Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →“0x800700” is not a complete Windows Server Update Services (WSUS) error. Capture all digits from Windows Update, WindowsUpdate.log, CBS.log, or Event Viewer before changing anything. The two commonly documented WSUS variants are 0x80070002 (a required file is missing) and 0x80070005 (access denied). Their repair paths differ: investigate the update store and component files for 0x80070002; investigate permissions, security software, and policy for 0x80070005. Work from the least-invasive checks toward registry or access-control changes, and test the client after each stage.
First, identify the complete code and failure phase
A hexadecimal prefix alone cannot identify the fault. On the affected client, record the complete value, the time it occurred, and whether Windows Update failed while scanning for approvals, downloading content, or installing and servicing a package. The phase determines whether to start with WSUS connectivity, the local update cache, or component servicing.
As an Amazon Associate I earn from qualifying purchases.
Where to collect evidence
- Windows Update history or the error dialog: copy the full code, including every digit after
0x800700. - WindowsUpdate.log: review entries around the failure timestamp for the update ID, URL, missing file, or access-denied message.
- CBS.log: inspect
C:WindowsLogsCBSCBS.logwhen installation or component servicing fails. It can identify a package or component that is missing or corrupt. - Event Viewer: open Applications and Services Logs > Microsoft > Windows > WindowsUpdateClient > Operational. Filter around the recorded time and save the relevant event details.
Do not treat a generic 0x800700 message as proof of one cause. Microsoft also lists 0x8007000d for update-file or cache corruption and groups 0x80070002, 0x80070003, and 0x80070057 with update-installation failures; the final digits determine which branch is appropriate.
What 0x80070002 and 0x80070005 mean
| Complete code | Meaning | Typical WSUS/Windows Update causes | Start with |
|---|---|---|---|
0x80070002 |
ERROR_FILE_NOT_FOUND — a file expected by the update process cannot be found. |
Missing or corrupt update files, an incomplete earlier update, a missing DLL, or a registry/service reference to a file that no longer exists. | Restart, run the available Windows Update troubleshooter, then rebuild the local SoftwareDistribution store and inspect CBS/Windows Update logs. |
0x80070005 |
E_ACCESSDENIED — the update process cannot access a required file, folder, or registry entry. |
Incorrect ACLs on %windir%, WinSxS, or SoftwareDistribution; denied servicing-registry access; endpoint security locks; or restrictive Group Policy and management agents. |
Verify elevation and SYSTEM/TrustedInstaller access, then check security software and policy before considering ACL repair. |
The same code can appear on one client or across many. One failing computer usually points to its local cache, identity, permissions, or component store. A broad failure across a site suggests WSUS availability, policy, proxy, or server-side trouble and should be investigated centrally rather than repaired identically on every machine.
#1 Best Overall
Run the common WSUS client checks
1. Confirm policy and name resolution
Open an elevated Command Prompt and generate the applied Group Policy result:
GPRESULT /VConfirm that the expected WSUS policy is present and that the configured intranet update service URL and port match your organization’s server. A policy can be present in the editor but not applied to the computer because of scope, filtering, or a conflicting policy. If you recently changed policy, refresh it before testing:
gpupdate /forceFrom the client, test name resolution and HTTP reachability to the WSUS server. Replace the placeholder with your actual server name and port:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorshttp://<WSUSSERVER:port>/iuident.cabA failure here indicates DNS, routing, proxy, firewall, or server-listening trouble, not a damaged update cache. Resolve that connection problem first; otherwise a cache reset will not make the client scan.
2. Verify the update services
Open services.msc and check that Windows Update (wuauserv) and Background Intelligent Transfer Service (BITS) can start. BITS transfers update content between WSUS and clients. If either service stops immediately, use the Event Viewer entries and the service’s dependency information to find the cause instead of repeatedly clicking Start.
You can also check from an elevated prompt:
sc query wuauserv
sc query bitsRecord the reported state and any service-control error. Do not delete service registry keys as a first response; that can make a recoverable configuration problem harder to repair.
