Error 0x80090308 means Windows received an invalid security token. Microsoft maps the Win32 value 0x80090308L to SEC_E_INVALID_TOKEN: “The function failed. The token passed to the function is not valid.” It is an SSPI authentication result, not a diagnosis of one particular program. The failing caller might be a TLS (Schannel) connection, Remote Desktop, a sign-in component, a synchronization client, a proxy or certificate-inspection device, or Windows Update.
The reliable fix is to identify the process and connection that generated the event, then correct that component’s software, certificate, proxy, TLS policy or update service. Do not start by deleting registry keys or disabling modern encryption. Follow the manual sequence below, using the branch that matches your symptom.
As an Amazon Associate I earn from qualifying purchases.
What 0x80090308 means
SEC_E_INVALID_TOKEN is returned through Windows Security Support Provider Interface (SSPI). An application passes an authentication token to a security provider, and the provider rejects the token as invalid or unusable. The number does not identify the provider, remote server, certificate, protocol, proxy or application by itself.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →When Schannel is named, the event usually concerns a TLS handshake. A handshake can fail because the two sides cannot agree on a protocol or cipher, a certificate chain is unacceptable, a TLS-inspection proxy altered the exchange, or the application supplied an unexpected token. Similar status values can also be logged by other SSPI callers. That is why a registry change that happens to help one TLS deployment can make another application stop connecting.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Is it a Windows Update error?
Not necessarily. Windows Update can be the caller, but 0x80090308 is not a Windows Update-only code. If the timestamp lines up with an update download or installation and Windows Update reports a failure, use the update-specific branch in this guide. If the event appears while opening a website, signing in to a work service, connecting with Remote Desktop or syncing an application, repair that caller instead.
The code alone is not evidence of malware, a damaged installation or a compromised account. There is no authoritative prevalence or success-rate statistic for this status, so a percentage-based promise would be misleading.
Identify the failing connection before changing anything
Context is the most valuable diagnostic information. Make a short record while the event is still available:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- The application, Windows service or process that was active.
- The Event Viewer log name, source (for example, Schannel), event ID, timestamp and full General and Details text.
- The remote host, URL, server name or device involved, if shown.
- What the user was doing: signing in, establishing a VPN or TLS connection, using Remote Desktop, synchronizing data, downloading an update or performing another operation.
- The Windows edition and build, application version, security-agent or VPN version, and any certificate, proxy or policy change made shortly before the first event.
- Whether the same operation works with another Windows account, another computer or another network.
Where to look in Event Viewer
- Press Win+R, enter
eventvwr.msc, and press Enter. - Open Windows Logs and inspect System. Use Filter Current Log… to narrow the time range and look for the Schannel source or the event ID named in the message.
- Check Application and the relevant Applications and Services Logs branch for a matching entry from the application, VPN, management client or update component.
- Open the event’s Details tab and copy the XML or text before clearing logs or restarting services. Correlating timestamps between the application log and System log often identifies the caller.
Choose the least risky fix for your symptom
| Where the error occurs | First owner of the fix | Risk | How reversible it is |
|---|---|---|---|
| One application’s sign-in or synchronization | User or application administrator | Low: update, restart and application-specific settings | Usually reversible by reinstalling or restoring the prior application configuration |
| TLS connection with Schannel in the event | Local administrator; domain administrator when policy is managed centrally | Medium to high if protocol, cipher or registry policy is changed | Policy rollback is reversible; registry replacement requires a verified backup |
| Remote Desktop | Client and Remote Desktop/server administrators | Low for updates and certificate checks; higher for shared TLS policy changes | Restart and certificate renewal are straightforward; policy changes must be rolled back deliberately |
| Windows Update | User with administrator rights or Windows administrator | Low to medium when only the update cache is rebuilt | Service restart and cache recreation are reversible; pending downloads must be obtained again |
Step 1: Update and restart the affected software
Install all available updates for the component named by the event before editing policy. For Windows, open Settings > Windows Update (in Windows 10, Settings > Update & Security > Windows Update), select Check for updates, install applicable updates and restart when prompted. Record the OS build after the restart with Settings > System > About.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Update the application that was connecting, as well as a VPN client, browser, security agent or device-management client involved in the transaction. Obtain installers and updates from the publisher or your organization’s approved software channel. A restart matters because SSPI and Schannel settings can be held by long-running services; closing only the visible window may leave the failing process running.
