Fix Error 0x80072f76 0x20016 in Windows

Error 0x80072f76 0x20016 is a Windows Update and Microsoft Store download failure that appears when the system cannot establish a secure connection to Microsoft’s servers, most often due to an incorrect system date, corrupted update cache, or a misconfigured proxy. The fix is to verify your clock and time zone, clear the SoftwareDistribution folder, and reset Windows Update components; in most cases one of these three steps resolves it within minutes.

What This Error Actually Means

The hexadecimal code 0x80072f76 maps to ERROR_WINHTTP_SECURE_FAILURE, which means the Windows HTTP service (WinHTTP) could not complete a secure SSL/TLS handshake with the update server. The second part, 0x20016, is a sub-code that points to a failure during the certificate validation phase. In plain terms, your PC is either rejecting Microsoft’s security certificate, or it cannot reach the server that holds it.

This error is not unique to one Windows version. Users have reported it on Windows 7, 8.1, 10, and 11, though it is far more common on older systems that have fallen out of the automatic update cycle. The error typically appears in the Windows Update settings page, the Microsoft Store, or when trying to download a driver through Windows Update.

Most Common Causes

Before you start changing system settings, it helps to know what you are actually looking for. The error is almost always one of these four things:

Wrong system date or time – SSL certificates are only valid between two dates. If your clock is off by more than a few minutes, the certificate looks expired or not-yet-valid, and the connection is refused.
Corrupted update cache – The SoftwareDistribution folder stores downloaded update files. If a partial or damaged file is in there, the update service may fail before the download completes.
Proxy or VPN interference – A proxy that filters SSL traffic, or a VPN that routes through a blocked region, can break the certificate chain.
Outdated root certificates – If your system has not received a root certificate update in years, it may not recognize Microsoft’s current signing certificates.

Less common but still possible causes include third-party antivirus software that intercepts HTTPS traffic, a corrupted Windows Update service registration, and DNS settings that point to a server that filters or blocks Microsoft domains.

Fix 1: Check the System Clock

This is the single most common cause, and the fastest to rule out. Right-click the clock in the taskbar and select Adjust date and time. Turn off Set time automatically and Set time zone automatically, then set the correct time zone manually and set the date and time. Turn both automatic options back on and check if the error clears.

If your clock resets to the wrong time after a reboot, the CMOS battery on the motherboard is likely dead. This is a small coin cell (usually CR2032) that keeps the clock running when the PC is off. Replacing it is a simple desktop repair, but on a laptop it may require a technician. Until you replace it, you will need to set the time manually before every update attempt.

Fix 2: Clear the Update Cache

The SoftwareDistribution folder is where Windows stores downloaded updates. If a file in there is corrupt, the update service can fail with this exact error. Clearing it is safe and forces Windows to download everything fresh.

Open an elevated Command Prompt: press Win + X and select Terminal (Admin) or Command Prompt (Admin).
Stop the update services by typing these two commands and pressing Enter after each:
net stop wuauserv
net stop bits
Rename the cache folder instead of deleting it, so you can revert if needed:
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
Restart the services:
net start wuauserv
net start bits
Close the Command Prompt and try Windows Update again.

If the error persists, repeat the same steps but also rename the Catroot2 folder: ren C:\Windows\System32\catroot2 catroot2.old. This folder stores update signatures, and a corrupted signature database can produce the same SSL failure.

Fix 3: Reset Windows Update Components

If clearing the cache does not help, the update service itself may be misconfigured. The built-in Windows Update Troubleshooter (Settings > System > Troubleshoot > Other troubleshooters) handles many of these cases automatically. Run it, restart, and try again.

If the troubleshooter finds nothing, you can manually re-register the update DLLs. In an elevated Command Prompt, run these commands one at a time:

regsvr32 /s atl.dll
regsvr32 /s urlmon.dll
regsvr32 /s mshtml.dll
regsvr32 /s shdocvw.dll
regsvr32 /s browseui.dll
regsvr32 /s jscript.dll
regsvr32 /s vbscript.dll
regsvr32 /s scrrun.dll
regsvr32 /s msxml.dll
regsvr32 /s msxml3.dll
regsvr32 /s msxml6.dll
regsvr32 /s actxprxy.dll
regsvr32 /s softpub.dll
regsvr32 /s wintrust.dll
regsvr32 /s dssenh.dll
regsvr32 /s rsaenh.dll
regsvr32 /s gpkcsp.dll
regsvr32 /s sccbase.dll
regsvr32 /s slbcsp.dll
regsvr32 /s cryptdlg.dll

These commands re-register the DLLs that handle secure web requests and certificates. They are safe to run and will not harm your system. After running them, restart the PC and check Windows Update again.

Fix 4: Check Proxy and Firewall Settings

If your network uses a proxy server, Windows Update may be trying to connect through it and failing the SSL check. To bypass this temporarily:

Press Win + R, type inetcpl.cpl, and press Enter.
Go to the Connections tab and click LAN settings.
Uncheck Use a proxy server for your LAN (or note the address so you can restore it later).
Make sure Automatically detect settings is checked.
Click OK and try the update again.

If you are on a corporate network, do not disable the proxy permanently — your IT department likely requires it. Instead, add *.microsoft.com and *.windowsupdate.com to the proxy bypass list. Also check that your third-party antivirus is not intercepting HTTPS. Temporarily disabling the HTTPS scanning feature (not the whole antivirus) is a valid test.

When to Use the Windows Update Assistant

If all the above fixes fail, the issue may be that your Windows version is too old to reach the update servers reliably. Microsoft periodically retires old update endpoints. In that case, the Windows Update Assistant (a free Microsoft tool) can force a feature update to a newer version, which typically resets the update stack entirely. Download it from Microsoft’s official website, run it, and it will walk you through updating to the latest feature release. This is often the final fix for Windows 10 systems that have not been updated in over a year.

If you are already on the latest version and still see the error, the last resort is an in-place repair upgrade: download the Windows Installation Assistant or the ISO, run setup.exe from within Windows, and choose Keep personal files and apps. This reinstalls the operating system files without touching your data and almost always resolves persistent update corruption.

Frequently Asked Questions

Will this error harm my computer?

No. The error simply means an update download failed. Your system is not damaged, and you can keep using it normally. The risk is only that you miss security patches until the error is fixed.

Why does the error appear in the Microsoft Store too?

The Store and Windows Update share the same underlying update service and the same WinHTTP stack. If the secure connection is broken for one, it is broken for both. Fixing the clock or clearing the cache usually fixes both at once.

Do I need to reinstall Windows to fix this?

Almost never. The steps above resolve the error in the vast majority of cases. Reinstalling is only worth considering if you have spent hours and every fix has failed, and even then an in-place repair upgrade is a better first choice than a full wipe.

Can a VPN cause this error?

Yes. Some VPNs route traffic through servers that Microsoft flags or that break the certificate chain. Disconnect the VPN, try the update, and if it works, switch to a different VPN server or protocol.

Is it safe to rename the SoftwareDistribution folder?

Yes. Windows simply creates a new folder on the next update attempt. The old folder remains on disk as a backup, and you can delete it after you confirm updates are working.

Why does my clock keep resetting?

This is almost always a dead CMOS battery on the motherboard. It is a user-replaceable part on desktop PCs. On laptops, it is often soldered or hard to reach, so a repair shop may be needed.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →