What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The code usually written as 0x80070005 (your search may show “0X8007005”) means access denied, but it does not identify one universal SCCM failure. If a task sequence stops at Setup Windows and ConfigMgr, the Microsoft-documented cause is usually a custom SetupComplete.cmd blocking Configuration Manager from installing its own setup-completion script. Remove that conflicting file or move its actions into task-sequence steps. A remote WMI/DCOM failure, software-update error, or Windows servicing failure follows a different path. Start by identifying the operation, then use its log to select the repair below.
What does 0x80070005 mean in SCCM?
Microsoft labels 0x80070005 “General access denied error.” In Configuration Manager (formerly SCCM), the same HRESULT can be emitted by operating-system deployment, remote management, software updates, or Windows servicing. The hexadecimal value is therefore a symptom, not a diagnosis. The computer, account, file, registry object, or DCOM operation that was denied is what determines the fix.
As an Amazon Associate I earn from qualifying purchases.
Before changing permissions or rebuilding a client, write down the exact action that failed, whether it ran in Windows PE or the installed operating system, whether the action was local or remote, and the time shown in the error. Those details let you match the event to the correct component log instead of applying an unrelated repair.
Which SCCM operation is failing?
Use the failing operation to choose the troubleshooting branch. These cases overlap in their error code but not in their remedies.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
| Where the error appears | Diagnostic evidence | What the evidence can indicate |
|---|---|---|
| OSD task sequence at “Setup Windows and ConfigMgr” | X:windowstempsmstslogsmsts.log; entries from OSDSetupHook |
A custom SetupComplete.cmd occupies the path needed for the task sequence’s setup hook. |
| Remote console, Configuration Manager tools, or WMI access | The remote operation’s error and WMI/DCOM context; remote failures may also show 0x800706ba | DCOM hardening, remote permissions, or the configured access account may be involved. |
| Software-update deployment or scan | WUAHandler.log and the software-update health details |
Access to a file or registry entry failed, or policy settings were overwritten by a higher authority. |
| Windows Update or component servicing outside an SCCM action | The latest CBS.log, matched to the error timestamp |
Windows servicing was denied access to a particular file or registry object. |
Do not treat a row as proof by itself. Confirm the matching timestamp and the component that reports the denial before editing a task sequence, account, policy, or permission.
How do I fix 0x80070005 when an OSD task sequence stops at “Setup Windows and ConfigMgr”?
For the documented OSD scenario, remove the custom SetupComplete.cmd that prevents the task sequence from installing its own setup-completion script. This is a file conflict, not a reason to perform a broad access-control reset.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →1. Confirm the OSD evidence
In the Windows PE environment described by Microsoft, open X:windowstempsmstslogsmsts.log. Find the error at the time the task sequence runs Setup Windows and ConfigMgr. The relevant pattern is an OSDSetupHook failure to install the setup hook with HRESULT 80070005. If your log instead shows a network, package, or account failure, use that evidence rather than assuming the setup-script conflict.
2. Find how the custom script was introduced
Review the task-sequence steps and the operating-system image. A common documented arrangement copies a custom SetupComplete.cmd with a Run Command Line step between Apply Operating System and Setup Windows and ConfigMgr. Another arrangement embeds the file in a custom WIM. Check both places; removing only the task-sequence copy will not help if the image itself still contains the file.
3. Remove the conflicting task-sequence step
If a Run Command Line step copies the custom file into the Windows installation, remove that step or otherwise stop it from placing the file before Setup Windows and ConfigMgr. Save the task sequence, update the content that your deployment uses, and test with the same deployment path. Keep the change limited to the step that creates the conflict.
4. Remove the file from a custom WIM when necessary
If the file is embedded in the image, Microsoft describes using a Run Command Line step between Apply Operating System and Setup Windows and ConfigMgr to delete it before the setup hook runs. Configure that step to target the custom SetupComplete.cmd in the applied Windows image, then update the task-sequence content and retest. The important condition is that the custom file is gone before the setup-completion hook is installed.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
5. Move the script’s work into supported task-sequence actions
Do not lose required configuration merely to remove the file. Break the actions performed by SetupComplete.cmd into explicit task-sequence steps where possible. This makes ordering and success or failure visible in smsts.log, and it leaves the setup-completion path available to Configuration Manager.
6. Rerun and verify the changed result
Run the same task sequence again and inspect the new smsts.log. A successful change should remove the setup-hook conflict; if a different step fails, use that step’s timestamp and message as the next diagnosis. Do not infer success merely because Windows Setup completed part of the deployment.
