Error 0x80070005 (Access Denied): Where It Comes From and Four Fixes

5 Aug 2026

Windows Update downloads a package, begins preparing it and then stops with:

0x80070005

You may also see:

Access is denied
E_ACCESSDENIED
Installation failed
Some update files are missing or have problems
We couldn’t complete the updates

The wording sounds as though your Windows account simply needs administrator rights. Sometimes that is relevant, but Windows Update normally performs its work through protected system services such as TrustedInstaller and the SYSTEM account.

Error 0x80070005 usually means one of those processes attempted to access a required file, folder or Registry entry and Windows refused the operation. Microsoft identifies incorrect permissions affecting the Windows component store, SoftwareDistribution folder or associated system resources as the typical cause.

The four main fixes are:

Restore the required Windows Update permissions.
Rebuild the Windows Update download and catalogue folders.
Repair the Windows component store and system files.
Isolate antivirus, security and management software interference.

Do not start by taking ownership of every Windows folder or granting your user account full control. Windows servicing depends on carefully assigned permissions, and broad changes can create more problems than they solve.

What Does 0x80070005 Mean?

The full Windows result is:

0x80070005

E_ACCESSDENIED

It means that a process was denied access to something it needed.

For Windows Update, that “something” could be:

A file inside C:\Windows\WinSxS
The Windows Update download database
A package inside SoftwareDistribution
A component-servicing Registry key
A temporary installation file
A folder locked by security software
A system location restricted by Group Policy
A file whose ownership or access control list has been changed

Microsoft’s current Windows Update guidance lists several common causes: incorrect permissions for TrustedInstaller, unsuitable permissions on component-servicing Registry entries, security software locking update content, insufficient SYSTEM permissions and organisational policies restricting access to Windows directories.

The Same Code Can Appear Elsewhere

0x80070005 is not exclusive to Windows Update.

It may also appear when:

An application cannot use the camera because privacy access is disabled
OneDrive cannot install or access required locations
Windows or Microsoft 365 activation cannot complete
A virtual machine cannot read its virtual disk
An installer cannot write to a protected folder
A service cannot access its Registry configuration

For example, Microsoft associates camera error 0x80070005 with denied camera access in the relevant Windows privacy settings.

This means the context matters. The four fixes below are designed primarily for Windows Update failures. Do not reset Windows Update because one application lacks permission to use your webcam.

First: Record the Failed Update

Open:

Settings > Windows Update > Update history

Find the failed update and record:

Its KB number
Installation date
Error code
Whether it is a cumulative, feature or driver update
How far the installation progressed
Whether the failure occurred before or after restarting

Press:

Windows key + R

Enter:

winver

Record the Windows version and complete OS build.

A useful support record might look like:

Windows 11 Pro

Version: 25H2

OS build: 26200.xxxxx

Failed update: KB50xxxxx

Error: 0x80070005

Failure stage: Installing at 74%

This helps distinguish one damaged package from a wider Windows servicing problem.

Check What Windows Was Denied Access To

The error code describes the result, but the servicing logs may reveal the affected object.

Windows Update activity can be investigated using:

C:\Windows\Logs\CBS\CBS.log

You can also generate a readable Windows Update log by opening PowerShell as administrator and running:

Get-WindowsUpdateLog

Search the generated log and recent CBS entries for:

0x80070005

Microsoft provides examples in which CBS reports that it failed to create a file or internally open a package because access was denied.

Look for references to:

WinSxS
SoftwareDistribution
Component Based Servicing
A particular Registry key
A third-party security product
A file-system filter driver

Do not change permissions on a random folder merely because its name appeared somewhere in the log. Identify the actual failure at the matching update timestamp.

Before Applying the Fixes

Before repairing permissions or Windows servicing:

Back up important files.
Confirm that the backup opens.
Save the BitLocker recovery key.
Connect the computer to reliable mains power.
Restart Windows.
Check that adequate free storage is available.
Confirm whether the PC is managed by an employer.
Record any third-party security, backup or encryption software.

Microsoft’s dedicated guidance recommends backing up the operating-system disk before troubleshooting this particular error.

On a business-managed computer, Group Policy, Microsoft Intune, Windows Autopatch, endpoint protection or another management agent may intentionally control update access. Local changes may be replaced automatically or cause the device to fall out of compliance.

