The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →0x800700 is not a complete Windows error code. It is an HRESULT prefix; the final characters determine whether you are dealing with invalid update data, denied access, or another installation failure. Capture the complete value (for example, 0x8007000d, 0x80070005, or 0x80070002) before deleting caches, changing permissions, or altering WSUS settings. Then use the matching repair path below.
The procedure applies to a Windows client receiving updates from an on-premises Windows Server Update Services (WSUS) server as well as to a client using Microsoft Update. Record the exact KB number, Windows edition and build, update source, and failure time so that every later log entry can be tied to the same attempt.
As an Amazon Associate I earn from qualifying purchases.
What the complete 0x800700 code means
Microsoft uses the suffix after 0x800700 to describe different failure conditions. These are not interchangeable fixes.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors| Complete code | Meaning | Best first action |
|---|---|---|
0x8007000d |
Invalid data or a damaged Windows Update file/cache | Run the Windows Update troubleshooter, then reset the SoftwareDistribution cache |
0x80070005 |
E_ACCESSDENIED: the update process cannot access a required file, folder, or registry entry |
Use logs to identify the denied object and check servicing-folder, registry, security-software, and policy permissions |
0x80070002 |
A general update-installation failure; the suffix alone does not identify the cause | Collect the exact KB and logs before changing permissions or deleting update files |
Microsoft Support describes 0x8007000d as an update-file or update-cache problem. Microsoft identifies 0x80070005 as E_ACCESSDENIED when the update process cannot access required files, folders, or registry entries. Its general support table treats 0x80070002 as an update-installation failure, so you need additional context rather than assuming a cache problem.
#1 Best Overall
- WIRED NETWORK USB PRINT SERVER: Connect a single USB 2.0 printer to a wired Ethernet LAN (RJ45); 10Base-T, 100Base-TX auto-sensing to ensure a reliable connection, letting you print from any network computer, across the office or over the Internet
- MANUAL NETWORK SETUP REQUIRED: Configuration via web interface (static IP or DHCP) using LPR queue “LP1"; Not plug-and-play, requires intermediate network knowledge for installation; Access our online FAQs for additional helpful tips and instructions
- USB PRINTER COMPATIBILITY: Works with most USB 2.0 printers using standard drivers; Not compatible with USB hubs, multi-function printers with proprietary drivers, or printers requiring full bi-directional communication
- COMPATIBILITY: The USB to Ethernet print server is USB 2.0 compliant and works with macOS and Windows; It also supports LPR network printing and Bonjour Print Services for broad compatibility; Included software is compatible with Windows only
- PRINT FROM ANYWHERE: Print from any computer connected to the Ethernet; This print server doesn’t require a wired connection to a computer, however it must be connected to your networking device (eg. router or switch) with the included RJ45 network cable
Capture the full code and failure context
Do this before attempting a broad reset. A partial code can send you toward the wrong repair and destroy evidence that would show whether WSUS, a proxy, a permission, or a particular update is responsible.
- Open update history. In Windows, go to Start > Settings > Windows Update > Update history. Record the failed KB number and the complete hexadecimal error shown for that attempt.
- Record the operating-system build. Go to Settings > System > About and note the Windows edition and build. Include whether the device is 32-bit or 64-bit when you report the problem.
- Identify the update source. Note whether the computer is managed by an organization and expected to use WSUS or is intended to use Microsoft Update. Windows Update client diagnostics identify Windows Server Update Service as the source when the client is configured for WSUS.
- Write down the time and symptom. State whether the failure occurred while scanning, downloading, or installing. Include the time zone and the KB number so an administrator can correlate client and WSUS-server logs.
- For an access-denied error, create readable logs. In an elevated PowerShell window, run
Get-WindowsUpdateLog. Review the resultingWindowsUpdate.logtogether withCBS.log, looking for the file path, folder, or registry object that was denied.
Do not infer that every error beginning with 0x800700 has the same cause. The suffix, failure stage, update source, and log evidence are the decision points.