What should I do when remote SCCM console, tools, or WMI access returns 0x80070005?
A remote-only failure is a separate branch from the OSD script conflict. If the action works locally but fails from a console or administration tool, investigate the remote WMI/DCOM path, its account, and the security changes applied to the environment.
Check whether the failure is genuinely remote
Repeat the operation locally on the target where that is safe and supported. A local success paired with a remote access-denied result points toward remote communication or authorization, while a local failure suggests a target-side problem that is not solved by changing DCOM alone. Record whether the message also includes 0x800706ba, which Microsoft documents among remote console and tool failures.
Review DCOM and WMI context
Microsoft documents Configuration Manager remote console and tool failures after Windows security updates released from June 2022, including 0x80070005 and 0x800706ba. Its WMI guidance separately describes 0x80070005 as access denied by DCOM security. Check the permissions and authentication configuration relevant to the specific remote operation, and compare the timing with those security changes. Avoid deleting an OSD setup script: that file is unrelated to a remote WMI/DCOM denial.
Verify the account used for client push or remote work
A Microsoft Q&A client-push example reports 0x80070005 while connecting to remote WMI and points administrators toward the configured client-push installation account. Treat that community report as a scenario clue, not a universal rule. In your Configuration Manager settings, verify which account is configured, that its credentials are current, and that it has the permissions required by your organization’s remote WMI and client-push design. Make one controlled change at a time and retest the same target.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Use the remote operation’s own logs
Capture the complete error and timestamp from the console or tool, then correlate it with the target and server-side records available for that operation. The evidence should identify whether the denial occurred during namespace access, service communication, authentication, or another stage. Without that distinction, a blanket permission change can conceal the real problem or weaken security without restoring connectivity.
How do I repair 0x80070005 during a software-update operation?
When the software-update health dashboard reports 0x80070005, investigate the file or registry access failure and the policy that controls the update client. The relevant starting point is WUAHandler.log, not smsts.log.
Recommended Free Tools
Read WUAHandler.log at the failure time
Locate the entries matching the dashboard’s timestamp and identify the update action, file, registry area, or policy operation that was denied. Preserve the surrounding lines; the component and requested action are more useful than the HRESULT alone. If the log points to a different component, follow that component’s evidence instead of changing update permissions immediately.
Check for policy being overwritten
Microsoft’s software-update health guidance specifically calls out policy-related troubleshooting, including the possibility that Group Policy settings were overwritten by a higher authority. Compare the effective policy with the settings your Configuration Manager deployment expects. Determine which authority is applying the value before editing it; a local change can be replaced again at the next policy refresh.
Retest the same deployment
After correcting the identified policy or access condition, trigger the affected scan or deployment according to your normal administration process. Recheck WUAHandler.log and the health status for a changed result. If the same object is denied, retain the new timestamp and investigate that object rather than repeating an unrelated permission reset.
What if 0x80070005 appears in Windows Update or CBS servicing?
If no SCCM action is running and Windows Update or component servicing reports the code, use Windows servicing guidance. This branch is not a universal Configuration Manager client-repair recipe.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Find the matching entry in CBS.log
Open the latest CBS.log, search around the error timestamp, and identify the file or registry object that servicing could not access. The goal is to name the denied object and the servicing operation that requested it. A bare 0x80070005 line without that context is insufficient evidence for changing ownership or ACLs.
Match the repair to the denied object
Only after the log identifies the object should you investigate its permissions, state, or controlling policy in the context of the servicing operation. Do not copy ACL changes or reset commands from a different Windows Update case. An adjustment that is appropriate for one denied object may be irrelevant or risky for another.
Run servicing again and compare logs
Repeat the same Windows Update or servicing action after the evidence-based correction. Compare the new CBS.log timestamp and message. If the denial moves to another object, treat that as a new servicing finding rather than proof that every permission needs to be reset.
What is the safest troubleshooting order for any SCCM 0x80070005 error?
A log-first sequence prevents the most common mistake: applying the OSD fix to a remote, update, or servicing failure. Work through these steps in order.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Name the operation. Record whether the failure is OSD, client push, remote console or tool access, software update, or Windows servicing. Note whether it occurs in Windows PE, the installed OS, locally, or remotely.
- Capture the exact message and time. Include the complete HRESULT, any companion code such as 0x800706ba, the task-sequence step or update action, target computer, and account involved.
- Open the matching log. Use
smsts.logfor the documented OSD hook case,WUAHandler.logfor software-update policy and access evidence, andCBS.logfor Windows servicing. Remote WMI/DCOM work requires the operation’s relevant remote context as well. - Identify the denied object or control. Look for the script path, WMI/DCOM authorization stage, file or registry entry, or policy value named near the timestamp. Do not treat the numeric code as the object name.