3. Check for an imaged or cloned client identity
Disk-imaged computers can retain the same WSUS SUSclientID. Clients with duplicate identities overwrite one another’s reporting data, so only one device may appear in the WSUS console even though several are contacting the server. If the symptom is “the client is missing from the console,” appears and disappears, or reports under another computer’s name, investigate imaging and registration before changing permissions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Repair 0x80070002 (missing file)
1. Restart and run the available troubleshooter
Restart the computer to clear a pending reboot and release files held by a previous update. Then run the Windows Update troubleshooter from the Windows Settings troubleshooting area when it is available for that edition. Apply only repairs it reports, restart if requested, and reproduce the same scan or installation while noting the new timestamp.
2. Rebuild the local update data store
A damaged or incomplete cache can leave Windows Update looking for files that are no longer present. Renaming the store is narrower and more reversible than deleting registry data. Use an elevated Command Prompt:
- Stop Windows Update:
net stop wuauserv - Rename the store (the example keeps the old data for rollback):
ren C:WindowsSoftwareDistribution SoftwareDistribution.old - Start Windows Update again:
net start wuauserv - Trigger a new detection from the Windows Update interface, or use the organization’s normal detection schedule. Watch the WindowsUpdateClient Operational log for the new scan.
Windows creates a fresh SoftwareDistribution directory. The first scan may take longer because metadata and downloaded content must be rebuilt. Keep the renamed directory until the client completes a successful scan and installation; remove it later only under your normal change-control process and after confirming no rollback is needed.
3. Identify the missing package or component
If the error returns, search WindowsUpdate.log and CBS.log for the exact filename, package identity, or component-store message at the failure time. A missing DLL, an incomplete previous update, and a broken service or registry reference require different repairs. Do not substitute a DLL downloaded from an untrusted site.
When the logs indicate component corruption, use the DISM repair source and servicing procedure appropriate to that Windows version and edition. There is no single universal DISM command or source that fits every release: an online source, mounted installation media, or a matching repair image may be required. Confirm that the source’s build and language match the installed operating system, and follow the servicing guidance for that version. Reboot after servicing, then run a fresh WSUS detection.
Repair 0x80070005 (access denied)
1. Work from an elevated account
Open Command Prompt or PowerShell with Run as administrator. A non-elevated shell can produce access-denied results even when the underlying ACLs are correct. Verify that the local SYSTEM and TrustedInstaller identities retain their expected rights on:
%windir%(normallyC:Windows)%windir%WinSxS%windir%SoftwareDistributionHKLMSOFTWAREMicrosoftWindowsCurrentVersionComponent Based Servicing
Compare permissions with a known-good computer running the same Windows edition and servicing level. Avoid replacing an entire ACL with permissions copied from a different build; servicing folders contain protected entries that ordinary users should not own.
2. Look for locks and policy restrictions
Temporarily managed endpoint protection, antivirus, ransomware protection, or another security agent can hold update files or deny writes. Review that product’s audit or quarantine log and your organization’s change procedure before testing an approved exclusion or maintenance window. Do not permanently disable protection on a production computer merely to make an update pass.
Free tools Windows power users keep installed
One-click scans. No signup required.
Also review Group Policy and management agents for rules that restrict Windows Update, service starts, registry writes, or access to the servicing directories. If the denial occurs only when a management task runs, the policy or agent is a stronger suspect than the local cache.
3. Reset ACLs only with a backup and change approval
Microsoft documents permission-reset examples for the Windows servicing directories. They are broad, recursive changes and can affect a functioning installation. Before using them, create an OS recovery path, record current permissions, and obtain the required change approval. In an elevated prompt, the documented examples are:
icacls "%windir%WinSxS" /reset /t /c /q
icacls "%windir%SoftwareDistribution" /reset /t /c /qRestart after the reset and test the same update. If WinSxS ownership is wrong, Microsoft’s servicing guidance describes restoring the owner to NT SERVICETrustedInstaller. Changing ownership or ACLs by hand can make servicing worse if a path is mistyped, so stop and escalate to an administrator who can restore from the recorded state if the machine becomes unstable.
4. Use offline servicing when online repair cannot access components
If logs show that online servicing cannot read or repair the component store, use an offline DISM /RestoreHealth procedure with a matching installation source for the installed build. The correct drive letter, image index, source files, and servicing syntax vary by Windows version. Confirm each value from the installation media and the DISM output rather than pasting a command intended for another release. Restart and repeat detection after DISM completes.