When a proxy or TLS-inspection device is present
Corporate proxies, firewalls and secure web gateways can terminate and recreate TLS sessions. Ask the network administrator to verify that the inspection certificate is valid, trusted by the affected computer, within its validity period and issued for the host being accessed. The administrator should also check whether a recent proxy policy changed the permitted TLS protocols, cipher suites or client-authentication behavior. Do not install a certificate supplied through an untrusted channel merely to silence an event.
Step 2: Inspect Schannel and TLS policy without weakening security
Use this branch when Event Viewer names Schannel or the failure clearly occurs during a TLS connection. First determine whether the computer receives policy from a domain, mobile-management system or security product. A local setting may be overwritten at the next policy refresh.
Recommended Free Tools
Review Group Policy first
- On a managed computer, ask the domain administrator which policy applies. On a test or standalone computer, run
gpedit.mscif the Windows edition provides the Local Group Policy Editor. - Review Computer Configuration > Administrative Templates > Network > SSL Configuration Settings > SSL Cipher Suite Order. Compare the configured order with the remote service’s documented requirements.
- Check whether a security baseline, VPN, proxy or endpoint product controls TLS protocol selection. Make a note of the previous policy values before any change.
- Apply only the protocol and cipher suites required by the service and supported by the Windows build. Keep modern TLS enabled. Do not broadly enable obsolete protocols or remove cipher suites as a first-line experiment.
- Run
gpupdate /forcein an elevated Command Prompt only after an administrator has approved the change, then restart the affected service or computer and retest.
Microsoft’s TLS registry guidance recommends Group Policy or other Windows tools instead of direct registry editing whenever possible. A policy-based change is easier to audit and roll back than an undocumented edit.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Check certificate and name validation
For the remote host, verify the certificate’s subject or subject-alternative name, expiration, issuing chain and intended usage. Confirm that the computer’s date, time and time zone are correct; a wrong clock can make a currently valid certificate appear expired or not-yet-valid. If the service requires mutual TLS, the client certificate and private-key permissions must also be checked by the service owner. These checks are diagnostic; they do not prove that every certificate error produces 0x80090308.
Step 3: Replace Schannel configuration only in a documented administrator procedure
Do not delete the Schannel key, import a random registry file or copy settings from a different Windows release. Microsoft’s Windows Server guidance for certain internal Schannel errors uses a functioning computer with the same Windows version as a reference. It also requires a backup of the affected key before replacement. That procedure is appropriate only when the event and support guidance point to damaged internal Schannel configuration.
- Have a local or domain administrator confirm that configuration replacement is warranted and identify a functioning reference computer with the same Windows version and relevant policy.
- On the affected computer, create a temporary folder such as
C:Tempand export the current key from an elevated Command Prompt:mkdir C:Temp
reg export "HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNEL" C:Tempschannel-backup.reg /y - Store the backup somewhere protected and record its location. A registry export is useful only if it can be restored with administrator rights.
- Export the corresponding Schannel subkey from the functioning reference computer, verify that the Windows version and organizational policy match, and transfer it through an approved administrative channel.
- Follow the specific Microsoft or support procedure for replacing the configuration. Restart Windows, test the original connection and review Event Viewer for new errors.
- If connectivity worsens, stop and restore the backup under administrator supervision with
reg import C:Tempschannel-backup.reg, then restart. Do not continue swapping registry files while the cause is unknown.
A mismatched export can remove organization-specific settings or introduce protocol differences, creating new failures. If you cannot explain why the reference machine is equivalent, escalate instead of performing this step.
Step 4: Repair Windows Update only when Windows Update is the caller
Use this procedure when Settings or the Windows Update log shows the failure during update detection, download or installation. It will not universally repair an invalid token emitted by a browser, Remote Desktop or another SSPI client.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Run the built-in troubleshooter
- Open the Get Help app and search for the Windows Update troubleshooter, or open Settings > System > Troubleshoot > Other troubleshooters in Windows 11 and select Windows Update > Run. Windows 10 uses Settings > Update & Security > Troubleshoot > Additional troubleshooters > Windows Update where that interface is available.
