|
| 1 | +--- |
| 2 | +title: Troubleshoot Windows Update download error codes associated with error 8024A000 |
| 3 | +description: Learn how to troubleshoot Windows Update download error codes 0x80D02002, 0x80072EFD, and 0x80072EFE in Windows. |
| 4 | +manager: dcscontentpm |
| 5 | +audience: itpro |
| 6 | +ms.date: 11/10/2025 |
| 7 | +ms.topic: troubleshooting |
| 8 | +ms.reviewer: scotro, mwesley, jarretr, v-ryanberg, v-gsitser |
| 9 | +ms.custom: |
| 10 | +- sap:windows servicing,updates and features on demand\Windows Update - Install errors starting with 0x8024 (WU E Setup) |
| 11 | +- pcy:WinComm Devices Deploy |
| 12 | +appliesto: |
| 13 | + - <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Supported versions of Windows Server</a> |
| 14 | +--- |
| 15 | + |
| 16 | +# Troubleshoot Windows Update download error codes associated with error code 8024A000 |
| 17 | + |
| 18 | +**Applies to:** :heavy_check_mark: Windows VMs |
| 19 | + |
| 20 | +## Summary |
| 21 | + |
| 22 | +When scanning for updates on Windows Virtual Machines (VMs), you might encounter error codes such as 0x80072EFD, 0x80072EFE, and 0x80D02002. These errors indicate issues with server connections or download progress. Understanding the symptoms and root causes can help in resolving these errors effectively. |
| 23 | + |
| 24 | +:::image type="content" source="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-errormessage80072efd.png" alt-text="Error message 80072EFD" lightbox="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-errormessage80072efd.png"::: |
| 25 | + |
| 26 | +## Prerequisites |
| 27 | + |
| 28 | +For virtual machines (VMs) running Windows in Azure, make sure that you back up the OS disk. For more information, see [About Azure Virtual Machine restore](/azure/backup/about-azure-vm-restore). |
| 29 | + |
| 30 | +## How to identify the issue |
| 31 | + |
| 32 | +### Symptom 1: While scanning for updates, you see error messages indicating a connection issue with the server |
| 33 | + |
| 34 | + :::image type="content" source="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-event16.png" alt-text="System event log 16 indicating connection issue" lightbox="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-event16.png"::: |
| 35 | + |
| 36 | + :::image type="content" source="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-event25.png" alt-text="Windows Update client Operational event 25" lightbox="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-event25.png"::: |
| 37 | + |
| 38 | + Check the Windows Update logs for error codes at the path: `%windir%\logs\windowsupdate`. |
| 39 | + |
| 40 | + :::image type="content" source="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-windowsupdatelogs.png" alt-text="Windows Update logs" lightbox="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-windowsupdatelogs.png"::: |
| 41 | + |
| 42 | +### Symptom 2: Control Panel > System and Security > Windows Updates shows an error code indicating no Internet access to download updates - external sites load, but Microsoft links fail with a TLS error |
| 43 | + |
| 44 | + :::image type="content" source="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-errormessage80072efe.png" alt-text="Error message 80072EFE" lightbox="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-errormessage80072efe.png"::: |
| 45 | + |
| 46 | + :::image type="content" source="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-tlserror.png" alt-text="TLS error accessing Microsoft update site" lightbox="media/troubleshoot-windows-update-download-error-codes-associated-with-error-8024a000/cant-install-updates-error-code-8024a000-80072efd-80072efe-tlserror.png"::: |
| 47 | + |
| 48 | +## Root cause for Windows Update download error codes |
| 49 | + |
| 50 | +**Error code 0x80072EFD**: This error occurs when firewall rules or proxies block Microsoft download URLs, preventing a connection with the server. |
| 51 | + |
| 52 | +**Error code 0x80072EFE**: This error is caused by issues with TLS ciphers, which disrupt connections to Microsoft sites. |
| 53 | + |
| 54 | +## Resolution or troubleshooting steps |
| 55 | + |
| 56 | +### Mitigation 1: Check network configurations |
| 57 | + |
| 58 | + - Confirm if traffic is routed through a Network Virtual Appliance (NVA). |
| 59 | + - Ensure the NVA allows the following Windows Update URLs: |
| 60 | + |
| 61 | + ```plaintext |
| 62 | + http://windowsupdate.microsoft.com |
| 63 | + http://*.windowsupdate.microsoft.com |
| 64 | + https://*.windowsupdate.microsoft.com |
| 65 | + http://*.update.microsoft.com |
| 66 | + https://*.update.microsoft.com |
| 67 | + http://*.windowsupdate.com |
| 68 | + http://download.windowsupdate.com |
| 69 | + https://download.microsoft.com |
| 70 | + http://*.download.windowsupdate.com |
| 71 | + http://wustat.windows.com |
| 72 | + http://ntservicepack.microsoft.com |
| 73 | + http://go.microsoft.com |
| 74 | + http://dl.delivery.mp.microsoft.com |
| 75 | + https://dl.delivery.mp.microsoft.com |
| 76 | + ``` |
| 77 | +
|
| 78 | + - Ensure ports 80 and 443 are open for communication. |
| 79 | +
|
| 80 | +### Mitigation 2: Verify TLS settings. |
| 81 | +
|
| 82 | + - Open Command Prompt as an admin and run the following command to check if TLS 1.2 is enabled: |
| 83 | +
|
| 84 | + ```shell |
| 85 | + reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server |
| 86 | + ``` |
| 87 | +
|
| 88 | + Ensure the values are set as follows: |
| 89 | +
|
| 90 | + ```output |
| 91 | + Enabled REG_DWORD 0x1 |
| 92 | + DisabledByDefault REG_DWORD 0x0 |
| 93 | + ``` |
| 94 | +
|
| 95 | + - If `TLS 1.2` is disabled, modify it to `0x1`. |
| 96 | +
|
| 97 | +### Mitigation 2.1: Address Group Policy Object (GPO)-related issues |
| 98 | +
|
| 99 | + - If external site connectivity is working as expected and previous mitigations don't work, check for the following registry key: |
| 100 | +
|
| 101 | + ```shell |
| 102 | + reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\XXXXXXXX" |
| 103 | + ``` |
| 104 | +
|
| 105 | + - Delete all content inside the `XXXXXXXX` hive or folder to test if a GPO is causing the issue. |
| 106 | +
|
| 107 | + - If the issue persists, remove the computer object from the Organizational Unit (OU) with SSL cipher configurations. |
| 108 | +
|
0 commit comments