0x80070005 means E_ACCESSDENIED: a Group Policy operation could not read or write a resource it needed. The blocked resource may be a GPO in Active Directory, a SYSVOL file, a local registry key or file, a service security descriptor, or a DCOM permission. The reliable fix is to identify that resource in the event or policy results, correct only the missing permission in the policy or endpoint that owns it, then reapply and verify the policy.
Do not treat this HRESULT as one universal repair. The same code appears in ordinary GPO processing, Group Policy Preferences, Windows Update, activation, and service configuration. The procedure below separates those cases before any ACL is changed.
As an Amazon Associate I earn from qualifying purchases.
What 0x80070005 means in Group Policy
Microsoft defines 0x80070005 as E_ACCESSDENIED. In a Group Policy context, “access denied” describes the operation, not the root cause. A user or computer may be unable to read the GPO object in Active Directory, read the policy files in SYSVOL, write a local registry value, reach a destination file, change a service security descriptor, or use a DCOM endpoint.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The code is also reused outside normal policy processing. Windows Update reports it when the update process cannot access required files, folders, or registry entries. Activation-related events can use it when DCOM permissions are missing. Identify the failing subsystem before changing permissions; a broad local ACL edit can create a security problem and still be overwritten at the next policy refresh.
#1 Best Overall
- 【Wide Application】This precision screwdriver set has 120 bits, complete with every driver bit you’ll need to tackle any repair or DIY project. In addition, this repair kit has 22 practical accessories, such as magnetizer, magnetic mat, ESD tweezers, suction cup, spudger, cleaning brush, etc. Whether you're a professional or a amateur, this toolkit has what you need to repair all cell phone, computer, laptops, SSD, iPad, game consoles, tablets, glasses, HVAC, sewing machine, etc
- 【Humanized Design】This electronic screwdriver set has been professionally designed to maximize your repair capabilities. The screwdriver features a particle grip and rubberized, ergonomic handle with swivel top, provides a comfort grip and smoothly spinning. Magnetic bit holder transmits magnetism through the screwdriver bit, helping you handle tiny screws. And flexible extension shaft is useful for removing screw in tight spots
- 【Magnetic Design】This professional tool set has 2 magnetic tools, help to save your energy and time. The 5.7*3.3" magnetic project mat can keep all tiny screws and parts organized, prevent from losing and messing up, make your repair work more efficient. Magnetizer demagnetizer tool helps strengthen the magnetism of the screwdriver tips to grab screws, or weaken it to avoid damage to your sensitive electronics
- 【Organize & Portable】All screwdriver bits are stored in rubber bit holder which marked with type and size for fast recognizing. And the repair tools are held in a tear-resistant and shock-proof oxford bag, offering a whole protection and organized storage, no more worry about losing anything. The tool bag with nylon strap is light and handy, easy to carry out, or placed in the home, office, car, drawer and other places
- 【Quality First】The precision bits are made of 60HRC Chromium-vanadium steel which is resist abrasion, oxidation and corrosion, sturdy and durable, ensure long time use. This computer tool kit is covered by our lifetime warranty. If you have any issues with the quality or usage, please don't hesitate to contact us
First identify which operation failed
Capture the event’s full text, the policy name and GUID, the affected user or computer, and the resource path. Record whether the failure is in User Configuration, Computer Configuration, a Group Policy Preferences item, Windows Update, activation, or a service/security setting.
| Where the error appears | Most likely resource to inspect first | Correct repair location | Best confirmation |
|---|---|---|---|
| GPO listed as denied or filtered | Active Directory GPO permissions, link, security filtering, WMI filter | Domain GPO or its delegation | gpresult or rsop.msc |
| Preference copies a file, creates a shortcut, or launches a task | SYSVOL/source ACL, destination ACL, or run-as account | GPO item, source share, destination, or service account | Preference event details and a second policy refresh |
| Service or Plug and Play setting | Service security descriptor changed by a GPO | The owning service-security policy, not a permanent local workaround | RSOP plus service behavior after refresh |
| Windows Update or component store | Component-store registry and file permissions, TrustedInstaller/SYSTEM rights, security software, management policy | Endpoint permissions or the policy/agent that changed them | Update retry and event logs |
| Activation or DCOM event | DCOM default access permissions for SELF |
Component Services on the affected endpoint | Restart and repeat the activation operation |
Run the safe diagnostic sequence
- Save the exact event. In Event Viewer, copy the event source, ID, policy name or GUID, account, path, and error text. The path and security principal usually identify the resource that needs attention.
