Windows Update error 0x80070005 (access denied): how to fix it

Published Sources checked By helps.wiki editorial team

0x80070005 is E_ACCESSDENIED: the update process tried to change a file, folder or registry key and Windows refused. Running the Windows Update troubleshooter and clearing the update cache fixes most cases; if it keeps coming back, Microsoft's fix is to reset permissions on the component store folders.

Applies to:Windows 11all supported versionsWindows 1022H2Windows Server2016 and later
On this page

What it means

The code 0x80070005 is Windows' generic "access denied" error, E_ACCESSDENIED. During an update it means the servicing stack, the part of Windows that installs updates, needed to write to something and did not have permission. That something is usually inside C:\Windows\WinSxS (the component store), C:\Windows\SoftwareDistribution (where updates are downloaded), or the registry key that tracks installed packages.

Microsoft lists the usual reasons: permissions on those folders or keys were changed, the TrustedInstaller account no longer owns them, a third-party antivirus or security tool locked the files, or a policy or management agent restricts writes to system folders. Your personal files are not at risk from the error itself; the update simply cannot finish.

Symptoms and causes

You are likely dealing with this problem if:

  • Settings > Windows Update shows Install error - 0x80070005 for a cumulative update, a .NET update or a feature update.
  • The same update fails again after every restart.
  • C:\Windows\Logs\CBS\CBS.log contains lines such as Failed to create file. [HRESULT = 0x80070005 - E_ACCESSDENIED].

The usual causes, most common first:

A temporary lock or stale download
A half-finished download in the update cache, or a file held open by another process, can trigger the error once. Clearing the cache usually helps.
Antivirus or security software
Third-party real-time protection and file system filter drivers can block the servicing stack from writing to Windows folders.
Changed permissions on system folders
Cleanup tools, manual ownership changes or migrations can leave WinSxS or SoftwareDistribution without the permissions TrustedInstaller needs.
Standard user account
Installing updates needs administrator rights; on managed PCs a policy may also limit who can install.

How to fix it

Work through these in order. They start with the quickest, safest checks and move to deeper repairs; stop as soon as the problem is gone.

1.Run the Windows Update troubleshooter

Easy

It checks the update services and resets common problems automatically, which is often enough after a one-off failure.

  1. On Windows 11, open Start > Settings > System > Troubleshoot > Other troubleshooters, find Windows Update and select Run. Newer builds open the same check in the Get Help app.
  2. On Windows 10, open Start > Settings > Update & Security > Troubleshoot > Additional troubleshooters, select Windows Update and then Run the troubleshooter.
  3. Apply any fixes it suggests, restart the PC and select Check for updates again.

2.Check the account, free space and date

Easy

Access errors also appear when the account lacks administrator rights, and updates fail for unrelated reasons when the disk is nearly full or the clock is wrong.

  1. Make sure you are signed in with an administrator account. In Settings > Accounts > Your info it should say Administrator.
  2. Keep at least 20 GB free on the system drive for a 64-bit Windows (Microsoft's guidance for updates).
  3. In Settings > Time & language > Date & time, turn on Set time automatically and select Sync now.
  4. Unplug external drives and docks you do not need, then try the update again.

3.Reset the Windows Update components

ModerateChanges settings

Renaming the download cache and the catalog folder makes Windows download the update again from scratch, which removes a damaged or locked download.

Before you start: Your update history list in Settings will look empty afterwards; installed updates are not removed. Close other programs first.

  1. Select Start, type cmd, right-click Command Prompt and choose Run as administrator.
  2. Stop the update services, rename the two folders, and start the services again:
    Command Promptrun as administrator
    net stop wuauserv
net stop bits
net stop cryptSvc
ren %windir%\SoftwareDistribution SoftwareDistribution.old
ren %windir%\System32\catroot2 catroot2.old
net start cryptSvc
net start bits
net start wuauserv
  3. Restart the PC and run Check for updates. If a ren command says access is denied, a service is still running: run the matching net stop command again.

4.Repair the component store with DISM and SFC

Moderate

If system files the update depends on are damaged, DISM repairs the component store from Windows Update and SFC then fixes protected system files.

  1. In an administrator Command Prompt, run DISM first and wait for it to reach 100% (it can sit at one percentage for a while):
    Command Promptrun as administrator
    DISM /Online /Cleanup-Image /RestoreHealth
  2. Then check the system files:
    Command Promptrun as administrator
    sfc /scannow
  3. Restart and try the update again.

5.Reset permissions on WinSxS and SoftwareDistribution

AdvancedBack up first

This is Microsoft's documented fix when the error keeps returning: it restores the default permissions that TrustedInstaller needs and makes TrustedInstaller the owner of WinSxS again.

Before you start: These commands change permissions on core Windows folders. Create a restore point or a full backup of the system drive first, type the commands exactly as shown, and do not run them on other folders.

  1. Create a restore point: search the Start menu for Create a restore point, select your system drive and choose Create.
  2. In an administrator Command Prompt, reset the default permissions on both folders (this can take several minutes):
    Command Promptrun as administrator
    icacls "%windir%\WinSxS" /reset /t /c /q
icacls "%windir%\SoftwareDistribution" /reset /t /c /q
  3. Make TrustedInstaller the owner of the component store again:
    Command Promptrun as administrator
    icacls "%windir%\WinSxS" /setowner "NT SERVICE\TrustedInstaller" /t /c /q
  4. Restart the PC and install the update again.

6.Rule out antivirus and filter drivers

AdvancedChanges settings

Microsoft names third-party security tools as a cause: their file system filter drivers can block writes to Windows folders.

Before you start: Only pause a third-party antivirus for the time it takes to install the update, and turn it back on right after. Do not turn off Microsoft Defender as a fix.

  1. Pause real-time protection in your third-party antivirus, or uninstall it temporarily with its vendor's removal tool. When no other antivirus is installed, Microsoft Defender Antivirus switches itself back on.
  2. To see which file system filter drivers are loaded, run this in an administrator Command Prompt. Names such as WdFilter and FileInfo belong to Windows; others usually belong to security or backup software:
    Command Promptrun as administrator
    fltmc
  3. Try the update. If it installs, turn protection back on and report the conflict to the antivirus vendor.
  4. If you cannot pause the software, a clean boot starts Windows with third-party services disabled for a test.

Check that it worked

  • Settings > Windows Update shows You're up to date after Check for updates.
  • The update appears under Update history with the status Successfully installed.
  • In an administrator PowerShell, Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 lists the KB number you were trying to install.

If it still fails

  • Open C:\Windows\Logs\CBS\CBS.log, search for 0x80070005 near the time of the failure, and note the file or registry path in the lines above it: that object is the one Windows could not access.
  • Download the update manually from the Microsoft Update Catalog by its KB number and run the .msu file.
  • On a work or school PC, ask IT: policies or management agents can block updates by design.
  • If nothing installs, an in-place repair upgrade with the Windows 11 Installation Assistant or installation media reinstalls Windows while keeping files and apps.

Sources

  1. Troubleshoot Windows Update error 0x80070005Official · Microsoft Learn
  2. Common Windows Update errorsOfficial · Microsoft Learn
  3. Troubleshoot problems updating WindowsOfficial · Microsoft Support

Browse