Home / Guides / Windows errors

Error 0x80072F8F - the Media Creation Tool and beyond

0x80072F8F is a secure-connection failure: Windows tried to talk to Microsoft's servers over HTTPS and the handshake failed. On Windows 7 and 8.1 it famously appears as "0x80072F8F - 0x20000" the moment the Media Creation Tool starts - those systems speak old TLS by default, and Microsoft's servers require TLS 1.2. Elsewhere (activation, Store, Update) the same code usually means the system clock is wrong. Both causes are fixable in minutes.

Fix it automatically

Outbyte Driver Updater identifies your installed hardware automatically and updates outdated or broken drivers from official sources, with a backup before every change. Useful when you would rather not run the steps below by hand - the scan and diagnosis are free.

Download Driver Updater Downloads Outbyte Driver Updater for Windows 11, 10, 8 and 7. Free 2-day trial, no credit card required.

Quick answer

First check the clock: date, time and time zone must be correct - a wrong clock breaks certificate checks and produces exactly this error. On Windows 7/8.1 with the Media Creation Tool, enable TLS 1.2 (method 2) - or skip the tool entirely and download the Windows ISO from Microsoft's site in a browser (method 3).

Symptoms - how this problem looks

Media Creation Tool exits with 0x80072F8F - 0x20000 right after starting
The error appears on a Windows 7 or 8.1 PC being upgraded
Windows activation fails with 0x80072F8F
Microsoft Store or Windows Update shows the same code
The system clock, date or time zone is off
The same download works fine on another, newer PC

Why it happens

Old TLS on Windows 7/8.1

These systems default to TLS 1.0 for system components. Microsoft's servers require TLS 1.2 - the handshake fails before anything downloads.

Wrong system clock

HTTPS certificates are valid for date ranges. A clock that is off - dead CMOS battery, wrong time zone - makes every certificate look invalid, and secure connections fail with 0x80072F8F.

Missing updates on the old system

TLS 1.2 support on Windows 7 arrived through updates. A long-unpatched system may lack the component itself, not just the setting.

Interception on the network

Proxies, VPNs and some antivirus "HTTPS scanning" features break the secure handshake the same way - temporarily disabling them isolates the cause.

The fixes, in order

1. Fix the clock first

  1. Right-click the taskbar clock, Adjust date and time.
  2. Enable automatic time and time zone; on older Windows set them manually and sync with an internet time server (Internet Time tab).
  3. If the clock resets on every boot, the motherboard's CMOS battery is dead - replace it, or the error will keep returning.

2. Windows 7/8.1: enable TLS 1.2

  1. Install all pending Windows updates first - TLS 1.2 support came via updates on Windows 7.
  2. In Internet Options (Win+R, inetcpl.cpl), Advanced tab: tick Use TLS 1.1 and Use TLS 1.2, untick SSL 3.0; apply.
  3. Set TLS 1.2 as default for system components via Microsoft's documented registry setting: in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp create DWORD DefaultSecureProtocols = 0xA00 (on 64-bit also under the matching Wow6432Node path), then restart.
  4. Run the Media Creation Tool again.

Careful: Edit the registry exactly as written and only these values - or prefer method 3, which avoids the registry entirely.

3. Skip the tool - download the ISO directly

  1. Open Microsoft's official Windows download page in a modern browser (Chrome, Edge and Firefox all speak TLS 1.2 on any Windows).
  2. Download the Windows ISO directly - on the download page, browsers on old Windows are offered the ISO instead of the tool.
  3. Mount the ISO (or write it to a USB stick with a tool like Rufus) and run setup.exe from it - same upgrade, no Media Creation Tool involved.

4. If the error is in activation, Store or Update

  1. Verify the clock (method 1) - it is the top cause for these.
  2. Disconnect VPNs and proxies, pause antivirus HTTPS scanning, and retry.
  3. Run the built-in troubleshooter: Settings, System, Troubleshoot - Windows Update or Store apps, depending on where the code appeared.

Frequently asked questions

What does 0x80072F8F - 0x20000 literally mean?

The first part is a secure-channel (HTTPS) failure; the suffix is the Media Creation Tool's context code. Together: the tool could not establish a TLS connection to Microsoft's servers - which on Windows 7/8.1 is almost always the TLS 1.2 issue.

Is upgrading an old Windows 7 PC still possible?

The upgrade path via the Windows ISO still works technically: download the ISO (method 3), run setup from it and keep files where offered. Whether the hardware meets requirements - particularly for Windows 11 - is a separate check the installer performs.

Why does the error mention time when my internet works?

Browsers tolerate small clock drift; the system's own HTTPS stack is stricter. A clock off by enough makes valid certificates appear not-yet-valid or expired, so system components fail with 0x80072F8F while websites still open.

The automatic route, whenever you are ready

Outbyte Driver Updater scans the PC and shows what it found - then waits. Nothing is applied without your OK, and every change can be rolled back.

Download Driver Updater Downloads Outbyte Driver Updater for Windows 11, 10, 8 and 7. Free 2-day trial, no credit card required.
1,000,000+drivers in the database
Freescan and diagnosis
Your OKrequired before any change
Rollbackavailable for every update