- Generate policy results. Run
rsop.mscto view the resulting policy, or create an HTML report withgpresult /h GPReport.html. Run the command in an elevated Command Prompt when you need computer-scope results. Inspect both applied and denied or filtered GPOs. - Check the scope. Determine whether the target is a user, computer, or both. A computer policy can fail even when the interactive user can browse the same location because the computer account, SYSTEM, or a service account is the security context that performs the operation.
- Test domain reachability. From the affected computer, verify that the security context shown in the event can read the domain SYSVOL path and the policy’s Active Directory object. A failure here points to delegation, security filtering, inheritance, replication, or hardening changes rather than a local application setting.
- Inspect the individual preference item. Note its item name, source and destination paths, action, and account used to run it. A readable GPO can still contain an item that cannot write its destination or authenticate to a share.
- Review effective permissions. In Group Policy Management, confirm the target has both Read and Apply Group Policy. Use
Get-GPPermissionto display security principals and their permission levels. Look for explicit Deny entries, broken inheritance, or a group membership that differs from what you expect. - Enable deeper logging only when needed. For persistent GPSVC failures that ordinary results do not explain, use Microsoft’s GPSVC diagnostic logging method based on the
GPSvcDebugLevelsetting, then review the generated logs. Remove or disable diagnostic logging after collecting the evidence.
Repair GPO permissions and filtering
Give the target both Read and Apply Group Policy
Open Group Policy Management, select the affected GPO, and inspect the Delegation and security-filtering entries. The intended user or computer group normally needs Read and Apply Group Policy. Having only one of these permissions is not sufficient for normal application.
Check the link location as well. A GPO can be correctly permissioned but linked to another site, domain, or organizational unit. Confirm that the user or computer resides in the linked scope and that inheritance is not blocked above it. If a WMI filter is attached, verify that the target satisfies its query.
Rank #2
- 【Precision screwdriver set】-- 40Pcs screwdriver set has 30 CRV screwdriver bits which are phillips PH000(+1.2) PH000(+1.5) PH00(+2.0) PH0(+3.0) PH1(+4.0), flathead -0.8 -1.2 -1.5 -2.5 -3.0, torx T1 T2 T3 T4 T5, torx security TR6 TR7 TR8 TR9 TR10 TR15 TR20, triwing Y000(Y0.6) Y00(Y1.5) Y0(Y2.5) Y1(Y3.0), pentalobe P2(0.8) P5(1.2) P6(1.5), MID 2.5, with a screwdriver handle, a double-ended spudger, a long spudger, 3 triangle spudgers, Tweezers, a cleaning brush and a suction cup with SIM card thimble.
- 【Slip-resistant rotatable handle】-- All our screwdriver bits are made of high quality CR-V chrome vanadium steel. CR-V screwdriver bits do not rust easily and are not prone to be broken. The screwdriver handle is made of TPR and PP materials, with a special non-slip design, offering a sense of comfortable. The top of the handle is rotatable design which makes it more convenient to remove the screws; the handle head and the screw head has magnetic adsorption which can quickly replace the screws.
- 【Portable gadgets】-- The triangular spudger is more suitable for opening the screen of the mobile phone.The double-ended spudger is more suitable for opening the back cover of game devices. The long spudger can pry the internal parts of the device.The suction cup can open the screen, which is more convenient to repair the mobile phone.The SIM card thimble can be used to replace the SIM card of the mobile phone. The cleaning brush can clean the dust of the device.Tweezers can grip small parts.
- 【Wide scope of application】-- +1.5/2.0 P2 Y0.6 MID2.5 are used for iPhone7/8/X/XR/11/12/13. +1.2/1.5/2.0/3.0 T2/3/4/5 P2 are used for Samsung/Huawei/Xiaomi and other phones. +1.5/2.0/3.0 T3/4/5/6/9 are used for iPad/Mini/Air/Pro. +1.2/1.5/2.0/3.0/4.0 T2/3/4/5 -2.5 are used for Huawei/Honor and other tablets. P2/5/6 +1.5/2.0/3.0/4.0 T3/4/5/6/7/8/9 Y2.5/3.0 are used for Macbook/Air/Pro. +1.5/2.0/3.0 T5 are for Kindle/Kindle Fire. T6/15 are used Ring Video Doorbell/ Video Doorbell 2/Pro/Elite.
