How to Fix “0x800704sd” Update Denied: Verify the Code and Repair Windows Update Access

Do not troubleshoot 0x800704sd as if it were a confirmed Windows error yet. The letter s cannot appear in a hexadecimal Windows error code, so the text was probably copied incorrectly or read from a blurry dialog. Recheck the exact characters in Settings, Windows Update history, or the original error message. Pay particular attention to whether the ending is 005, 45d, or another value.

If the verified code is 0x80070005, Microsoft defines it as E_ACCESSDENIED: Windows does not have sufficient permission to access something required for the update. The safest sequence is to run the built-in Windows Update troubleshooter, restart, check again, confirm administrator access, test for security-software interference, and only then inspect CBS logs or repair system corruption.

#	Preview	Product	Price
1		Microsoft Windows 11 (USB)	$128.99	Buy on Amazon
2		Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC |...		Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

First, verify what Windows actually reported

A single character changes the diagnosis. 0x800704sd is not valid hexadecimal because hexadecimal notation uses only the digits 0–9 and letters A–F. Treat the supplied text as an uncertain transcription rather than silently changing it to another code.

Where to check the exact code

• Open Settings > Windows Update > Update history and locate the failed update. Expand its details if Windows offers that option.
• Read the code again in the dialog or notification that appeared during installation.
• If you copied the message from a photograph or another device, compare every character, including zeros, the letter O, the digit 5, and the letter S.

Write down the complete code, the update name or knowledge-base number shown beside it, and the date and time of the failed attempt. Those details let you distinguish a real permission error from a different Windows Update failure. The procedures below are specifically applicable when the confirmed code is 0x80070005 or when Windows clearly says access is denied.

#1 Best Overall

Sale

Microsoft Windows 11 (USB)

• Less chaos, more calm. The refreshed design of Windows 11 enables you to do what you want effortlessly.
• Biometric logins. Encrypted authentication. And, of course, advanced antivirus defenses. Everything you need, plus more, to protect you against the latest cyberthreats.
• Make the most of your screen space with snap layouts, desktops, and seamless redocking.
• Widgets makes staying up-to-date with the content you love and the news you care about, simple.
• Stay in touch with friends and family with Microsoft Teams, which can be seamlessly integrated into your taskbar. (1)

$128.99

Buy on Amazon

What 0x80070005 means

Microsoft describes 0x80070005 as an access-denied or insufficient-permissions error. In Windows servicing, the update process must read and write protected files, folders, registry entries, and component-store data. If the account, a changed permission, or another security component blocks one of those objects, installation can stop with this code.

The code identifies the type of failure, not the exact object that was blocked. It does not by itself prove that Windows is infected, that every permission on the computer is damaged, or that reinstalling Windows is necessary. A controlled sequence narrows the cause before any sensitive change is attempted.

Choose the least risky remedy that fits the evidence

Use the rows from top to bottom. Do not jump to permission edits or system repair commands merely because an update failed once.

Step 1: Run Microsoft’s Windows Update troubleshooter

Microsoft’s supported first step is the Windows Update troubleshooter. On Windows 11, the automated experience starts in the Get Help app. Microsoft also provides the general Settings path used across current Windows 10 and Windows 11 releases.

1. Select Start > Settings > System > Troubleshoot > Other troubleshooters.
2. Find Windows Update and select Run (the button may open Get Help instead of displaying a traditional wizard).
3. Allow the checks to complete. Read any finding or action that Windows reports rather than closing the window immediately.

UI wording can vary by Windows version and edition, but the purpose is the same: detect common update configuration problems without manually changing protected permissions. If the troubleshooter reports that it made a change, note that result before proceeding.

Step 2: Restart, then check for the update again

Microsoft instructs users to restart after the troubleshooter finishes and then try Windows Update again. A restart closes processes that may still hold update files and completes any repair that is waiting for a reboot.

1. Save open work and choose Start > Power > Restart.
2. After Windows loads, open Settings > Windows Update.
3. Select Check for updates, or retry the specific update shown in the history.
4. Record whether the same code returns, whether a different code appears, or whether installation completes.

If the update succeeds, no permission change is needed. If the exact access-denied message returns, continue with the account and security checks rather than repeatedly selecting Check for updates.

Step 3: Confirm that an administrator can approve the installation

An access-denied update can occur when the signed-in account is not allowed to install system changes. Check the account type before changing anything in the file system or registry.

1. Open Settings > Accounts and review the account information shown for the current user. The exact label differs between Windows editions.
2. If the account is standard, sign in with an administrator account and retry the update.
3. If this is a managed work or school computer, ask the administrator who manages the device to perform the installation. Do not attempt to bypass organizational controls.

Being an administrator does not guarantee that every update will install; it only removes one common permission barrier. If an administrator receives the same 0x80070005 result, the cause may be a changed file-system or registry permission, security software, or corruption in the servicing components.

Step 4: Test whether antivirus or firewall software is blocking the update

Microsoft lists antivirus and firewall interference as possible causes of access-denied update failures. The useful test is temporary and reversible: pause the relevant protection, retry the update once, and restore protection immediately afterward.

1. Open the security product’s own controls and identify the option that temporarily pauses real-time antivirus or firewall protection. The label and location depend on the product.
2. Pause protection only for the shortest period needed to start and test Windows Update. Keep the computer off untrusted websites and downloads during this test.
3. Open Settings > Windows Update and retry the failed update.
4. Restore antivirus and firewall protection as soon as the test finishes, whether the update worked or failed.