Fix One: Restore Windows Update Permissions

Use this fix when the logs indicate denied access to:

C:\Windows\WinSxS

or:

C:\Windows\SoftwareDistribution

WinSxS is the protected Windows component store. It contains files and package information used to install, repair and service Windows.

SoftwareDistribution holds Windows Update downloads, metadata and temporary servicing information.

Reset the folder permissions

Open Terminal or Command Prompt as administrator.

Run:

icacls "%windir%\WinSxS" /reset /t /c /q

Then run:

icacls "%windir%\SoftwareDistribution" /reset /t /c /q

These are Microsoft’s current documented commands for resetting default access-control entries on the two Windows Update locations when troubleshooting 0x80070005.

The operation may take time because WinSxS contains a large number of files and folders.

The command options mean:

/reset restores inherited default access-control entries.
/t processes subfolders and files.
/c continues when individual errors occur.
/q reduces normal output.

Restart Windows when both commands finish, then retry the update once.

Restore TrustedInstaller ownership

If the update still fails and the logs continue to indicate WinSxS ownership problems, open an elevated Command Prompt and run:

icacls "%windir%\WinSxS" /setowner "NT SERVICE\TrustedInstaller" /t /c /q

Microsoft specifically documents TrustedInstaller as the correct owner for the component store in this troubleshooting process.

Restart and test Windows Update again.

What not to do

Do not:

Make your personal account the permanent WinSxS owner.
Grant “Everyone” full control of Windows.
Delete files from WinSxS.
Disable permission inheritance across C:\Windows.
Use a general “take ownership” script.
Apply Registry permissions copied from an unrelated computer.

TrustedInstaller ownership protects Windows components from accidental modification and unauthorised software.

Fix Two: Rebuild the Windows Update Components

If the permissions are correct but Windows Update’s working folders are damaged, rebuilding them can remove corrupted downloads and force Windows to create fresh update databases.

This does not uninstall updates already present in the operating system.

Stop the update services

Open Command Prompt as administrator and run:

net stop wuauserv

net stop bits

net stop cryptSvc

These commands stop:

Windows Update
Background Intelligent Transfer Service
Cryptographic Services

Rename the working folders

Run:

ren %windir%\SoftwareDistribution SoftwareDistribution.old

ren %windir%\System32\catroot2 catroot2.old

Renaming rather than immediately deleting the folders provides a temporary fallback while Windows creates replacements.

Restart the services

Run:

net start cryptSvc

net start bits

net start wuauserv

Restart the computer and check for updates again.

Microsoft includes this exact reset sequence in its dedicated 0x80070005 resolution process.

What to expect afterwards

Windows may need to:

Rebuild its update database
Download the package again
Recalculate which updates apply
Recreate cryptographic catalogue information
Repopulate parts of Update history

The visible history page may temporarily contain less information, but this does not mean installed Windows updates have been removed.

Keep the .old folders until the update has installed and the computer has restarted successfully. An experienced technician can remove them later when they are no longer required.

Fix Three: Repair Windows Components and System Files

Incorrect permissions may have prevented Windows from servicing its component store correctly. Damaged servicing files can then cause the error to continue even after folder permissions have been restored.

Run DISM first, followed by System File Checker.

Repair the component store

Open Terminal or Command Prompt as administrator and run:

DISM.exe /Online /Cleanup-Image /RestoreHealth

DISM checks the active Windows image and attempts to repair damaged component-store files. By default, it may use Windows Update as its repair source.

Allow the process to reach completion.

Do not close the terminal simply because the displayed percentage remains unchanged for several minutes.

Check protected system files

After DISM finishes, run:

sfc /scannow

System File Checker compares protected Windows files with their trusted component-store copies and replaces damaged files where possible.

Microsoft recommends DISM and SFC as consecutive stages in its current resolution sequence for 0x80070005.

Restart Windows after both commands finish.

Interpreting the results

DISM completed successfully

Run SFC, restart and retry Windows Update.

DISM could not find the source files

Windows may need:

A matching Windows installation image
Access to Microsoft Update
A network repair source
A repair installation

Do not use an ISO belonging to a different Windows language, architecture or release without confirming compatibility.