- 【Wide scope of application】-- T8 +1.5/2.0/3.0 are used for PS3/PS4/PS5 controllers and consoles. T6/8/10 are used for Xbox 360/Xbox One/Xbox Series controllers and consoles. Y1.5/2.5/3.0 +1.5/2.0 are used for Switch/NS-Lite/Joy-Con/Wii/Game Boy Advance. T3/8 are used for Fitbit wristband/folding knife. +1.2/1.5/2.0/3.0/4.0 T3/4/5/6/7/8/9 Y2.5/3.0 -2.5 are used for Microsoft/Acer/Dell and other laptops. +1.2/1.5/2.0/3.0/4.0 -0.8/1.2/1.5/2.5/3.0 are used for Desktop Computer/Watch/Glasses/Toy.
Remove an unintended deny or delegation conflict
An explicit Deny takes precedence over an Allow. Review direct permissions and group-derived permissions for the affected security principal. Use Get-GPPermission to compare the entries with the group memberships shown in the event or policy report. Correct the narrowest entry that blocks the target; do not grant Domain Users or Authenticated Users broad rights merely to make the error disappear.
If the policy is delegated to an administrative group, make the change in the domain GPO and document it. A local edit on one endpoint will not correct a domain-side denial and may be reverted at the next refresh.
Fix SYSVOL, source-share, and destination access
Group Policy Preferences often perform a second operation after the GPO is read. A file-copy, shortcut, folder, registry, or scheduled-task item may return 0x80070005 because the source in SYSVOL or a share is unreadable, the destination ACL rejects the write, or the item runs under the wrong account.
Rank #3
- The original electronics toolkit: Designed for computer, smartphone, tablet, and gaming repair, backed by thousands of free instructions.
- Intentional selection: All the tools you need. A 64 precision bit driver set, tweezers, flex extension, opening tools, and anti-static wristband.
- Secure design: Magnetic case and foam insert ensure secure storage and transportation. Additionally, the inside of the lid serves as a sorting/organization tray.
- Lifetime Warranty: We'll replace anything that breaks, as long as you own it.
Check the source
Confirm that the affected security context can read the policy’s SYSVOL files and any external source share. Check both the share permission and the NTFS permission. If the source is a hidden administrative share or a server outside the domain, verify that the account used by the preference item is authorized there.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Check the destination
Inspect the destination ACL on the affected computer or server. A user-run item needs user rights; a computer-startup item commonly runs as the computer account or SYSTEM; a scheduled task may use a separately configured account. Grant only the operation required—read, create, modify, or execute—and avoid Full Control when a narrower right works.
Reprocess the item
After correcting the owning policy or ACL, run gpupdate /force. If the item is computer-scoped, restart when prompted or when the policy requires startup processing. If it is user-scoped, sign out and back in when the item requires logon processing. Recheck the preference event rather than assuming a successful refresh applied every item.
Rank #4
- 【59 in 1 Precision Screwdriver Set】Small screwdriver set contains 44 screwdriver bits, Phillips PH000,PH00,PH0,PH1,PH2; Flathead -1.0, -1.5 -2.0,-3.0; Torx T1 T2 T3 T4 T5, Torx security TR6 TR7 TR8 TR9 TR10 TR15 TR20; Triwing Y0.6, Y1.5. Y2.3, Y3.0; Pentalobe P2(0.8) P5(1.2); Triangle 2.3; U-type U2.6; H-type: H0.9, H1.3, H1.5, H2.0, H2.5, H3.0; MID-type: MID; Sleeve: M2.5, M3.0, M3.5, M4.0, M4.5, Cross 2.0, G3.8, G4.5
- 【Unique Handle Design】Ergonomic design handle, more energy-saving operation, batch head built-in strong magnet, easy to adsorb the batch head. The screwdriver bit is made of high quality CRV steel, which is wear-resistant and hard.
- 【Multi-Functional Accessories】Mini Tool kit contains 15 accessories for a variety of repair needs, including a magnetic plus or minus area to increase or decrease the magnetism of the bit, a long pry bar, a scimitar shaped pry bar, four triangular pry blades, three double-ended pry bars, tweezers, a black cleaning brush, a SIM card thimble, and a suction cup. Note: The package is made of PP material without carton and user manual.
