Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Windows Update error 0x80070005 means the update process was denied access to a file, folder, or registry entry. The code does not identify the exact object, so the safest fix is staged: inspect the CBS or Windows Update logs, repair only the permissions involved, reset update components, repair Windows with DISM and SFC, and then check security software or device-management restrictions. Back up the operating-system disk before changing protected permissions.
The title is sometimes typed as 0X800700005, but Microsoft’s documented error is 0x80070005. The procedures below apply to that access-denied failure.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What does Windows Update error 0x80070005 mean?
0x80070005 is the Windows error E_ACCESSDENIED. During an update, a service such as Windows Update or Component Based Servicing tried to read, write, rename, or modify a protected resource and Windows refused the request. Microsoft Learn describes this category plainly: “This error generally means that access was denied.”
The number is not a diagnosis by itself. Different machines can show the same code because of altered permissions on the component store, incorrect registry permissions used by servicing, a security product locking an update file, or a Group Policy or device-management restriction. Treat the code as a starting point, not as proof that one particular folder is damaged.
Popular on Amazon
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
Why the exact object matters
Windows has many protected locations and service identities. A broad permission reset can create a new security problem while failing to repair the object that caused the update to stop. Use the logs to identify the denied file, folder, or registry key before making targeted changes.
How should I prepare before changing Windows permissions?
Permission and ownership commands in this guide run with administrator rights and affect system resources. Create an operating-system disk backup or another recovery option first, and make sure you can sign in with an administrator account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Save open work and disconnect unnecessary external storage.
- Record the update’s failure time and the update name or KB number shown in Settings.
- Keep the computer connected to power while repairs run.
- Do not apply a registry or folder-permission reset to unrelated locations merely because the error number matches.
- If the device belongs to an employer or school, involve its administrator before changing policy, security, or management settings.
These precautions do not remove the error; they reduce the risk of making recovery harder if a protected-resource change goes wrong.
How do I find the file or registry object that was denied?
Start with the event that matches the failed update. The CBS log often identifies the resource that received an access-denied response, while the Windows Update log can confirm where 0x80070005 was recorded.
Read the CBS log
- Press Windows key + R, enter
%Windir%logsCBS, and press Enter. - Open the latest
CBS.logwith an account that can read it. The file can be large; use the failure time from Windows Update to narrow your search. - Look for entries around that time containing access-denied text or the code. Note the full path of any file, folder, or registry object named nearby.
Microsoft’s common Windows Update error guidance recommends matching the CBS error timestamp and identifying the affected object before correcting permissions. Do not infer a path that is not present in the log.
Generate and search the Windows Update log
On current Windows client editions, open an elevated PowerShell window and run:
Get-WindowsUpdateLogWindows creates a readable Windows Update log from its event data. Search that file for 0x80070005, then compare the timestamp and surrounding messages with the CBS entry. If the logs point to different objects, preserve both findings and investigate the one associated with the failed transaction rather than changing permissions at random.
What a useful log finding looks like
- A named file or directory with an access-denied result.
- A registry path used by servicing, with a matching time.
- A service or filter-driver message that appears immediately before the update aborts.
A bare error number without a nearby object is not enough to justify a custom permission change. Continue with the documented staged repairs below and return to the logs if the failure persists.
Can resetting permissions on WinSxS and SoftwareDistribution fix the error?
It can when inherited or altered permissions on the component store or update-download directory prevent servicing from working. Microsoft’s error-specific procedure starts with an elevated Command Prompt and resets permissions on those two locations.
Also popular on Amazon
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Run the documented permission reset
- Open Start, type Command Prompt, choose Run as administrator, and approve the User Account Control prompt.
- Run these commands exactly:
icacls "%windir%WinSxS" /reset /t /c /q
icacls "%windir%SoftwareDistribution" /reset /t /c /q- Wait for each command to finish. The switches reset entries recursively, continue when an item cannot be processed, and reduce routine output; they do not make every object identical by magic.
- Restart Windows and try the update again from Settings > Windows Update.
These commands touch protected servicing data. If the log names a different object, do not assume these folders are responsible; use the log evidence and Microsoft’s procedure as your boundary.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →What if the component store still has the wrong owner?
If the permission reset did not resolve the failure, Microsoft’s next documented step is to make the Windows Modules Installer service account, TrustedInstaller, the owner of the WinSxS tree.
- Open an elevated Command Prompt again.