Protect your data and check prerequisites
Back up important files before making servicing or permission changes. Microsoft places this precaution before its Windows Update troubleshooting steps because an interrupted repair or an incorrect ACL change can create a separate recovery problem.
- Use a stable network connection. If the computer is on a managed network, keep the organization’s proxy and firewall requirements available.
- Sign in with an account that can perform administrative actions. Stopping the Windows Update service and inspecting protected servicing locations may require elevation.
- Set date and time to update automatically. An incorrect clock can make an otherwise valid update appear unusable.
- Check free disk space. Microsoft’s prerequisite guidance specifies at least 16 GB free for a 32-bit upgrade and 20 GB for a 64-bit upgrade. Those figures are upgrade guidance, not a guarantee that every individual update needs that amount.
- Disconnect unnecessary external hardware while troubleshooting. Leave only the keyboard, mouse, display, network equipment, and other hardware required for the update.
Run the built-in Windows Update troubleshooter
- Open Start > Settings > System > Troubleshoot > Other troubleshooters.
- Find Windows Update and select Run.
- Allow the troubleshooter to complete its checks and apply any suggested repair.
- Restart if Windows requests it, then return to Settings > Windows Update and select Check for updates.
The troubleshooter is a low-risk first step for all three suffixes. If the same complete code returns, continue with the branch that matches it instead of repeatedly running the troubleshooter.
Repair 0x8007000d by rebuilding the update cache
0x8007000d commonly indicates invalid update data or corruption in the local update cache. Rebuilding the cache removes downloaded update contents; it does not remove personal files.
- Press
Windows + R, enterservices.msc, and press Enter. - In the Services console, locate Windows Update, right-click it, and choose Stop. Leave the Services window open.
- Open File Explorer and enter
C:WindowsSoftwareDistributionin the address bar. If Windows is installed on another drive, use that installation’sWindowsdirectory. - Delete the contents of
SoftwareDistribution, not the parent folder itself. If a file is locked, confirm that the Windows Update service is stopped and that no management agent is actively using it. - Return to Services, right-click Windows Update, and choose Start.
- Restart the computer, open Windows Update, and select Check for updates. Record whether the same KB now downloads or installs.
If the cache reset changes the code or the failure stage, preserve the new error and logs. A changed symptom is evidence that the original cache contents were involved; it is not proof that permissions or WSUS connectivity are healthy.
Rank #2
- [Win OS Install or reinstall] — Boot from the USB to install or reinstall Win 11, 10, or 7 Home & Pro editions. Includes OS installations and reinstallations media plus WinPE Utility Suite.
- [WinPE Repair & Recovery Tools] — Boot into the included WinPE utility suite to backup system and important files, troubleshoot startup problems, repair boot issues, recover data, recover Win User accounts password, and diagnose common PC problems.
- [All-in-One PC Rescue USB] — Combines Win 11, 10, and 7 installation media with PC repair, recovery, and diagnostic tools on one bootable 64GB USB drive, helping you troubleshoot and restore a computer without needing multiple discs or downloads.
- [Support] — Full instructions are included in packaging plus a printable copy of the instructions with troubleshooting information on the device. Also, a video “How to boot from a bootable USB drive.mp4” to help guide you through starting a PC from a USB drive. If you need help using the USB please contact us for assistance, we are here to help.
- [Video] - If you are new to booting from a USB drive or need a refresher see our video "How to boot from USB drive" both in description and on USB device.
Repair 0x80070005 by tracing the denied object
Microsoft defines 0x80070005 (E_ACCESSDENIED) as an update process that cannot access required files, folders, or registry entries. The denial can come from incorrect TrustedInstaller permissions on %windir%WinSxS or %windir%SoftwareDistribution, incorrect permissions on the Component Based Servicing registry key, missing SYSTEM full control on %windir%, an antivirus or other security lock, or restrictive Group Policy or management software.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use logs to find what was refused
- Run
Get-WindowsUpdateLogin elevated PowerShell to generateWindowsUpdate.log. - Search WindowsUpdate.log and CBS.log around the recorded failure time for access denied, denied, a path under
WinSxSorSoftwareDistribution, or a registry object associated with Component Based Servicing. - Write down the exact object and operation. Do not reset every permission on the computer simply because the top-level error says
0x80070005.
