Fix TRUST_E_ACTION_UNKNOWN (0X800B0002) Easily

What’s This Error, Really?

I know seeing TRUST_E_ACTION_UNKNOWN (0X800B0002) feels like your computer just threw up its hands and said “I dunno.” This error means the trust provider—the part of Windows that checks if a file is signed and safe—can’t figure out what action you’re asking it to do. It usually shows up when you’re trying to run an installer, update Windows, or launch a program downloaded from the web. It’s not a virus warning; it’s more like Windows forgot how to validate signatures. Let me help you fix that, step by step.

We’re going to start with the quickest fix—something you can do in 30 seconds—and work up to deeper surgery. Stop when the error’s gone.

Quick Fix: Check Your System Date and Time (30 seconds)

This is the #1 culprit. If your PC’s clock is wrong—especially the year—Windows can’t verify certificate expiration dates. I’ve seen this trip up even experienced admins.

Right-click the time in the taskbar and select Adjust date/time.
Toggle Set time automatically and Set time zone automatically ON.
If they’re already on, turn them OFF, wait 10 seconds, then turn them back ON. This forces a sync.
Click Sync now under “Additional settings.”

Now try running the file or update again. If the error’s gone, great—you’re done. If not, move on.

Moderate Fix: Run Windows Update Troubleshooter (5 minutes)

Sometimes the trust provider itself gets its wires crossed. Windows has a built-in tool for that.

Press Win + I to open Settings.
Go to Update & Security > Troubleshoot > Additional troubleshooters.
Select Windows Update and run the troubleshooter. Let it do its thing—it’ll check for corrupted components related to updates and verification.

If it finds something, follow the prompts. Reboot and test. Still busted? Let’s try a command-line fix.

Moderate Fix: Clear the Windows Update Cache (5 minutes)

A stale cache can throw off the trust verification. I’ve seen this fix it on Windows 10 and 11.

Open Command Prompt as Administrator (right-click Start > Command Prompt (Admin) or Terminal (Admin)).

Stop the update services by running these commands, one at a time:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver

Now rename the SoftwareDistribution folder to force a fresh start:
```
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
```

Restart the services:

net start wuauserv
net start cryptSvc
net start bits
net start msiserver

Reboot and try your update or file again. This nuke-and-pave approach works when the cache is corrupted.

Advanced Fix: Rebuild the Certificate Chain (15+ minutes)

If the error still shows up—especially on older software or after a failed update—the trust provider’s certificate store might be misconfigured. This is the fix I used on a help desk ticket 2 years ago that stumped my whole team.

Open Command Prompt as Administrator.
Run the Microsoft Certificate Trust List update tool:
```
certutil -generateSSTFromWU C:\temp\trusted.sst
```
This downloads the latest trusted certificates from Windows Update. If it fails, your internet connection might be blocking it—try again later.

Import the root certificates manually:

certutil -addstore Root C:\temp\trusted.sst

That should refresh the trust provider’s database. But if you’re still stuck, the real problem might be a corrupted trust provider DLL.

Advanced Fix: Re-register the Trust Provider DLLs (15+ minutes)

This is nuclear but effective. We’re going to re-register the core files that handle signature verification.

Open Command Prompt as Administrator.

Run these commands in order:

regsvr32 /s wintrust.dll
regsvr32 /s initpki.dll
regsvr32 /s softpub.dll
regsvr32 /s mssip32.dll

Restart your computer.

This forces Windows to reload the trust provider components. I’ve used this on Windows 10 Pro 22H2 and Windows 11 23H2 with success.

When All Else Fails: Check for Malware

Rare, but I’ve seen malware corrupt the trust provider to block security updates. Run a full scan with Windows Defender (or your third-party AV) in offline mode. If you’re on Windows 10 or 11, use Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline Scan. It’ll reboot and scan before Windows loads.

One Last Thing

If none of this worked, the file itself might be legitimately unsigned or from a shady source. Try redownloading it from the official website. I’ve wasted hours only to realize I had a corrupted download. It happens to the best of us.

This error is annoying, but it’s fixable. Start with the date check—seriously, look at it—and work your way down. You’ve got this.