- 【Practical Storage Box】Compartments are categorized for placement, each CRV precision bit is marked with a model number for easy identification, neatly dispensed for easy storage and searching. The box is sturdy and durable with strong clasps that protect each accessory well. The bits are mini (long 28mm, diameter 3.98mm) for precision work, not suitable for large screws.
- 【Wide Scope of Application】Suitable for iPhone/Samsung/Huawei and other cell phones; Mini/Air/Pro and Huawei/Honor and other laptops; Macbook/Air/Pro; Kindle/Kindle Fire; Ring Video Doorbell/ Video Doorbell 2/Pro/Elite; PS4/PS5/XOBX game console controllers and consoles, and PC laptops , watches, glasses, jewelry, toys, flight models, drones, cameras, RC cars, and some small appliances like coffee makers.
Repair a service or registry ACL changed by a GPO
Microsoft documents a Plug and Play case in which a GPO changes the service security descriptor and removes rights required by the Network Service account. The same pattern can affect other service or registry settings: the local symptom appears on one computer, but the domain policy is the component that keeps reintroducing it.
- Run
rsop.mscon the affected computer and locate the policy that configures the Plug and Play or related service setting. - Open that GPO and edit the service-security configuration. Add
SERVICENetwork Servicewith the minimum rights specified for the affected service by Microsoft’s documented scenario. Do not copy a permissive descriptor from an unrelated machine. - Save the GPO, allow replication where applicable, and run
gpupdate /forceon the client. - Restart the service or computer if the service does not reread its security descriptor immediately, then confirm the original operation succeeds.
If RSOP shows no responsible GPO, the fallback is an endpoint repair: restore the required Network Service permissions on the affected profile-list registry key and restart. Export or otherwise back up the key before editing it, and use the exact key and rights identified by the event or Microsoft’s procedure. If a domain policy later begins managing that setting, move the durable fix into the policy instead of maintaining conflicting local edits.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAddress Windows Update and component-store variants
When the event belongs to Windows Update rather than ordinary policy processing, investigate the update path separately. Microsoft lists incorrect permissions on the component-store registry key, missing TrustedInstaller or SYSTEM rights, third-party security locks, and a Group Policy or management agent that restricts writes as possible causes.
Best Value
- 64-in-1 Precision Screwdriver Set: This small screwdriver set includes 48 bits (Phillips, Flathead, Torx, Torx security, Triwing, Pentalobe, Hex, Triangle, U-type, Square, SIM, MID, OVAL, Gamebit, Nut driver). It's a complete electronics repair kit that has been professionally designed to repair computers, PC, laptops, Macbooks, tablet, phones, PS4 PS5, XBOX, Switch, eyeglasses, drone, watches, Ring doorbells and more
- Ergonomic & Magnetic Design: The super smooth swivel cap on the top of the handle makes it easier to rotate screws with less effort. This mini screwdriver features an ergonomic non-slip design and rubberized handle that provides a comfortable grip and precise control. The built-in strong magnet ensures magnetic bit holder transmits magnetism through the screwdriver tip to help you with tiny screws
- Practical Accessories: Our electronics tool kit comes with 8 types of 15 essential accessories. Magnetizer can enhance the magnetism of the screwdriver tip, pointed tweezers make it easy to handle screws and tiny components, spudger and hook tool is effective for connecting/disconnecting components, scraping off adhesives, suction cup, pry tools, opening picks and brush to help open and clean your device
- Organize & Portable Storage: All screwdriver bits are stored in rubber bit holder which marked with type and size for fast recognizing. The rubber bit holder can be fixed on the shelf of the sturdy plastic case, also can be removed for easy access, making it more convenient for you to perform repairs. The case provides secure protection and organized storage, while being lightweight and portable for easy transportation
- Premium Quality & Warranty: STREBITO manufactures premium quality, pro-grade screwdriver set. The precision bits are CNC machined to be precise, made of 60HRC Chromium-vanadium steel which is resist abrasion, oxidation and corrosion. This micro screwdriver set is covered by our lifetime warranty. If you have any issues with the quality or usage, simply contact customer service for troubleshooting help
- Confirm that the event is from Windows Update and identify the file, folder, or registry path named in it.
- Check whether a security product, hardening baseline, or management agent recently changed that path’s permissions. Correct the responsible policy or agent first; otherwise the repair may be undone.
