSS layer looks for. If it isn't registered — because a prior cleanup tool unregistered it, or an installer overwrote its registration — you get exactly 0X80093017 on the next scan.

Verify the DLL is present before re-registering:

dir C:\Windows\System32\asn1.dll
certutil -verifykeys

If asn1.dll is missing, that's your answer — you need to restore it from a matching build's WinSxS store or run sfc /scannow. Don't download it from a random DLL site; the signature matters.

Step 3 (15+ minutes): Repair component store and encoder store

When steps 1 and 2 both fail, the encoder rules aren't broken at the DLL level — they're broken at the component store level, which means DISM and SFC need to run against a healthy source. This is the long path. Do it in order.

1. Run sfc /scannow. Yes, it's slow. Yes, it's worth it here — it will repair the ASN encoder rules' supporting files if any are corrupt.
2. Run DISM with a source that matches your build. Pointing at an old ISO is the #1 reason DISM returns 0x800f081f and you're back where you started.
3. Reboot. Then re-run Windows Update twice — the first pass rebuilds the catalog, the second actually applies.

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth /Source:WIM:D:\sources\install.wim:1 /LimitAccess
sfc /scannow
shutdown /r /t 0

Swap D:\sources\install.wim for whatever matches your exact Windows build. On Windows 10 22H2 and Windows 11 23H2 the encoder rules live under the same component family (Microsoft-Windows-ASN1-*), so a mismatched source from an older build will restore files but leave the rules stale.

If it's still failing after all three steps

Check whether a third-party filter driver is intercepting crypto calls. VPN clients, endpoint security agents, and some older backup tools hook bcrypt.dll and ncrypt.dll, and their hooks are what actually reject the encoder request. Disable them temporarily, retry the update, then re-enable. If the update succeeds with the agent disabled, you found the culprit — update the agent or open a ticket with the vendor, because the fix isn't on Microsoft's side.

One more thing: if you're running this inside WSUS with an outdated catalog sync, the error can appear on the client even though the client is healthy. Force a sync on the WSUS server, then re-run wuauclt /resetauthorization /detectnow on the client. I've seen a stale WSUS catalog cause OSS_UNAVAIL_ENCRULES on 200 machines at once, and the fix took 90 seconds once someone looked at the server instead of the clients.