- Run:
icacls "%windir%WinSxS" /setowner "NT SERVICETrustedInstaller" /t /c /q- Restart the computer.
- Retry the update and record whether the same object appears in the logs.
Ownership is different from ordinary read or write permission. Changing it on the wrong path can interfere with future servicing, which is why this step belongs after the initial reset and a backup.
How do I reset Windows Update components?
When access is still denied, the update services or their downloaded files and catalogs may be stuck in a state that prevents a clean transaction. Microsoft’s reset sequence stops the relevant services, renames two working folders, and starts the services again. Renaming preserves the old folders for troubleshooting instead of deleting them immediately.
- Open Command Prompt as administrator.
- Stop the services in this order:
net stop wuauserv
net stop bits
net stop cryptSvc- Rename the update download and catalog directories:
ren %windir%SoftwareDistribution SoftwareDistribution.old
ren %windir%System32catroot2 catroot2.old- Start the services again:
net start cryptSvc
net start bits
net start wuauserv- Restart Windows and retry the update.
If a net stop command reports that a service is not running, note the message and continue with the documented sequence. If a rename says the folder is in use, restart Windows and run the sequence again before changing unrelated permissions. Keep the renamed folders until the update succeeds and you no longer need their contents for diagnosis.
Should I run DISM and System File Checker?
Yes, if the permission and component-reset stages do not work. DISM repairs the Windows image; SFC then checks protected system files against that repaired image. Run both from an elevated Command Prompt and restart afterward.
Repair the Windows image with DISM
DISM /Online /Cleanup-Image /RestoreHealthMicrosoft says DISM uses Windows Update as its default repair source. The command may take time and can appear to pause while it evaluates or replaces components. Do not close the window simply because progress is slow.
Verify system files with SFC
sfc /scannowWait until the scan reaches 100 percent, then restart Windows and try the update once more. SFC is a verification and repair step; it does not tell you which external security product or management policy might be blocking the update.
When Windows Update cannot supply DISM files
If DISM reports that it cannot obtain the files from Windows Update, Microsoft documents using a working Windows installation or repair files from a network, USB drive, or DVD as an alternate source. A USB drive is therefore a conditional way to provide prepared repair media, not a direct fix for access denial. Use Microsoft’s separate repair-image instructions to select the correct source and image for the installed Windows edition; do not point DISM at arbitrary files.
Recommended Free Tools
Also popular on Amazon
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Could antivirus, security software, or a filter driver be blocking the update?
Third-party security software and file-system filter drivers can lock update resources. If the same access-denied event remains after the documented repairs, Microsoft advises checking for that interference.
Temporarily test real-time protection
- Identify the security product installed on the computer and open its documented settings.
- Temporarily disable real-time protection only long enough to test Windows Update, while keeping the device offline from unnecessary browsing and downloads.
- Run the update test, then immediately re-enable protection whether or not the update succeeds.
Do not treat a successful test as proof that the security product is defective; it only indicates that a lock or policy may be involved. Check the product’s support guidance for an update-safe exception or replacement setting.
Inspect file-system filter drivers
From an elevated Command Prompt, run:
fltmcThe command lists file-system filter drivers. Unloading a non-Microsoft filter driver is an advanced administrator action. Do it only when you understand what the driver belongs to, have a way to restore normal operation, and can undo the change. Removing or unloading an unknown filter can disrupt security, backup, storage, or encryption software.
What should I do on a work- or school-managed PC?
Group Policy, mobile-device management, or other organization controls can deny update operations even when local files and permissions look correct. A managed device may also automatically restore a setting you change.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Ask the organization’s IT administrator to review update policy, servicing permissions, and security-agent logs.
- Provide the exact error code, failure time, CBS path, and Windows Update log entry.
- Do not disable management agents or edit policy settings independently.
Home users should likewise avoid importing permission settings from another computer. Permissions depend on the installed Windows configuration and service identities.
When should I stop troubleshooting and escalate?
Escalate when the log identifies a specific file or registry key but the documented permission, ownership, component-reset, DISM, and SFC stages do not correct it, or when a filter driver or policy is involved and you cannot safely change it.
- Contact Microsoft Support with the update name, error time, relevant CBS lines, and the Windows Update log.
- On a managed computer, contact the device administrator rather than applying broad local changes.
- Keep your operating-system backup available before any further registry or permission work.