A successful installation while protection was paused is evidence of interference, not proof that protection should remain disabled. Contact the security-software administrator or vendor for an update-compatible rule rather than leaving the computer unprotected. If the update fails in exactly the same way, restore protection and proceed to log review.

Rank #2

Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC | Branded by Microsoft

• STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
• OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
• OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
• PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
• GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.

Buy on Amazon

Step 5: Use CBS.log to identify the denied object

When the failure persists, Microsoft Learn recommends examining the Component-Based Servicing log. This is more reliable than guessing which permission to change because the log can show the relevant timestamp, the error entry, and the file or registry object that servicing could not access.

1. Open File Explorer and enter %Windir%\logs
CBS
CBS.log in the address bar, or navigate to the Windows folder, then logs, then CBS.
2. Open CBS.log. If Windows asks for elevation, approve it or have an administrator open the file.
3. Find entries near the date and time of your latest failed update attempt. Search for error and compare the timestamp with the failure.
4. Record the file-system path or registry object named in the denied entry, along with the exact error text.

Keep the log unchanged. Its value is diagnostic: it tells you whether the denial concerns a particular object or whether broader component-store corruption is indicated. A single denied path does not justify taking ownership of every Windows folder or resetting permissions across the registry. Those broad changes can create new servicing and security problems.

Step 6: Repair component-store or system-file corruption when the evidence points there

Microsoft documents DISM and SFC for cases in which the component store or Windows system files are corrupted. Use these commands after the earlier checks, especially when CBS.log entries indicate corruption rather than a simple account or security-software block.

Run DISM from an elevated Command Prompt

1. Open Start and type Command Prompt.
2. Right-click Command Prompt and choose Run as administrator. Approve the User Account Control prompt.
3. Enter Dism.exe /Online /Cleanup-Image /Restorehealth and press Enter.
4. Allow the command to finish and read the result it displays. Do not close the window merely because progress appears to pause.

/Online targets the running Windows installation, while /Cleanup-Image /Restorehealth asks DISM to check and repair the component store. If DISM reports that it could not complete, record the exact message before trying another step; do not substitute unverified switches.

Run System File Checker after DISM

1. In the same elevated Command Prompt, enter Sfc.exe /Scannow and press Enter.
2. Wait for SFC to finish its verification and repair pass.
3. Restart Windows.
4. Return to Settings > Windows Update and check again.

DISM addresses the component store that Windows uses for servicing; SFC checks protected system files. Running them in this order gives SFC a repaired source when component-store corruption was part of the problem. These commands do not prove that every access-denied failure is corruption, so do not use them as a substitute for confirming the code and reviewing the log.

How to interpret the result

The code changes after troubleshooting

If the original text was a transcription error, the next attempt may show a different, valid code. Stop applying the 0x80070005 path and record the new value exactly. A different code can require a different Microsoft procedure.

The update installs after a restart or troubleshooter

This indicates that no manual permission repair was necessary. Keep the successful sequence in your notes, especially the update name and date, in case another update later fails.

The update works only while security protection is paused

Restore protection first. The result points to an interaction between the security configuration and Windows Update. Obtain a supported exception or configuration from the person who manages that security product instead of repeating updates with protection disabled.

CBS.log names a specific file or registry object

Preserve the path and timestamp for an administrator or support technician. Avoid changing ownership or permissions based on a generic online command; the correct repair depends on the object and the Windows installation’s intended permissions.

DISM and SFC report repairs, but the update still fails

Restart once more, retry Windows Update, and compare the newest CBS.log timestamp with the failure. If the same object is denied, the remaining issue is likely permission or security-policy related rather than merely damaged system files.

What not to do

• Do not treat 0x800704sd as a confirmed hexadecimal code. Verify it first.
• Do not reset permissions on the entire Windows directory or registry because a forum command promises a universal fix.
• Do not leave antivirus or firewall protection paused after the test.
• Do not run DISM or SFC from a non-elevated Command Prompt; Windows may reject the operation or fail to repair the intended installation.
• Do not keep retrying the same update without recording the new code, timestamp, and CBS.log entry. Repeated attempts can overwrite the context you need to diagnose the failure.

When to ask an administrator for help

Escalate when the device belongs to an employer or school, when you cannot open CBS.log with the required access, when a registry object is named in the denial, or when DISM and SFC return errors you cannot interpret. Give the administrator the verified error code, update name, Windows version, failure time, troubleshooter result, whether security protection was paused, and the relevant CBS.log lines. That information is more useful than reporting only that Windows Update was denied.

Quick Recap

SaleBestseller No. 1

Microsoft Windows 11 (USB)

Make the most of your screen space with snap layouts, desktops, and seamless redocking.; FPP is boxed product that ships with USB for installation

$128.99

Bestseller No. 2

Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC | Branded by Microsoft

GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.

As an optional shortcut after the manual checks, Outbyte PC Repair can address more than 100 common Windows issues, including broken system elements and shared DLL problems, and can review crashes and system settings. It includes a free trial by category of at least two days, then requires a paid subscription; it runs on Windows 11, 10, 8 and 7. It complements antivirus software rather than replacing it, results vary, and no repair tool fixes every crash.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

0x80070005Access DeniedWindows 10Windows 11Windows troubleshootingWindows Update