SFC found and repaired corrupt files

Restart before retrying the update.

SFC found files it could not repair

Further CBS.log analysis or a repair reinstall may be required.

Repair-reinstall Windows 11

When servicing corruption continues, open:

Settings > System > Recovery

Under Fix problems using Windows Update, select:

Reinstall now

This reinstalls the same Windows version and repairs system files and components while preserving applications, personal files and settings. Microsoft notes that the option can be unavailable on devices whose updates are controlled by an organisation.

Keep the computer connected to power and the internet throughout the process.

Fix Four: Isolate Security and Management Software

Antivirus, backup, encryption and endpoint-management products operate deeply within Windows. Some install file-system filter drivers that inspect, redirect or block access to files before another process can use them.

If a security product locks an update file or prevents TrustedInstaller from writing to a protected location, Windows Update may return 0x80070005. Microsoft explicitly lists third-party antivirus and security tools among the potential causes.

Perform a clean boot

Press:

Windows key + R

Enter:

msconfig

Then:

Open the Services tab.
Select Hide all Microsoft services.
Select Disable all.
Select Apply.
Open the Startup tab.
Select Open Task Manager.
Disable enabled startup applications.
Close Task Manager.
Select OK.
Restart Windows.
Retry the update.

Always select Hide all Microsoft services before disabling services.

Microsoft describes a clean boot as a supported way to determine whether another application or service is preventing an update or application installation. The computer may temporarily lose some functionality while it remains in that state.

If the update works

One of the disabled services or applications was probably interfering.

Restore services in groups, restarting and testing between changes, until the responsible product is identified.

Common categories include:

Third-party antivirus
Endpoint detection and response
Backup snapshot software
Disk encryption
VPN clients
Application-control products
File synchronisation
Disk-management utilities
Legacy system optimisation tools

Update, reconfigure or replace the responsible software rather than leaving it permanently disabled.

If the update still fails

Restore normal startup. The error is unlikely to be caused by an ordinary startup service or application.

Check filter drivers

Microsoft’s advanced guidance also suggests listing file-system filter drivers with:

fltmc

Non-Microsoft filter drivers may belong to security, backup, encryption or storage software. Microsoft documents temporarily unloading an identified non-Microsoft driver with:

fltmc unload <DriverName>

However, this is an advanced diagnostic step. Unloading the wrong filter can disrupt protection, storage access, backup or encryption. It should normally be handled by an experienced IT engineer, particularly on a business device.

Run the Windows Update Troubleshooter

Before or between the four main fixes, run Microsoft’s automated troubleshooter.

Open:

Settings > System > Troubleshoot > Other troubleshooters

Select Run beside Windows Update.

On current Windows 11 installations, Microsoft recommends beginning with the troubleshooter in the Get Help application. Restart the computer when it finishes and check for updates again.

The troubleshooter may correct common service and update-database problems, but it may not repair a highly specific permission entry. Record what it reports.

Could Group Policy Be Causing It?

On company computers, access may be restricted by:

Microsoft Intune
Group Policy
Windows Autopatch
WSUS
Endpoint security
Application control
Privileged-access software
Remote monitoring and management tools

Microsoft’s 0x80070005 documentation identifies Group Policy and management agents restricting write access to system directories as possible causes.

Signs that management is involved include:

“Some settings are managed by your organisation”
Windows Update controls being unavailable
Local settings changing back after restarting
The same failure affecting several company computers
Security software blocking permission changes
The PC using a business update server

Do not remove company policies or management agents locally. The correct fix may need to be deployed centrally across every affected device.

Why Administrator Rights Alone May Not Fix It

Signing in with an administrator account does not automatically grant unrestricted access to every Windows component.

Protected servicing locations may specifically require:

TrustedInstaller
SYSTEM
A Windows servicing service
A particular service security identifier

An ordinary administrator can authorise elevated commands, but the update still depends on the correct system accounts and permissions.

This is why repeatedly selecting Run as administrator may not solve the problem when TrustedInstaller ownership or SYSTEM access has been altered.

When the Error Is Not Coming From Windows Update

Use the context to choose the appropriate repair.

