Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
DISM error 0x80070005 means Windows was denied access to a file, folder, or registry entry needed for servicing. It is not one single fault, so the reliable fix is to identify the blocked object, repair permissions, reset Windows Update components when necessary, then run DISM and System File Checker in the correct order. The procedure below uses built-in Windows tools and applies to Windows 10 and Windows 11; menus and log availability can vary by edition and whether the PC is managed.
Back up the system drive before changing ownership or permissions. Work in an elevated Command Prompt, follow the stages in sequence, and stop if a command reports that the path does not exist or that access is still denied. That message is useful evidence about what remains blocked.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What does DISM error 0x80070005 mean?
0x80070005 is Windows error E_ACCESSDENIED. During servicing, the component-based servicing stack cannot open, modify, or read an object it needs. Microsoft describes the same condition for Windows Update as an inability to access required files, folders, or registry entries.
The code does not identify one universal cause. A damaged access-control list, incorrect ownership, a security filter driver, Group Policy, or a broken Windows Update cache can all produce the same result. The repair therefore starts with evidence from the logs rather than immediately taking ownership of every system folder.
Popular on Amazon
- Spacious Design: Measuring 21.1" wide and 14.1" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy ergonomic support with the integrated cushioned wrist rest.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a sleek black carbon color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.8 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
- WinSxS: the component store that DISM services.
- SoftwareDistribution: the Windows Update download and database cache.
- Component Based Servicing registry data: permissions here can prevent servicing transactions.
- The Windows directory and individual files: a single denied object can stop a larger operation.
- Security software and filter drivers: these can lock or intercept update files.
- Group Policy: an organization’s policy may intentionally restrict servicing or update operations.
An administrator account alone does not guarantee access: Windows protects many servicing resources with service identities such as TrustedInstaller. That is why the commands below use elevation and, where appropriate, restore the expected owner instead of granting broad permanent rights.
How should I prepare before repairing permissions?
- Back up the operating-system disk. Permission and ownership changes affect core Windows folders. Use your normal image-backup or file-backup process and make sure you can reach the backup before continuing.
- Open an elevated Command Prompt. Select Start, type
Command Prompt, choose Run as administrator, and approve User Account Control. The window title should indicate administrator access. - Record the exact failure. Note whether the error appeared with
/RestoreHealth, Windows Update, an update installation, or another servicing operation. The timestamp will help you match the event in the logs. - Keep the PC connected to power. DISM and SFC can take a while and should not be interrupted by shutdown or sleep.
Do not start by changing permissions on the entire Windows directory or by deleting the component store. Broad, improvised changes can create a second servicing problem and make later recovery harder.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do I find the file, folder, or registry key that was denied?
Use the logs to narrow the repair. The code alone is too general to tell you which object needs attention.
Check CBS.log
Open %windir%LogsCBSCBS.log in a text editor running as administrator, or copy it to another location if the editor cannot read it. Search for 0x80070005 and for lines containing , error. Match the timestamp to your failed DISM or update attempt, then inspect the lines immediately before the error. They often name the file, directory, package, or registry operation that could not be opened.
Check Windows Update logging
Review the Windows Update log available on the affected installation and search for the same code or error text. Match the time of the failure rather than relying on the last line in a large log. If both logs point to the same path, repair that area first; if they identify different objects, address the one involved in the operation you are currently retrying.
Interpret what you find
- A path under
WinSxSpoints toward component-store permissions or ownership. - A path under
SoftwareDistributionpoints toward a Windows Update cache reset. - A registry location under Component Based Servicing points toward a permissions problem that may require an administrator familiar with Registry Editor and organizational policy.
- A file repeatedly held by a third-party filter suggests security software or another file-system filter, not merely a missing administrator elevation.
If the logs do not reveal a specific object, continue with the targeted component-store permission reset below and then retest. Preserve a copy of the logs before making changes if you may need support.
Recommended Free Tools
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
How do I reset WinSxS permissions and TrustedInstaller ownership?
Run these commands only in the elevated Command Prompt. They reset access-control entries below the two named directories and restore the normal TrustedInstaller owner on WinSxS.
icacls "%windir%WinSxS" /reset /t /c /q
icacls "%windir%SoftwareDistribution" /reset /t /c /q
icacls "%windir%WinSxS" /setowner "NT SERVICETrustedInstaller" /t /c /q/reset replaces inherited permission entries with the defaults available to the files; /t applies the operation through subfolders; /c continues when an individual item reports an error; and /q reduces output. The ownership command specifically sets the WinSxS owner to the built-in TrustedInstaller service identity.
