Windows Update Error 0x800A138F

Since the main focus of my site is the odd things that Windows will do to you sometimes, I figure it’s a good idea to write about this one. I was working on a machine recently, and after cleaning up Sasser I went to use Windows Update. No go. Error 0x800A138F. This being the first time I had ever run into it, I figured that it was a quirk and since I had just been dealing with some annoying adware I figured something was perhaps still memory resident. I rebooted, and still got the same error.

After much more tinkering I had a bit of a brainstorm, I went to the machines hosts file, opened it in notepad, and cleared it out. I did another reboot just for kicks and ran Windows Update. Worked perfectly this time.

The hosts file is in a few different locations:

Windows XP – WINDOWSSYSTEM32DRIVERSETC
Windows 2K – WINNTSYSTEM32DRIVERSETC
Win 98/ME – WINDOWS

Evidently Microsoft moved some of the Windows Update components to akamai.net. Akamai is also known for serving ads, and so some adware scanners may add lines to the hosts file to redirect Akamai’s servers locally. This means that every time your computer looks for the server, it sees in it’s hosts file that Akamai should be located on your machine. Since it’s obviously not, you get that error.

If that doesn’t work for you, here’s a couple of other things you may try:

Make sure that Internet Explorer is configured to use SSL 2.0 and SSL 3.0.

In Internet Explorer go to Tools->Internet Options->Advanced. In the Settings box towards the bottom, under Security, select “Use SSL 2.0” and “Use SSL 3.0” (assuming they are not already selected), and click OK. Close IE and then reopen it. Try to run Windows Update.

Oddly enough, if your date and time are off, this may cause issues as well. SSL certificates have expiration dates, so if your clock is totally tweaked this may be the cause. To change the Date/Time double click the clock in the system tray.

**2/27/05 – Steve Winston submitted the following 0x800A138F info:

We too were having A LOT of problems with windows update on Windows 2003 servers and tried ALL of the suggestions with limited to no success. We also tried changing the system time by 1 minute and that helped on a couple of machines.

We finally came up with this solution and it has worked on every server thus far:

Unselect Check for server certificate revocation

Unselect Use SSL 3.0
Unselect Use SSL 2.0
Select Use TLS 1.0

We have found that even after setting these in some cases we still had to go back and change the system clock by one minute to make it work.