|
| 1 | +--- |
| 2 | +title: Troubleshoot Windows Update download errors |
| 3 | +description: Learn how to troubleshoot Windows Update download error codes 0x80D02002, 0x80072EFD, and 0x80072EFE in Windows. |
| 4 | +manager: dcscontentpm |
| 5 | +audience: itpro |
| 6 | +ms.date: 11/10/2025 |
| 7 | +ms.topic: troubleshooting |
| 8 | +ms.reviewer: scotro, mwesley, jarretr, v-ryanberg, v-gsitser |
| 9 | +ms.custom: |
| 10 | +- sap:windows servicing,updates and features on demand\Windows Update - Install errors starting with 0x8024 (WU E Setup) |
| 11 | +- pcy:WinComm Devices Deploy |
| 12 | +appliesto: |
| 13 | + - <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Supported versions of Windows Server</a> |
| 14 | +--- |
| 15 | + |
| 16 | +# Troubleshoot Windows Update download errors |
| 17 | + |
| 18 | +**Applies to:** :heavy_check_mark: Windows VMs |
| 19 | + |
| 20 | +## Summary |
| 21 | + |
| 22 | +During a scan for updates on Windows Virtual Machines (VMs), you might encounter error codes such as 0x80072EFD, 0x80072EFE, and 0x80D02002. These errors indicate issues that affect server connections or download progress. Understanding the symptoms and root causes can help you to resolve these errors effectively. |
| 23 | + |
| 24 | +:::image type="content" source="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-errormessage80072efd.png" alt-text="Error message 80072EFD" lightbox="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-errormessage80072efd.png"::: |
| 25 | + |
| 26 | +## Prerequisites |
| 27 | + |
| 28 | +For Microsoft Azure virtual machines (VMs) that run Windows, make sure that you back up the OS disk. For more information, see [About Azure Virtual Machine restore](/azure/backup/about-azure-vm-restore). |
| 29 | + |
| 30 | +## How to identify the issue |
| 31 | + |
| 32 | +### Symptom 1: Error messages during scanning |
| 33 | + |
| 34 | +When you scan for updates on a Windows VM, you receive the following error message or a similar message that indicates a server connection issue: |
| 35 | + |
| 36 | +> Windows could not search for new updates |
| 37 | + |
| 38 | + :::image type="content" source="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-event16.png" alt-text="System event log 16 indicating connection issue" lightbox="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-event16.png"::: |
| 39 | + |
| 40 | + :::image type="content" source="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-event25.png" alt-text="Windows Update client Operational event 25" lightbox="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-event25.png"::: |
| 41 | + |
| 42 | + Check the Windows Update logs for error codes at the following location: |
| 43 | + |
| 44 | + `%windir%\logs\windowsupdate` |
| 45 | + |
| 46 | + :::image type="content" source="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-windowsupdatelogs.png" alt-text="Windows Update logs" lightbox="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-windowsupdatelogs.png"::: |
| 47 | + |
| 48 | +### Symptom 2: Windows Updates error code indicates no internet access |
| 49 | + |
| 50 | +When you scan for updates, Windows Updates shows an error code that indicates that you have no internet access. External sites load, but Microsoft links fail and return a TLS error message. |
| 51 | + |
| 52 | + :::image type="content" source="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-errormessage80072efe.png" alt-text="Error message 80072EFE" lightbox="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-errormessage80072efe.png"::: |
| 53 | + |
| 54 | + :::image type="content" source="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-tlserror.png" alt-text="TLS error accessing Microsoft update site" lightbox="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-tlserror.png"::: |
| 55 | + |
| 56 | +## Cause |
| 57 | + |
| 58 | +**Error code 0x80072EFD**: This error occurs when firewall rules or proxies block Microsoft download URLs and prevent a server connection. |
| 59 | + |
| 60 | +**Error code 0x80072EFE**: This error is caused by issues that affect TLS ciphers. This error disrupts connections to Microsoft sites. |
| 61 | + |
| 62 | +## Resolution or troubleshooting steps |
| 63 | + |
| 64 | +### Resolution 1: Check network configurations |
| 65 | + |
| 66 | + - Verify that traffic is routed through a Network Virtual Appliance (NVA). |
| 67 | + - Make sure that the NVA allows the following Windows Update URLs: |
| 68 | + |
| 69 | + ```console |
| 70 | + http://windowsupdate.microsoft.com |
| 71 | + http://*.windowsupdate.microsoft.com |
| 72 | + https://*.windowsupdate.microsoft.com |
| 73 | + http://*.update.microsoft.com |
| 74 | + https://*.update.microsoft.com |
| 75 | + http://*.windowsupdate.com |
| 76 | + http://download.windowsupdate.com |
| 77 | + https://download.microsoft.com |
| 78 | + http://*.download.windowsupdate.com |
| 79 | + http://wustat.windows.com |
| 80 | + http://ntservicepack.microsoft.com |
| 81 | + http://go.microsoft.com |
| 82 | + http://dl.delivery.mp.microsoft.com |
| 83 | + https://dl.delivery.mp.microsoft.com |
| 84 | + ``` |
| 85 | + |
| 86 | + - Make sure that ports 80 and 443 are open for communication. |
| 87 | + |
| 88 | +### Resolution 2: Verify TLS settings |
| 89 | + |
| 90 | + - Open an elevated Command Prompt window, and run the following command to check whether TLS 1.2 is enabled: |
| 91 | + |
| 92 | + ```shell |
| 93 | + reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server |
| 94 | + ``` |
| 95 | + |
| 96 | + Make sure that the values are set as follows: |
| 97 | + |
| 98 | + ```output |
| 99 | + Enabled REG_DWORD 0x1 |
| 100 | + DisabledByDefault REG_DWORD 0x0 |
| 101 | + ``` |
| 102 | + |
| 103 | + - If `TLS 1.2` is disabled, change it to `0x1`. |
| 104 | + |
| 105 | +### Resolution 2.1: Fix Group Policy Object (GPO)-related issues |
| 106 | + |
| 107 | + - If external site connectivity is working as expected, and previous mitigations don't work, check for the following registry subkey: |
| 108 | + |
| 109 | + ```shell |
| 110 | + reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\XXXXXXXX" |
| 111 | + ``` |
| 112 | + |
| 113 | + - Delete all content that's inside the `XXXXXXXX` hive or folder to test whether a GPO is causing the issue. |
| 114 | + |
| 115 | + - If the issue persists, remove the computer object from the Organizational Unit (OU) with SSL cipher configurations. |
0 commit comments