- Run the first command and wait for it to finish.
- Run the second command for the Windows Update cache.
- Run the ownership command for WinSxS.
- Restart Windows.
- Retry the operation that originally failed.
Read the command output. A few inaccessible items can indicate that another process is holding a file or that policy is preventing the change. Do not repeatedly force ownership of unrelated system directories. If the retry still fails, continue to the Windows Update reset and log review rather than widening permissions.
How do I reset Windows Update components?
Use this branch when the denied path is in SoftwareDistribution, Windows Update repeatedly fails, or the permission reset did not clear the error. Renaming the caches lets Windows create fresh directories; it does not erase the Windows installation itself.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- In an elevated Command Prompt, stop the services that may have files open:
net stop wuauserv
net stop bits
net stop cryptSvc- Rename the two working directories:
ren "%windir%SoftwareDistribution" SoftwareDistribution.old
ren "%windir%System32catroot2" catroot2.old- Start the services again:
net start wuauserv
net start bits
net start cryptSvc- Restart Windows and retry DISM or the update. If a service refuses to stop, record the message, reboot, and perform the sequence again before renaming anything.
Windows will rebuild the renamed caches as needed. Keep the old directories until the update and servicing operations work; they can be removed later through normal administrative cleanup if disk space is needed. If Group Policy manages updates, the cache reset may not change the policy decision and an administrator will need to review it.
How do I run DISM RestoreHealth correctly?
After the permission and cache checks, run DISM from an elevated Command Prompt:
Also popular on Amazon
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
DISM /Online /Cleanup-Image /RestoreHealth/Online targets the running Windows installation. /Cleanup-Image selects component-store servicing, and /RestoreHealth scans for corruption and attempts repair. By default, DISM uses Windows Update as its repair source, so the command may fail with another access or source error when Windows Update is blocked, its cache is damaged, or the device cannot reach the required update files.
Let the command complete without closing the window. If it reports that the source files could not be found or access is denied again, copy the final error and timestamp, check CBS.log, and use a matching installation source instead of repeatedly rerunning the same command.
Why should I run SFC after DISM?
Run System File Checker only after DISM has completed successfully or after you have supplied a usable repair source:
sfc /scannowSFC checks protected Windows files and replaces corrupted copies. DISM repairs the component source that SFC relies on, which is why Microsoft places DISM first in this sequence. When SFC finishes, read its result: it may report that no integrity violations were found, that corrupt files were repaired, or that some files could not be fixed. If files remain unrepaired, save the message and logs rather than changing permissions again without evidence.
How do I use Windows installation media as a DISM repair source?
When Windows Update is unusable, Microsoft supports a known-good Windows installation, a network share, or removable installation media as an alternate source. A Windows installation USB drive is suitable only when its edition, language, architecture, and build match the installed system; an unmatched image can produce a source error or an inappropriate repair.
Connect or mount the media, identify the folder containing the Windows installation files, and substitute that real path in this command:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Also popular on Amazon
- Anti-Slip Surface - Transform your laptop into a mobile workstation with the AboveTEK portable laptop lap desk. The anti-slip surface provides a strong grip for laptops up to 15.6 inches(Diagonal), while the double rubber strip on the bottom ensures a stable display or typing experience on your lap, couch, or bed.
- Retractable Mouse Pad - Retractable laptop mouse pad extends on both directions for the left/right handed with elevation along the edges for stopping mouse from falling off. The size of laptop tray is 14" X 9.7" and the size of mouse pad is 7.4" X 6.1".
- Effective Heat Shield - The effective heat shield made of sturdy and thick material protects your laptop from overheating. Prioritizes your comfort and safety, an ideal lap pad or board for working anywhere.
- EASY to Carry and Store - With an ergonomic and simplistic design, the lap desk is portable to store in a backpack. Only 15" in size, 2.2 lb of weight and with slim 0.6 inch thickness, it is ready to be easily carried around.
- Widely Applicable - The smooth platform accommodates laptops and tablets up to 15.6 inches(Diagonal), making it a versatile accessory and one of the best gifts for mom, dad, students and professionals. Perfect for use as a laptop bed tray or tablet holder anywhere at home, library, or park.
DISM.exe /Online /Cleanup-Image /RestoreHealth /Source:C:RepairSourceWindows /LimitAccess/Source tells DISM where to obtain repair files. /LimitAccess prevents it from contacting Windows Update and forces use of the supplied location. C:RepairSourceWindows is an example path, not a folder you should create blindly; replace it with the matching source on your USB drive, mounted ISO, or approved network share.