Inspect servicing-folder permissions
- In File Explorer, enter
%windir%WinSxS. Right-click the folder, choose Properties, open the Security tab, and select Advanced. - Repeat the inspection for
%windir%SoftwareDistributionand for%windir%itself if the log names it. - Check that the entries used by Windows servicing, including TrustedInstaller where the log or the folder’s baseline indicates it, are present and have the permissions required for the operation. Verify that the
SYSTEMaccount has full control on%windir%when the log points to that missing right. - Do not take ownership, replace inherited entries, or grant broad rights as a guess. Export or document the existing security configuration first and have an administrator restore the known-good permissions when a baseline is available.
Inspect the Component Based Servicing registry permissions
- Back up the registry or create an approved recovery point before editing permissions.
- Run
regeditas an administrator and locate the Component Based Servicing registry key named in the log. - Use the key’s Permissions dialog to inspect which account was denied and whether the required servicing account still has access.
- Make only the targeted correction approved for your Windows build or organization. A blanket permission replacement can prevent future servicing operations.
Check security software and management controls
Antivirus and other security software can hold a file or registry entry while Windows Update is trying to use it. Group Policy, endpoint-management agents, and hardening tools can also deny access. Review the product’s event log for a block at the same time as the Windows Update failure. If your organization controls the device, ask its administrator to test the policy or create a temporary maintenance exception. Do not leave a protection exception in place after the test, and do not treat a security lock as evidence that the update itself is malicious.
Retry only after the targeted change
Restart Windows, run Check for updates, and compare the new WindowsUpdate.log and CBS.log with the original. If the denied path changes, follow the new path rather than repeating the same ACL edit. If no object is identified, stop changing permissions and investigate the update source and proxy path instead.
Handle 0x80070002 as an installation failure, not an automatic cache diagnosis
For 0x80070002, Microsoft’s general support table labels the condition an update-installation failure. The suffix does not tell you whether the problem is a missing file, a servicing component, a policy, or a connection. Obtain the exact KB, stage, Windows build, and relevant WindowsUpdate.log or CBS.log entries first.
- If the log names a denied file or registry object, use the focused
0x80070005permission workflow. - If the failure occurs while downloading from WSUS, use the WinHTTP and Range-request checks below.
- If the log points to damaged update data, use the
0x8007000dcache procedure. - Do not delete
SoftwareDistributioncontents or change servicing ACLs merely because the short prefix looks familiar.
Check the WSUS path, WinHTTP proxy, and Range support
Windows Update uses WinHTTP and HTTP Range requests when downloading from an on-premises WSUS server. A proxy on this path must support Range requests. A proxy configured for a user’s Internet or Internet Explorer session does not automatically configure the system-level WinHTTP proxy used by Windows Update.
Confirm the system proxy configuration
- Ask the network or WSUS administrator for the required proxy host and port, and confirm that the proxy permits the update traffic and HTTP Range requests.
- Open an elevated Command Prompt if your organization permits local WinHTTP changes.
- To set the system WinHTTP proxy explicitly, use
netsh winhttp set proxy ProxyServerName:PortNumber, replacing the placeholder with the approved server and port. - If the approved design is to copy the Internet proxy configuration into WinHTTP, use
netsh winhttp import proxy source=ie. This imports the configuration; it does not make a user-level proxy automatically apply to WinHTTP. - Retry the update and record whether the failure changes from scan or download to installation. A change in stage helps separate connectivity from servicing faults.
Do not enter a guessed proxy, bypass organizational authentication, or copy a home-network setting onto a managed computer. An incorrect WinHTTP proxy can make a healthy WSUS server appear unreachable.
