Error 0x80072af9: Fix Windows Update Failures

Error code 0x80072af9 is a Windows Update failure that usually means your PC cannot reach Microsoft’s update servers, often due to a blocked connection, incorrect system date, or a corrupted update cache. The quickest fix is to run the Windows Update troubleshooter, reset the update components, and verify your date/time and internet connection. Below is a complete guide to resolving this error on current Windows 10 and Windows 11 systems.

What Causes Error 0x80072af9?

This error appears when the Windows Update client fails to establish a secure connection (HTTPS) to Microsoft’s servers. The underlying causes are typically one of the following:

• Incorrect system date, time, or time zone – SSL/TLS certificates rely on accurate clocks; even a few minutes off can break the handshake.
• Firewall or proxy interference – Security software, VPNs, or corporate proxies may block the required ports or URLs.
• Corrupted Windows Update components – The software distribution cache or registry keys can become damaged over time.
• Network connectivity issues – DNS problems, a flaky Wi-Fi, or a router that blocks certain traffic.
• Outdated system files – Missing updates or corrupt system files can prevent the update service from running correctly.

Unlike some specific error codes that point to a single driver or hardware issue, 0x80072af9 is generic enough that you need to test each of these areas in order.

Before You Start: Check the Basics

Spend two minutes on these checks before diving into command-line fixes. They resolve a surprising number of cases.

1. Verify date and time: Right-click the clock in the taskbar, select Adjust date/time, and ensure Set time automatically and Set time zone automatically are both on. If they are already on, toggle them off and on again, then manually set the correct time zone.
2. Test your internet connection: Open a browser and visit a few HTTPS sites (like https://www.microsoft.com). If they fail, the problem is your network, not Windows Update.
3. Temporarily disable VPN or proxy: If you use a VPN, disconnect it. In Windows, go to Settings > Network & Internet > Proxy and turn off any manual proxy that is enabled.
4. Restart your router: Power-cycle the modem/router by unplugging it for 30 seconds, then plug it back in.

If these don’t help, move on to the built-in troubleshooter.

Run the Windows Update Troubleshooter

Windows includes an automated diagnostic tool that can detect and fix common update problems. It won’t solve every case, but it’s the safest first step.

1. Open Settings (Win + I) and go to System > Troubleshoot > Other troubleshooters (on Windows 11) or Update & Security > Troubleshoot (on Windows 10).
2. Find Windows Update in the list and click Run.
3. Wait for the scan to finish. If it finds issues, it will offer to apply fixes automatically.
4. Restart your PC and try updating again.

If the troubleshooter reports “Windows Update components must be repaired” but cannot fix them, proceed to the manual reset below.

Reset Windows Update Components Manually

This is the most reliable fix for 0x80072af9. It stops the update services, clears the cache, and re-registers the DLL files. You’ll need to run these commands in an elevated Command Prompt (as administrator).

1. Press Win + X and select Terminal (Admin) or Command Prompt (Admin).
2. Type the following commands one by one, pressing Enter after each. They stop the relevant services:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver

3. Rename the SoftwareDistribution and Catroot2 folders to clear the cache. This does not delete your personal files; it only removes downloaded update files. Type:

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 Catroot2.old

4. Restart the services you stopped:

net start wuauserv
net start cryptSvc
net start bits
net start msiserver

5. Close the Command Prompt and restart your PC, then try Windows Update again.

If you get an “access denied” error when renaming, make sure you are running as administrator and that the services are fully stopped.

Check Firewall and Proxy Settings

Windows Update requires outbound HTTPS (port 443) to reach Microsoft’s servers. Most firewalls allow this by default, but third-party security suites can block it.

• Temporarily disable your third-party firewall/antivirus (not Windows Defender) and try updating. If it works, add an exception for *.microsoft.com and *.windowsupdate.com.
• Check the Windows Firewall: Go to Control Panel > Windows Defender Firewall > Allow an app through the firewall. Ensure Windows Update is checked for both Private and Public networks.
• Flush DNS: In the same admin Command Prompt, run ipconfig /flushdns and then netsh winsock reset. Restart your PC.

If you are on a corporate network, your IT department may need to whitelist the update endpoints. Home users should also check that the router’s parental controls or content filters aren’t blocking the connection.

Advanced Fixes: DISM and SFC

If the error persists, system file corruption may be the culprit. Two built-in tools can repair this.

1. Open an admin Command Prompt or Terminal.
2. Run DISM /Online /Cleanup-Image /RestoreHealth. This fixes the system image. It can take 10-20 minutes; let it finish.
3. Then run sfc /scannow. This scans and repairs protected system files. It also takes a while.
4. Restart your PC and try updating again.

Note that DISM requires internet access to download replacement files from Windows Update. If your connection is the cause of the error, you may need to use the /Source parameter with a Windows installation media, but that is an advanced step best left to experienced users.

Frequently Asked Questions

Does error 0x80072af9 mean my PC is hacked?

No. This error is purely a communication problem between your PC and Microsoft’s update servers. It does not indicate malware or a security breach. However, if you suspect malware, run a full Windows Defender scan separately.

Can I fix this error by reinstalling Windows?

Yes, a clean install will almost certainly fix it, but it’s a last resort. Try the steps above first, as they are less disruptive and usually work. Reinstalling erases your apps and settings, so back up your data first.

Why does the error appear even when my internet works?

Your browser may load websites fine, but Windows Update uses a different network stack and requires specific ports and certificates. A proxy, VPN, or firewall can block those even when normal browsing works. Also, a wrong system clock will break the secure connection even if the network is fine.

Will resetting the update cache delete my downloaded updates?

Yes, it removes the files in the SoftwareDistribution folder, but Windows will simply download them again. It does not affect your personal files, installed programs, or system settings.

Is there a way to update Windows without fixing this error?

You can try using the Microsoft Update Catalog website to download a specific update manually, but that only works for standalone packages, not cumulative updates. The proper fix is to resolve the underlying connection issue.

How long should the DISM command take?

Typically 10 to 20 minutes, but it can take longer on older hardware or slow internet. If it seems stuck at 20% for over an hour, you can safely close the window and restart the command; it will resume from where it left off.

When to Seek Professional Help

If you’ve tried all the above and still see 0x80072af9, the issue may be deeper, such as a corrupted Windows registry or a failing hard drive. At this point, consider contacting Microsoft Support or a local technician. They can run more advanced diagnostics like checking the CBS log or performing an in-place upgrade repair. Do not attempt to manually edit registry keys related to Windows Update unless you are absolutely sure what you are doing, as a mistake can make your system unbootable.

Related

• Restore Missing OneDrive Icon Taskbar Windows 10
• BattlEye Service Failed: Test Signing Fix
• Chrome Remote Desktop on Chromebook: Setup Guide