- Apply the recommended correction, restart, and select Check for updates again.
- If the troubleshooter reports a service, database or cache problem that persists, continue with the cache reset below.
Rebuild the SoftwareDistribution cache
- Open Windows Terminal (Admin) or Command Prompt (Admin).
- Stop Windows Update:
net stop wuauserv. If the command reports that dependent Background Intelligent Transfer Service jobs are active, stop BITS withnet stop bitsas well. - In File Explorer, open
C:WindowsSoftwareDistributionand delete its contents, not the parent folder. If a file is locked, confirm that the related service is stopped before retrying. - Start the services again:
net start wuauservand, if you stopped it,net start bits. - Restart Windows and run Windows Update. Previously downloaded update files may need to be downloaded again.
Use an administrator account and do not interrupt a feature-update installation. If the same status returns while another application is failing at the same time, return to Event Viewer rather than repeating the cache reset.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Step 5: Handle Remote Desktop, sign-in and synchronization cases
Remote Desktop
Record whether the error occurs on the client, the host or both. Check the host name, certificate presented by the host, account permissions and any recent Network Level Authentication, gateway, VPN or TLS-policy change. Update the Remote Desktop client and host through your normal Windows servicing process. If only one network path fails, compare a direct approved connection with the corporate gateway and have the gateway administrator inspect its certificate and protocol logs.
Application sign-in or synchronization
Update the application and its authentication component, then sign out and back in using the application’s supported procedure. Check whether the account works in a different browser profile or on another network without bypassing organizational security controls. A vendor may need the application log, timestamp, Windows build and the SSPI event to determine which security provider rejected the token.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Windows services and scheduled tasks
If the event names a service, open Services, locate that service and note its startup type and recovery actions before restarting it. Confirm that the service account has not recently changed and that its proxy, certificate store and network route are still valid. Coordinate changes with the service owner; restarting a production authentication or synchronization service can interrupt other users.
Step 6: Escalate with a complete evidence package
Escalate when updates, application repair and an approved policy check do not resolve the error, or whenever a registry replacement would be the next proposed action. Send the application or service name, event log and ID, timestamp with time zone, full event text or XML, OS edition and build, application and VPN versions, remote host, proxy or TLS-inspection details, recent certificate or policy changes, and the result of testing another account or network.
Contact the application vendor when only that application fails. Contact the network or domain administrator when a shared proxy, certificate, Group Policy or cipher-suite order is involved. Contact Microsoft support for a reproducible Windows or Schannel failure after your organization has collected the logs. Avoid repeatedly changing TLS registry values; each untracked change makes the original cause harder to isolate.
Windows 10 support status
Microsoft ended standard Windows 10 support on October 14, 2025. After that date, Microsoft no longer provides free Windows Update software updates, routine technical assistance or security fixes for Windows 10 under the ended support lifecycle. That limitation is separate from the meaning of 0x80090308: it does not identify the immediate cause of an SSPI failure. Check your organization’s licensing and support arrangements and plan a supported operating-system upgrade, while still diagnosing the current event with the steps above.
Quick Recap
How to verify that the fix worked
- Repeat the exact action that originally produced the event, using the same account, host and network.
- Confirm that the application reports a successful sign-in, TLS connection, Remote Desktop session or update operation.
- Check Event Viewer for new events at the test time rather than relying on old entries.
- Keep the working policy, certificate or application version documented so it can be restored after a future update.
- If the event returns only for one remote host, provide that host and the timestamp to its administrator; the remote endpoint may be rejecting the client token.
As an optional shortcut after the manual checks, Outbyte PC Repair can attempt repairs for more than 100 common Windows issues where possible, adjust settings that affect CPU, RAM and disk load, clean temporary and cache files, provide privacy and vulnerability checks, and include tools such as a real-time boost, file shredder and app-crash log. It runs on Windows 11, 10, 8 and 7; its free trial lasts at least two days before a paid subscription. It complements antivirus software rather than replacing it, results vary, and no tool repairs every crash.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