- Apply only the matching repair. Remove the conflicting OSD
SetupComplete.cmd, investigate DCOM/WMI and the configured account for remote work, correct the effective update policy or access condition for software updates, or follow the object-specific CBS finding for servicing. - Retest the identical operation. Use the same task sequence, target, account, and deployment conditions where possible. This makes the before-and-after log comparison meaningful.
- Document the result. Save the relevant log excerpt, the change made, and the new timestamp. If the error changes location, begin a new evidence-based branch instead of broadening the original fix.
Which common “fixes” should I avoid?
Several tempting responses are not supported by the documented scenarios and can obscure the cause.
- Do not assume every 0x80070005 is an OSD script conflict. The code also appears in remote DCOM/WMI, software-update, and Windows servicing paths.
- Do not perform a blanket ACL or permission reset first. Microsoft’s servicing guidance says to find the denied file or registry object in
CBS.log; the OSD case identifies a conflicting file instead. - Do not delete a custom setup script from an unrelated remote-management failure. That action addresses the specific OSD hook conflict only.
- Do not change Group Policy blindly. For software updates, determine whether a higher authority is overwriting the expected setting before editing local or Configuration Manager policy.
- Do not treat a community example as a universal cause. The client-push account advice is useful for checking that scenario, but your environment’s account and permissions must be verified directly.
- Do not declare the issue fixed without a retest and fresh log. A task sequence or update can progress past one failure and expose a separate problem later.
How do I decide which branch applies when symptoms overlap?
Compare three axes: the operation, the execution location, and the diagnostic evidence. An OSD task sequence running in Windows PE with an OSDSetupHook entry is materially different from a remote console that fails only after a security update, even when both show 0x80070005.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Operation: OSD, remote management or client push, software update, or Windows servicing.
- Location: Windows PE versus installed Windows, and local versus remote execution.
- Evidence: the component log and exact failing step, including the object or policy named near the timestamp.
Use all three before selecting a repair. The available Microsoft guidance does not establish one repair matrix that applies to every Configuration Manager version, topology, or deployment architecture.
Can an optional repair utility help after I identify the cause?
As an optional shortcut for non-driver Windows troubleshooting, Outbyte PC Repair can address some common broken system elements, invalid redirects, shared DLL issues, settings that contribute to CPU, RAM, or disk load, temporary and cache files, privacy warnings, vulnerability checks, and app-crash logging. It complements an antivirus rather than replacing one, results vary, and it cannot repair every SCCM or Windows crash; it runs on Windows 11, 10, 8, and 7 with a free trial by category for at least two days before a subscription.
What should I remember before closing the incident?
0x80070005 is an access-denied signal, not a single SCCM defect. For the specific Microsoft OSD failure, a custom SetupComplete.cmd blocks the task sequence’s setup hook; removing that file or moving its actions into task-sequence steps is the targeted repair. Remote WMI/DCOM access, software-update policy, and Windows servicing require their own logs and evidence. Keep the failing operation, timestamp, denied object, corrective change, and retest result together in the incident record so the next occurrence can be diagnosed without guessing.
Frequently Asked Questions
Is 0x80070005 the same as 0x8007005?
They are commonly the same access-denied HRESULT written with a missing zero in informal searches. Use the eight-digit form, 0x80070005, when searching logs and Microsoft documentation so you do not miss the relevant entries.
Where is smsts.log during an OSD failure?
In the Windows PE scenario covered by Microsoft’s OSD guidance, check X:windowstempsmstslogsmsts.log. The path can differ after the operating system is installed, so use the location appropriate to the phase shown in your task sequence.
Can restarting the SCCM client fix 0x80070005?
A restart may clear a transient state, but the documented causes here are a setup-script conflict, remote authorization, update policy or access, and servicing access. Restart only as a controlled test; keep the original timestamp and inspect the relevant log before deciding that the issue is resolved.
Free tools Windows power users keep installed
One-click scans. No signup required.
Does changing the client-push account always solve this error?
No. A Microsoft Q&A client-push example identifies the account as something to check for a remote WMI scenario, but it is not a universal explanation. Verify the configured account and its required permissions against the exact remote operation in your environment.
Should I reset Windows permissions to repair SCCM error 0x80070005?
Not without identifying the denied object and operation. Windows servicing guidance starts with the matching CBS.log entry, while the documented OSD case is fixed by removing a conflicting SetupComplete.cmd, not by a broad ACL reset.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
