SOLVED: Resolving Windows Update Error We Couldn’t Connect To The Update Service 0x80072F8F

We recently worked on a Windows 11 client computer that returned the following non-specific Windows Update error:

---

We couldn’t connect to the update service

---

Quick Overview

It took us 3 hours to fix, but we got it! The problem related to the Windows 11 computer not being able to handshake with TLS/SSL to slscr.update.microsoft.com ,

We determined this by clearing the Windows Update Logs, then running a Windows Update, and checking the logs.

Then we exported the HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > SystemCertificates > AuthRoot from a working computer, and imported itinto the problem computer. It turns out that you could just use our registy entries to fix your problem, so click HERE to download the AuthRootCerts.ZIP file we used if you don’t want to spend the 30 seconds to export from a working computer you trust.

The downside of this process is that it locks the certificates so in the unlikely event one is revoked on Microsoft release a new cert, that machine will not get it. However, that problem is USUALLY resolved whenever Microsoft releases a new version of Windows. For instanace the problem computer in question was running Win 11 24H2, after it upgrades to 25H2 (a few months from now), the certificates will be refreshed and no longer locked, so it is a pretty small problem.

Details:

1 – Troubleshooting Methodology & Log Confirmation

The issue was isolated by methodically clearing the Windows Update log and forcing a clean scan to capture the precise error.

Action	Commands (in Elevated PowerShell)
Clear Old Logs	Stop-Service -Name wuauserv -Force Remove-Item -Path $env:windir\logs\WindowsUpdate\* -Force -ErrorAction SilentlyContinue Start-Service -Name wuauserv
Run Windows Update	Run a Windows Update GUI or use this script: (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher().Search("IsInstalled=0 and Type='Software'")
Generate New Log	Get-WindowsUpdateLog

2 – The Problem: Secure Channel Failure

We scanned through the logs and found:

---

FAILED [80072F8F] WinHttp: SendRequestWithAuthRetry using proxy failed for <HTTPS://slscr.update.microsoft.com/SLS/{9482F4B4-E343-43B6

---

The client machine was unable to successfully contact Microsoft’s update servers, failing the initial TLS/SSL handshake with the Service Location Service (SLS) server.

The persistent error, 0x80072F8F, is a Secure Channel Failure (ERROR_WINHTTP_SECURE_FAILURE), confirming the machine could not trust the security certificate presented by the server.

3 – The Fix and Its Critical Side Effect

Since the system could not trust the server, it needed the missing trust components provided manually.

Action	Technical Detail
The Fix	The registry key for the Trusted Root Certificate Authorities store was exported from a known working Windows machine and imported onto the non-working machine.
Target Key	Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
Result	This replacement restored the missing root certificate(s), immediately allowing the TLS handshake to succeed, thus resolving the 0x80072F8F error and restoring Windows Update functionality.

IMPORTANT NOTE: The “Locked” Certificate Store

By importing a static .reg file, the repaired machine’s root certificate store is now effectively frozen at the time of the export.

• This manually created store takes priority, which is great for the immediate fix
• However, the machine loses its ability to dynamically receive updates (new trusted roots) or, more importantly, receive Certificate Revocation Lists (CRLs) which would mark a compromised certificate as untrusted. This creates a potential security risk in the long term

However, that problem is USUALLY resolved whenever Microsoft releases a new version of Windows (i.e. when you upgrade from Win 11 24H2 to 25H2, the certificates will be refreshed and no longer locked. Also, Microsoft does not revoke its own certs or create new one very often, so it is a pretty small problem.

---