Rank #3
- Comprehensive Solution: This Windows 10 reinstall DVD provides a complete solution for resolving various system issues, including crashes, malware infections, boot failures, and performance slowdowns. Repair, Recover, Restore, and Reinstall any version of Windows.
- USB will work on any type of computer (make or model). Creates a new copy of Windows! DOES NOT INCLUDE product key.
- Windows not starting up? NT Loader missing? Repair Windows Boot Manager (BOOTMGR), NTLDR, and so much more with this DVD. Clean Installation: Allows you to perform a fresh installation of Windows 11 64-bit, effectively wiping the system and starting from a clean slate.
- Step by Step instructions on how to fix Windows 10 issues. Whether it be broken, viruses, running slow, or corrupted our disc will serve you well
- Please remember that this DVD does not come with a KEY CODE. You will need to obtain a Windows Key Code in order to use the reinstall option
Use the failure stage to narrow the path
| Observed stage | Evidence to examine | Likely next check |
|---|---|---|
| Scan or detection | Update source in client diagnostics, policy, and management-agent status | Confirm that the client is pointed to the intended WSUS server rather than an unintended source |
| Download | WinHTTP proxy, HTTP Range behavior, network and WSUS logs | Correct the system proxy and verify Range-request support |
| Install | CBS.log, WindowsUpdate.log, exact KB, permissions, and servicing components | Follow the suffix-specific cache or access-denied workflow |
Confirm that the client is using the intended update source
Windows Update client diagnostics identify Windows Server Update Service when WSUS is configured. If diagnostics show a different source, repeated cache resets will not correct the policy mismatch.
- Compare the source shown by diagnostics with the organization’s intended design.
- Review the applicable Windows Update policy and management-agent configuration with the administrator responsible for the device.
- Correct the policy or management configuration if the source is wrong, then allow policy processing to complete.
- Only after the source is correct should you repeat a cache reset or retry the failed KB.
A device can legitimately use Microsoft Update instead of WSUS, but the repair instructions and proxy path differ. Record which source was active for the failed attempt rather than assuming the presence of a WSUS server means the client used it.
Use servicing checks when the logs point to component corruption
If CBS.log identifies damaged Windows servicing components rather than a denied path or a proxy failure, run the standard servicing integrity checks from an elevated Command Prompt. Run DISM first, then System File Checker:
- Open Start, search for Command Prompt, right-click it, and choose Run as administrator.
- Run
DISM /Online /Cleanup-Image /RestoreHealthand wait for it to finish. - Run
sfc /scannowand wait for verification to reach 100 percent. - Restart Windows and retry the specific KB. Preserve the command output with the update logs.
These checks are appropriate when servicing evidence points to component or system-file damage. They are not a replacement for correcting a denied ACL, a wrong WSUS policy, or a proxy that cannot handle Range requests.
Retry, restart, and document the result
- After the relevant repair, open Settings > Windows Update and select Check for updates.
- Retry the same KB rather than several unrelated updates, so the result remains diagnosable.
- When Windows offers Update and restart or Update and shut down, use that option and allow the device to complete the restart.
- Record the final code, stage, KB result, and the repair that preceded it.
If the error returns, compare the new evidence with the original instead of repeating every procedure. A persistent scan failure points toward source or policy configuration; a persistent download failure points toward WinHTTP, proxy, WSUS, or Range handling; a persistent installation failure points toward the KB, CBS, or permissions. Provide the administrator with the complete code, build, source, timestamps, WindowsUpdate.log, CBS.log, and any proxy or policy findings.
Quick Recap
As an optional shortcut after the manual checks, Outbyte PC Repair can address more than 100 common Windows issues where possible, including broken system elements and shared DLL problems, while also offering settings tweaks, temporary-file cleanup, vulnerability checks, and crash logging. It runs on Windows 11, 10, 8, and 7; its free trial is offered by category for at least two days before a paid subscription. It complements antivirus software rather than replacing it, results vary, and no tool repairs every crash.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