Reset and re-register a WSUS client
Use a client reset when the update store or registration is damaged, or when a duplicate identity must be removed. This sequence deletes selected Windows Update registry values; it does not erase the whole Windows Update key. Back up the registry and ensure you have a recovery plan before proceeding.
Best Value
- Open an elevated Command Prompt.
- Stop Windows Update.
- Delete the registration values shown below.
- Start Windows Update.
- Reset authorization and trigger detection.
net stop wuauserv
reg Delete HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate /v PingID /f
reg Delete HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate /v AccountDomainSid /f
reg Delete HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate /v SusClientId /f
reg Delete HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate /v SusClientIDValidation /f
net start wuauserv
wuauclt.exe /resetauthorization /detectnow“The system was unable to find the specified registry key or value” is expected when one of these values is already absent. It is not, by itself, evidence that the reset failed. After the command completes, review the WindowsUpdateClient Operational log and WindowsUpdate.log for a new identity, successful contact with the WSUS URL, and a completed detection.
Ordinary re-registration without deleting values
For a normal policy refresh, first apply policy and then request detection:
gpupdate /force
wuauclt /detectnowUse wuauclt.exe /resetauthorization /detectnow only when authorization genuinely needs to be reset. Repeated resets can obscure whether the actual problem is policy, network reachability, permissions, or the WSUS server.
Choose the narrowest repair for the symptom
| Observed symptom | Most useful first action | Why | Escalate when |
|---|---|---|---|
| Scan cannot contact WSUS | Run GPRESULT /V, verify the WSUS URL, and test iuident.cab. |
Policy, DNS, proxy, firewall, or server reachability must work before local repairs matter. | Several clients fail the same reachability test or the server does not respond. |
| 0x80070002 during download or installation | Rename SoftwareDistribution, then inspect WindowsUpdate.log and CBS.log. |
It refreshes the local metadata/content store without immediately altering registry registration. | Logs identify component corruption, a missing package, or a recurring servicing failure. |
| 0x80070005 during servicing | Verify elevation, SYSTEM/TrustedInstaller access, security locks, and policy. | Access-denied errors are permission or interference problems, not normally solved by deleting cache data. | ACLs or ownership are wrong, or online servicing cannot repair the component store. |
| Client missing or duplicated in WSUS | Investigate cloned SUSclientID and perform the documented registration reset on the affected image. |
Duplicate identity causes clients to overwrite reporting records. | Multiple clients remain absent after unique registration and successful detection. |
| Many clients fail at once | Check WSUS health, policy scope, proxy/firewall changes, and server logs. | A fleet-wide pattern is unlikely to be an isolated cache or ACL error. | Server synchronization, database, IIS, or approval problems are found. |
Use the table as a decision aid, not a reason to run every command. Registry deletion and recursive ACL resets carry more risk than a cache rename, so reserve them for evidence that the narrower step did not address.
Verify the repair and document the result
- Restart if a troubleshooter, servicing operation, ACL change, or update requested it.
- Confirm
wuauservand BITS start normally. - Run
gpupdate /forcewhen policy was changed, then verify the expected WSUS URL withGPRESULT /V. - Trigger one detection and record its start and completion times.
- Check the WindowsUpdateClient Operational log for a successful scan, download, and installation result.
- Confirm the computer reports once, under the correct name, in the WSUS console.
- Keep the renamed cache, registry backup, permission export, and logs according to your change-control and retention policy until the update has been verified.
If the same full code returns after these checks, preserve the logs rather than repeatedly resetting the client. Include the Windows version and build, WSUS policy output, exact failure phase, timestamps, service states, reachability test, and any CBS package name when escalating to the WSUS or Windows servicing administrator. That evidence distinguishes a local repair from a server, policy, or image-design problem.
Quick Recap
As an optional shortcut after the manual checks, Outbyte PC Repair can address some common Windows issues, clean temporary and cache files, check settings and missing updates, and provide an app-crash log. It runs on Windows 11, 10, 8 and 7 and offers a free trial by category for at least two days before a subscription; results vary, it does not repair every crash, and it complements rather than replaces antivirus protection.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