- Verify the media is authentic and obtained through a trusted channel.
- Confirm the installed Windows edition, language, 32-bit or 64-bit architecture, and build correspond to the source.
- Keep the media connected for the entire DISM operation.
- After DISM succeeds, run
sfc /scannowagain.
If the source still cannot be opened, inspect the path and permissions on the media or share and compare the error timestamp with CBS.log. On a managed computer, ask the administrator for an approved source rather than bypassing access controls.
Could antivirus software or a filter driver be causing access denied?
Yes. Real-time security products and other file-system filter drivers can temporarily lock update files or block servicing operations. This does not prove that malware is present; it only means another component may be intercepting access.
- Check the security product’s documented procedure for temporarily testing real-time protection. Follow your organization’s policy and do not leave protection disabled after the test.
- In an elevated Command Prompt, run:
fltmcThe command lists file-system filter drivers. Investigate non-Microsoft entries that coincide with the failure, especially if the logs identify a file that is being held. Re-enable protection immediately after the controlled retry. If the device is managed, security settings may be enforced centrally and only the administrator can authorize a test.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhich repair path should I choose?
Choose the narrowest path supported by your logs and environment.
| Situation | First choice | Source used | When to change course |
|---|---|---|---|
| A specific WinSxS or SoftwareDistribution object is denied | Reset permissions and, for WinSxS, TrustedInstaller ownership | Local files and ACLs | Logs still show denial after reboot, or another process owns the lock |
| Windows Update cache errors or repeated update failures | Stop services, rename SoftwareDistribution and catroot2, restart services | Fresh local update caches | Policy blocks updates or DISM cannot obtain repair files |
| The component store is corrupt but Windows Update works | DISM /Online /Cleanup-Image /RestoreHealth |
Windows Update by default | DISM reports missing source files or access denied |
| Windows Update cannot provide files | DISM with a verified matching /Source and /LimitAccess |
Installation media, network share, or known-good Windows installation | The source does not match the installed build or cannot be read |
| Security software or a filter driver is implicated | Controlled protection test and fltmc review |
Local security and filter configuration | Protection is policy-managed or the lock persists |
| Azure virtual machine or organization-managed PC | Use the environment owner’s documented repair procedure | Environment-specific tools or offline image repair | Escalate to Microsoft or the platform administrator |
What should I do if 0x80070005 still appears?
Stop repeating commands that produce the same denial. Save CBS.log, Windows Update log entries, command output, the exact Windows edition and build, and the time of the failure. Those details let support identify whether the remaining block is a registry permission, a policy, a filter driver, or a damaged image.
Also popular on Amazon
- Spacious Design: Measuring 21.1" wide and 12" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy laptop support with the integrated device ledge.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a blush pink color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.14 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Microsoft directs users to Microsoft Support when the documented sequence does not resolve the problem. Managed business or school devices should go to the organization’s administrator because changing policy-controlled permissions can violate security requirements. Azure virtual machines have additional reset-tool, offline-image, and repair-VM procedures; use the Azure-specific guidance for that environment rather than applying desktop steps blindly.
As an optional shortcut after the manual checks, Outbyte PC Repair can address more than 100 common Windows issues, including broken system elements, invalid redirects and shared DLL problems, while also offering settings tweaks, cleanup, privacy checks, vulnerability checks, a real-time boost, file shredding and crash logging. It runs on Windows 11, 10, 8 and 7 and offers a category-based free trial of at least two days before a subscription; it complements antivirus software, does not replace it, and results vary.
Frequently Asked Questions
Is 0x80070005 a sign that my PC has malware?
No. The code only reports that Windows was denied access to an object. Permissions, update-cache corruption, Group Policy, or a security filter can all cause it, so use the logs and your normal security procedures before drawing conclusions.
Can I fix this DISM error without an internet connection?
Yes, if you have a verified matching Windows installation source on removable media or an approved network share. Run DISM with that path in /Source and add /LimitAccess so it does not try Windows Update.
Why can an administrator account still receive access denied?
Servicing files may be owned by protected service identities, and filter drivers or policy can intercept access even for administrators. The relevant log entry and timestamp are more useful than simply opening another elevated window.
Is renaming SoftwareDistribution different from deleting it?
Renaming preserves the old cache while allowing Windows to create a clean replacement. Keeping the renamed folder until the repair succeeds gives you a fallback if you need to inspect or restore its contents.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
