Home / Guides / Windows errors

Error 0x80072F8F - the Media Creation Tool and beyond

0x80072F8F is a secure-connection failure: Windows tried to talk to Microsoft's servers over HTTPS and the handshake failed. On Windows 7 and 8.1 it famously appears as "0x80072F8F - 0x20000" the moment the Media Creation Tool starts - those systems speak old TLS by default, and Microsoft's servers require TLS 1.2. Elsewhere (activation, Store, Update) the same code usually means the system clock is wrong. Both causes are fixable in minutes.

Quick answer

First check the clock: date, time and time zone must be correct - a wrong clock breaks certificate checks and produces exactly this error. On Windows 7/8.1 with the Media Creation Tool, enable TLS 1.2 (method 2) - or skip the tool entirely and download the Windows ISO from Microsoft's site in a browser (method 3).

Symptoms - how this problem looks

Media Creation Tool exits with 0x80072F8F - 0x20000 right after starting
The error appears on a Windows 7 or 8.1 PC being upgraded
Windows activation fails with 0x80072F8F
Microsoft Store or Windows Update shows the same code
The system clock, date or time zone is off
The same download works fine on another, newer PC

Why it happens

Old TLS on Windows 7/8.1

These systems default to TLS 1.0 for system components. Microsoft's servers require TLS 1.2 - the handshake fails before anything downloads.

Wrong system clock

HTTPS certificates are valid for date ranges. A clock that is off - dead CMOS battery, wrong time zone - makes every certificate look invalid, and secure connections fail with 0x80072F8F.

Missing updates on the old system

TLS 1.2 support on Windows 7 arrived through updates. A long-unpatched system may lack the component itself, not just the setting.

Interception on the network

Proxies, VPNs and some antivirus "HTTPS scanning" features break the secure handshake the same way - temporarily disabling them isolates the cause.

The fixes, in order

1. Fix the clock first

  1. Right-click the taskbar clock, Adjust date and time.
  2. Enable automatic time and time zone; on older Windows set them manually and sync with an internet time server (Internet Time tab).
  3. If the clock resets on every boot, the motherboard's CMOS battery is dead - replace it, or the error will keep returning.

2. Windows 7/8.1: enable TLS 1.2

  1. Install all pending Windows updates first - TLS 1.2 support came via updates on Windows 7.
  2. In Internet Options (Win+R, inetcpl.cpl), Advanced tab: tick Use TLS 1.1 and Use TLS 1.2, untick SSL 3.0; apply.
  3. Set TLS 1.2 as default for system components via Microsoft's documented registry setting: in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp create DWORD DefaultSecureProtocols = 0xA00 (on 64-bit also under the matching Wow6432Node path), then restart.
  4. Run the Media Creation Tool again.

Careful: Edit the registry exactly as written and only these values - or prefer method 3, which avoids the registry entirely.

3. Skip the tool - download the ISO directly

  1. Open Microsoft's official Windows download page in a modern browser (Chrome, Edge and Firefox all speak TLS 1.2 on any Windows).
  2. Download the Windows ISO directly - on the download page, browsers on old Windows are offered the ISO instead of the tool.
  3. Mount the ISO (or write it to a USB stick with a tool like Rufus) and run setup.exe from it - same upgrade, no Media Creation Tool involved.

4. If the error is in activation, Store or Update

  1. Verify the clock (method 1) - it is the top cause for these.
  2. Disconnect VPNs and proxies, pause antivirus HTTPS scanning, and retry.
  3. Run the built-in troubleshooter: Settings, System, Troubleshoot - Windows Update or Store apps, depending on where the code appeared.

The automatic option

Outbyte PC Repair scans for more than 100 common problems - junk files, heavy background processes, vulnerabilities, privacy issues - and fixes them from one place. Useful when you would rather not run the tools above by hand, or want regular maintenance done automatically.

Download PC Repair Downloads Outbyte PC Repair for Windows 11, 10, 8 and 7. Free by-category trial included.

Full features and details →

Frequently asked questions

What does 0x80072F8F - 0x20000 literally mean?

The first part is a secure-channel (HTTPS) failure; the suffix is the Media Creation Tool's context code. Together: the tool could not establish a TLS connection to Microsoft's servers - which on Windows 7/8.1 is almost always the TLS 1.2 issue.

Is upgrading an old Windows 7 PC still possible?

The upgrade path via the Windows ISO still works technically: download the ISO (method 3), run setup from it and keep files where offered. Whether the hardware meets requirements - particularly for Windows 11 - is a separate check the installer performs.

Why does the error mention time when my internet works?

Browsers tolerate small clock drift; the system's own HTTPS stack is stricter. A clock off by enough makes valid certificates appear not-yet-valid or expired, so system components fail with 0x80072F8F while websites still open.