How to Fix Windows Update Error 0x80072F8F

By ErrorFix · Updated October 19, 2026 · 7 min read

What error 0x80072f8f means

Error 0x80072f8f is Windows' way of saying the secure connection never got established. Whenever your PC talks to Microsoft's servers — checking for Windows updates, activating Windows, downloading from the Microsoft Store, or running the Media Creation Tool — it opens an encrypted SSL/TLS connection and verifies the server's certificate before sending anything. With this error, that handshake fails: the certificate cannot be validated, the encryption protocol is disabled on your side, or the secure response cannot be decoded. The underlying Windows error is a secure-failure code, which is exactly what 0x80072f8f reports.

What makes this error tricky is that it can appear in several different places for the same root cause. You might see it in Settings next to a failed Windows Update, as 0x80072F8F - 0x20000 in the Media Creation Tool when an in-place upgrade refuses to start, or during Windows activation when the activation servers cannot be reached securely. In every case, the fix is the same: restore whatever is breaking the secure channel between your PC and Microsoft. That is almost never your internet connection itself — your browser can load websites perfectly while this error blocks updates, because browsers manage their own certificate checks while Windows' system services rely on the PC's clock, TLS settings, and proxy configuration.

Common causes

• System clock out of sync: SSL certificates are only valid between two dates, so a clock that is off by more than a few minutes makes every certificate look expired or not yet valid. A PC whose battery-backed clock reset after a power cut is the classic 0x80072f8f machine — and syncing the time fixes it in seconds.
• TLS 1.1 and TLS 1.2 disabled: Windows 7 and some older Windows 10 builds ship with modern TLS protocols turned off in Internet Options. Microsoft's servers require TLS 1.2 now, so a PC with only older protocols enabled cannot complete the handshake at all.
• Proxy or VPN intercepting the connection: a corporate proxy, a leftover system-wide proxy from uninstalled software, or a VPN that terminates and re-encrypts traffic presents its own certificate to your PC. When that certificate is expired or untrusted, the secure connection to Microsoft fails even though other traffic looks normal.
• Firewall or antivirus breaking the handshake: third-party security suites that inspect HTTPS traffic act like a proxy and can fail the certificate validation. Even Windows Defender definition updates have been seen failing with 0x80072f8f when a security product interferes with the secure download channel.
• Outdated root certificates or corrupted update cache: PCs that have been offline or unpatched for a long time can miss root certificate updates, so they no longer trust the certificates Microsoft's servers present. Corrupted files in the SoftwareDistribution or catroot2 folders can stall the update engine mid-handshake and surface as the same error.

How to fix error 0x80072f8f — step by step

Work through these fixes in order. Step 1 alone resolves most cases.

1. Sync your date and time with a real time server Open Settings, go to Time and language, then Date and time. Turn on Set time automatically and Set time zone automatically, then click Sync now under Additional settings. Windows rejects SSL certificates when the system clock is off by more than a few minutes, so a correct clock is the single most effective fix for 0x80072f8f. If sync fails, open Terminal as administrator and run w32tm /resync to force a fresh sync.
2. Enable TLS 1.1 and TLS 1.2 in Internet Options Press Windows + R, type inetcpl.cpl, and press Enter to open Internet Properties. Go to the Advanced tab, scroll down to the Security section, and make sure Use TLS 1.1 and Use TLS 1.2 are both checked. Click Apply, then OK, and restart your PC. Windows 7 and some older Windows 10 builds ship with TLS 1.2 off, and without it your PC cannot complete the secure handshake with Microsoft's servers.
3. Turn off the proxy and disconnect the VPN Open Settings, go to Network and internet, then Proxy, and make sure Use a proxy server is turned off and no setup script is configured. Then disconnect your VPN completely and retry the update. A proxy or VPN that intercepts traffic presents its own certificate to your PC, and when that certificate is not trusted, the secure connection fails with 0x80072f8f.
4. Reset the WinHTTP proxy Right-click Start and choose Terminal (Admin). Type netsh winhttp reset proxy and press Enter to clear any hidden system-wide proxy left behind by old software. This proxy is separate from the one in Settings, so it can break Windows Update even when the Settings proxy looks empty. Close the window and retry the update.
5. Reset the Windows Update components Right-click Start and choose Terminal (Admin). Stop the services one at a time with net stop wuauserv, net stop cryptSvc, net stop bits, and net stop msiserver. Rename the update folders with ren C:\Windows\SoftwareDistribution SoftwareDistribution.old and ren C:\Windows\System32\catroot2 Catroot2.old. Restart the services with net start wuauserv, net start cryptSvc, net start bits, and net start msiserver, then check for updates again.
6. Repair system files and refresh root certificates If the secure failure persists, open Terminal as administrator and run sfc /scannow to repair protected system files. When it finishes, run DISM.exe /Online /Cleanup-image /Restorehealth to repair the component store, which also helps your PC trust the current Microsoft root certificates. Restart your PC and check for updates one more time.

Did this fix it? Quick checklist

• Windows Update (or the Media Creation Tool) connects without 0x80072f8f
• Date, time, and time zone are correct and synced with a time server
• TLS 1.1 and TLS 1.2 are enabled; no proxy or VPN is active during the update
• No stuck or failed downloads remain in Update history

If the error survives all six steps, try the update on a different network — tether through your phone's hotspot and retry. If it works there, the block sits with your router or ISP's DNS: restart the router and try your ISP's default DNS instead of a third-party service. On a work PC, check whether it is pointed at a WSUS server with an expired or self-signed certificate — that certificate must be renewed by your IT admin, because your PC will never trust it once it lapses. As a last resort, an in-place upgrade with a freshly downloaded Media Creation Tool replaces every update component at once.