- Back up the operating-system disk before changing component-store permissions.
- Where the documented procedure applies, reset permissions on
%windir%WinSxSand%windir%SoftwareDistributionwith the Microsoft-prescribedicaclscommands. Use the exact command syntax and account assignments from that procedure rather than improvising recursive grants. - Retry the update and inspect Windows Update and Application logs. If the same path is denied again, compare the effective ACL before making another change.
Do not use a Windows Update permission reset to fix a GPO that is actually denied in Active Directory or SYSVOL. The code is identical, but the repair boundary is different.
Fix the DCOM activation variant
Use this branch only when the event identifies activation or DCOM. Microsoft’s documented 0x80070005 activation case is caused by missing DCOM permissions for SELF.
- Press
Win+R, enterdcomcnfg, and open Component Services. - Browse to Component Services > Computers > My Computer, open Properties, and select COM Security.
- Under Default Access Permissions, edit the list and add
SELFif it is absent. - Grant Local Access and Remote Access only when the documented event and application require them. Avoid changing launch or activation permissions that are not implicated.
- Apply the change, restart as required by the event, and repeat the activation operation.
If a domain security baseline manages DCOM permissions, make the change in that baseline or GPO. A local correction that conflicts with a centrally managed descriptor will not persist.
Recommended Free Tools
Validate the repair
- Run
gpupdate /forceafter the policy or ACL change. - Sign out, restart, or restart the affected service when the policy type or security descriptor requires a new session.
- Re-run
gpresult /h GPReport.htmlor openrsop.msc. Confirm that the GPO is now applied and that the previous denial or filtering reason is gone. - Check Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational, plus the relevant Application, Windows Update, or DCOM log.
- Verify the actual outcome: the preference item exists at its destination, the service starts, the registry value is present, or the update completes.
- Compare the effective permissions and policy results with a known-good computer. Matching domain results but a failure on one endpoint points toward a local ACL, service, profile, or security-software issue; differing results point toward scope, replication, filtering, or delegation.
Common mistakes to avoid
- Changing permissions before identifying the resource: the same HRESULT can refer to AD, SYSVOL, a local key, a service, or DCOM.
- Checking only Read: normal GPO application also requires Apply Group Policy.
- Granting Everyone or Full Control: this increases exposure and can conceal the actual missing right.
- Repairing the endpoint instead of the owning GPO: domain policy can overwrite a local fix at the next refresh.
- Ignoring the run-as account: a preference executed by SYSTEM or a computer account does not inherit the interactive user’s access.
- Using a Windows Update reset for a GPO denial: repair the subsystem named by the event.
- Leaving diagnostic logging enabled: turn off GPSVC troubleshooting after collecting the required logs.
A practical decision framework
| Question | If yes | If no |
|---|---|---|
Does gpresult show the GPO as denied or filtered? |
Inspect link scope, Read, Apply Group Policy, Deny, inheritance, and WMI filtering. | Continue to the resource named in the event. |
| Can the event’s security context read SYSVOL and the AD policy object? | Inspect the preference destination, service, registry, or application operation. | Repair delegation, replication, reachability, or the relevant ACL. |
| Is a specific file, registry key, or service named? | Grant the minimum required right to the named principal in the owning policy or endpoint. | Enable targeted GPSVC logging and compare with a known-good computer. |
| Does the event explicitly identify Windows Update or DCOM? | Use the Windows Update component-store or DCOM branch above. | Keep the investigation within GPO, SYSVOL, and the local operation. |
When to escalate
Escalate to a domain administrator when the GPO object, SYSVOL, replication, delegation, or security baseline is involved. Provide the event text, GPO GUID, affected account, gpresult report, RSOP findings, and the exact permission that was denied. Escalate to the endpoint or application owner when the failure is isolated to one machine and policy results match a known-good computer. Include the before-and-after ACL or security-descriptor change so it can be reviewed and reversed if necessary.
Quick Recap
As an optional shortcut after the manual checks, Outbyte PC Repair can address more than 100 common Windows issues where possible, adjust settings that affect CPU, RAM, and disk load, clean temporary and cache files, check Windows settings and missing updates, and provide tools such as real-time boost, file shredder, and crash logging. It runs on Windows 11, 10, 8, and 7; a free trial is available by category for at least two days, followed by a paid subscription. It complements antivirus software, does not replace it, and no tool repairs every crash.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