Camera

Open:

Settings > Privacy & security > Camera

Check:

Camera access
Let apps access your camera
Let desktop apps access your camera

Microsoft associates 0x80070005 in camera applications with denied camera permissions.

OneDrive

An OneDrive 0x80070005 error may involve installation, folder access, organisational policy or permissions affecting its synchronisation location. It requires OneDrive-specific investigation rather than resetting WinSxS.

Application installation

Check whether:

The installer was launched from a protected network location.
The user has permission to install software.
Security software blocked the installer.
The destination folder has modified permissions.
The application is controlled by company policy.

Activation

Activation-related 0x80070005 should be investigated through Windows or Microsoft 365 activation tools. Changing Windows Update folder permissions may be irrelevant.

Common Mistakes to Avoid

Granting Everyone Full Control

This weakens security and can create unsupported permission structures.

Taking Permanent Ownership of WinSxS

The component store should normally remain owned by TrustedInstaller.

Deleting SoftwareDistribution While Services Are Running

Files may be locked, and the update database may not reset correctly.

Deleting WinSxS

WinSxS is not a disposable update cache. Manual deletion can damage Windows servicing and startup.

Disabling Antivirus Permanently

Use a controlled clean-boot or vendor-approved troubleshooting process, then restore protection promptly.

Editing Registry Permissions Without Log Evidence

A general access-denied error does not identify one universal Registry key.

Running Random “Windows Repair” Scripts

Scripts may change services, permissions and policies without documenting what they altered.

Applying Windows Update Repairs to an App-Specific Error

The same code can represent denied camera, OneDrive, activation, virtual-machine or application access.

A Practical 0x80070005 Checklist

When Windows Update reports Access Denied:

Record the failed KB and installation time.
Run winver.
Back up important files.
Save the BitLocker recovery key.
Restart Windows.
Run the Windows Update troubleshooter.
Check whether the PC is organisation-managed.
Review CBS.log and WindowsUpdate.log.
Identify which file, folder or Registry key was denied.
Reset WinSxS and SoftwareDistribution permissions where appropriate.
Restore TrustedInstaller ownership to WinSxS.
Restart and test.
Rebuild SoftwareDistribution and catroot2.
Restart and test again.
Run DISM.
Run SFC.
Perform a clean boot.
Review third-party security and filter drivers.
Restore normal startup after testing.
Use the Windows repair-reinstall option if servicing remains damaged.
Escalate managed business devices to the IT provider.

How Hamilton Group Can Help

Error 0x80070005 is rarely solved well by guessing.

The important question is:

Which process was denied access to which resource—and why?

Hamilton Group’s experienced IT team can help with:

Windows Update Analysis

We can review:

Failed KB numbers
Windows builds
CBS logs
Windows Update logs
Servicing-stack errors
TrustedInstaller activity
Installation timestamps

Permission Repair

Where permissions have been changed, we can restore appropriate ownership and access for:

WinSxS
SoftwareDistribution
Component-servicing Registry entries
Windows Update services
SYSTEM and TrustedInstaller

Security-Software Investigation

Hamilton Group can identify whether the error is being caused by:

Endpoint protection
Antivirus
Backup filter drivers
Encryption software
Application control
VPN or management agents

Microsoft Intune and Group Policy

For managed organisations, we can determine whether the problem is linked to:

Update policies
Deployment rings
Security baselines
Endpoint restrictions
WSUS configuration
Microsoft Intune
Windows Autopatch

Windows Servicing Repair

Where access problems have damaged Windows, we can perform:

Windows Update component resets
DISM repairs
System File Checker
Repair reinstalls
Controlled update recovery

Hamilton Group aims to make first contact on IT support requests within 15 minutes, helping businesses restore Windows updating before failed security patches create a larger risk.

Access Denied to What?

Error 0x80070005 does not simply mean that you need to sign in as an administrator.

For Windows Update, it usually means the servicing process cannot access a protected file, folder or Registry entry because permissions, ownership, security software or management policy are blocking it.

The correct order is:

Identify the denied resource, restore the proper Windows permissions, rebuild the update components, repair Windows and isolate third-party interference.

Call 0330 043 0069, book a meeting with one of our experts or visit hgmssp.com for experienced help with Windows Update errors, servicing permissions and business patch management.

Previous Next