Do not apply a blanket reset to the entire Windows directory based only on 0x80070005. The number signals denied access, but the log and environment determine which repair is appropriate.
As an optional shortcut after the manual steps, Outbyte PC Repair can attempt fixes for more than 100 common Windows issues where possible, adjust settings, clean temporary and cache files, and provide tools such as vulnerability checks and an app-crash log. It runs on Windows 11, 10, 8, and 7; its category-based free trial lasts at least two days before a paid subscription, and it complements antivirus software rather than replacing it. Results vary, and no tool repairs every crash.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Windows Update error 0x80070005 FAQ
Will these commands delete my personal documents?
The documented commands target Windows servicing folders and services, not user libraries such as Documents or Pictures. Nevertheless, create the recommended operating-system backup before changing protected resources, and do not substitute personal paths for the paths shown.
Can I run the commands from PowerShell?
The commands are written for an elevated Command Prompt. PowerShell can invoke many executables, but quoting and environment-variable handling can differ; using the requested administrator Command Prompt avoids changing the syntax during a sensitive repair.
Also popular on Amazon
- 【Efficient Performance】 Powered by Intel Core i3 processor (2 cores, 4 threads, up to 3.4GHz) with 12GB RAM and 256GB SSD. Handles multitasking, office software, online classes, and HD video streaming smoothly. Integrated Intel UHD Graphics 620
- Backlit Keyboard & Complete Package】Comes with a cool backlit keyboard. Comes with awebcam, dual stereo speakers (8Ω/1.0W each), DC charger, and user manual – ready for late-night studying, online classes, video conferencing, and daily productivity
- 【Vibrant Display】 15.6-inch Full HD (1920x1080) anti-glare screen with 16:9 aspect ratio delivers crisp images and vivid colors – perfect for studying, watching lectures, or entertainment. Thin-bezel design maximizes viewing area
- 【Fast Connectivity & Expansion】 Equipped with WiFi 6 (802.11ax) and Bluetooth 5.2 for stable, high-speed wireless. Features 3 x USB 3.0, HDMI 2.1, Type-C (supports PD3.0 fast charging), and a TF card slot expandable up to 2TB – easily connect external monitors, mice, drives, or expand storage for all your files
- 【Long Battery Life & Portable】 Built-in 11.55V 5000mAh/57.75Wh high-capacity battery delivers approximately 7 hours of mixed-use battery life – enough for a full day of classes and assignments. Lightweight at just 1.63kg (3.6 lbs) and 19.5mm thin, plus a compact packing size – easily slips into a backpack for campus, library, or coffee shop
Why does the error return after a restart?
A recurring failure can indicate that a security product, filter driver, or organization policy reapplies a restriction after boot. Compare the new failure time with the logs and ask the security or device administrator to review the corresponding event.
Should I keep the .old update folders?
Keep them temporarily if you may need to compare files or logs while diagnosing the failure. After Windows Update works and you have confirmed that no rollback or investigation requires them, follow Microsoft’s cleanup guidance for your Windows version rather than deleting protected data impulsively.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsIs buying a USB drive required?
No. Standard permission checks, component resets, DISM’s normal repair source, and SFC do not require new hardware. USB media is relevant only when DISM cannot obtain repair files from Windows Update and you have prepared a matching alternate source.
Frequently Asked Questions
Will these commands delete my personal documents?
The commands target Windows servicing folders and services, not user libraries such as Documents or Pictures. Nevertheless, create the recommended operating-system backup before changing protected resources, and do not substitute personal paths for the paths shown.
Can I run the commands from PowerShell?
The commands are written for an elevated Command Prompt. PowerShell can invoke many executables, but quoting and environment-variable handling can differ; using the requested administrator Command Prompt avoids changing the syntax during a sensitive repair.
Why does the error return after a restart?
A recurring failure can indicate that a security product, filter driver, or organization policy reapplies a restriction after boot. Compare the new failure time with the logs and ask the security or device administrator to review the corresponding event.
Should I keep the .old update folders?
Keep them temporarily if you may need to compare files or logs while diagnosing the failure. After Windows Update works and you have confirmed that no rollback or investigation requires them, follow Microsoft’s cleanup guidance for your Windows version rather than deleting protected data impulsively.
Is buying a USB drive required?
No. Standard permission checks, component resets, DISM’s normal repair source, and SFC do not require new hardware. USB media is relevant only when DISM cannot obtain repair files from Windows Update and you have prepared a matching alternate source.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
