How to Fix SCCM 0x80070057: Denied Access, Invalid Paths and Deployment Failures

0x80070057 is not one universal SCCM diagnosis. It is a symptom that can appear during client push, content download, software-update scanning, or CCMSetup source retrieval. Find the first failing stage in the relevant Configuration Manager log, then fix that stage: grant the push account local-administrator rights, restore remote connectivity, correct boundary-group and distribution-point relationships, repair software-update-point assignment, or make the management point/distribution point reachable.

The procedure below starts with manual checks and changes only one failure category at a time. That prevents a boundary problem from being mistaken for a permissions problem, or a delayed software-update fallback from being mistaken for a broken download.

#	Preview	Product	Price
1		Microsoft Windows 11 (USB)	$128.99	Buy on Amazon
2		Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC |...		Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

What SCCM 0x80070057 means

In Configuration Manager, the hexadecimal value by itself does not identify a root cause. The same symptom can be produced by an invalid or incomplete installation parameter, an inaccessible administrative share, failed authentication, an incorrect boundary, unavailable content, an incorrectly scoped software update point, or an unreachable source for CCMSetup files.

First identify what the computer was doing when the error appeared:

#1 Best Overall

Sale

Microsoft Windows 11 (USB)

• Less chaos, more calm. The refreshed design of Windows 11 enables you to do what you want effortlessly.
• Biometric logins. Encrypted authentication. And, of course, advanced antivirus defenses. Everything you need, plus more, to protect you against the latest cyberthreats.
• Make the most of your screen space with snap layouts, desktops, and seamless redocking.
• Widgets makes staying up-to-date with the content you love and the news you care about, simple.
• Stay in touch with friends and family with Microsoft Teams, which can be seamlessly integrated into your taskbar. (1)

$128.99

Buy on Amazon

Record the timestamp, device name, site code, action being attempted, and the first error before changing anything. Later messages often repeat 0x80070057 after the original failure has already occurred.

Fix client-push access denied errors

Client push uses a remote connection from the site server to the destination computer. Microsoft requires the push account to be a local Administrator on each destination computer. A domain account can be used, but domain membership alone does not provide the required target-side rights.

1. Verify the account used for client push

1. In the Configuration Manager console, open Administration > Site Configuration > Sites, select the site, and open Client Installation Settings > Client Push Installation.
2. Review the configured installation accounts. Confirm that the account is enabled, its password has not expired, and it is a local administrator on the target computer.
3. Test with one known target rather than changing the account for every device. If the account is managed through a domain group, confirm that group is actually present in the target computer’s local Administrators group.

If the push account cannot log on to the target with administrative rights, changing CCMSetup switches will not solve the push failure.

2. Test name resolution, SMB and the administrative share

From the site server, replace TARGET with the computer name and run:

Resolve-DnsName TARGET
Test-NetConnection -ComputerName TARGET -Port 445
dir \TARGETadmin$

A failed name lookup indicates DNS or naming trouble. A failed TCP 445 test indicates firewall or network filtering. An “access denied” result when listing admin$ indicates an authentication or privilege problem. A successful share listing proves only that SMB access works; it does not prove that CCMSetup will complete.

3. Check firewall and remote-management paths

Allow the SMB and RPC traffic required by your organization’s Windows firewall policy between the site server and the target. SMB uses TCP 445; RPC uses the endpoint mapper and dynamically allocated RPC ports, whose range may be restricted by local policy. Check both the target’s local firewall and any network firewall between the servers. Do not disable firewalls broadly as a diagnostic shortcut; create a scoped rule or test during an approved maintenance window.

4. Validate authentication policy

When Kerberos mutual authentication is required, the target must be in a trusted Active Directory forest and the computer and user identities must resolve correctly. Review whether your security policy permits NTLM fallback and whether the client-push configuration can use it. A policy that blocks the available authentication method can look like a bad password or an invalid path even when the account credentials are correct.

5. Confirm access to the setup source and directory services

The push process must reach the share containing the client files and communicate with the Configuration Manager server and the domain controller as required by the environment. Verify that the push account and the target can resolve and access those systems. If the target is on a segmented network, test from the actual site-server subnet rather than from an administrator workstation.

6. Read the push logs and retry deliberately

Use ccm.log on the site server to identify whether the first failure is account validation, connection, share access, file copy, or CCMSetup launch. Once the setup process starts on the target, inspect %windir%ccmsetupLogsccmsetup.log and, if Windows Installer runs, client.msi.log. Correct one class of issue, retry, and compare the new transition in the log with the old one.

Microsoft documents that failed client contact is retried hourly for up to seven days. An immediate retry is useful after a fix, but a device that remains offline will continue to fail until it is reachable; waiting alone does not repair a missing permission or blocked port.

Fix content, application and package download failures

For content deployment, the client must belong to a boundary group associated with a distribution point that has the requested content. A device can be healthy, authenticated, and visible in the console yet still receive 0x80070057 if its current network location maps to the wrong boundary group.

1. Confirm the device’s current boundary

1. In the console, open Administration > Hierarchy Configuration > Boundaries and identify the IP range, subnet, Active Directory site, or VPN boundary that represents the client’s current location.
2. Open Boundary Groups and verify that the boundary is a member of the intended group.
3. Check remote and VPN address pools separately. A laptop that moves from the office to a VPN can change boundary membership without changing its device record.

Boundary groups determine which distribution points, software update points, management points, and cloud management gateways a client can use. A stale or overlapping boundary can therefore affect more than one deployment type.

2. Verify distribution-point association and content status

In the relevant boundary group, confirm that the expected distribution point is listed. Then check the package, application, boot image, or update under Monitoring > Distribution Status > Content Status. The content must be distributed successfully to that distribution point, not merely present in the console.

Rank #2

Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC | Branded by Microsoft

• STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
• OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
• OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
• PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
• GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.

Buy on Amazon

If the deployment uses a distribution point in another boundary group, either associate that distribution point with the client’s group or correct the client’s boundary membership. Do not assume that a distribution point elsewhere in the hierarchy is automatically an eligible source.

3. Trace location selection and transfer

LocationServices.log shows the management points and distribution points the client discovers. CAS.log records content-location and cache activity, while ContentTransferManager.log records the transfer job. For an application, AppEnforce.log helps separate a download failure from an installation command failure.

If the logs show no eligible location, fix the boundary relationship first. If they show an eligible distribution point but no content, redistribute and monitor content status. If the content is available but transfer fails, test the client’s network path and the distribution point’s health before changing the deployment.

Fix software-update failures and apparent delays

Software-update clients use the software update point assigned through their boundary group. An incorrect assignment can generate a location or parameter error even though the management point is reachable.

1. Check software update point membership

1. Open the client’s boundary group and review the assigned software update point.
2. Confirm that the client is actually in that boundary group at its current network location.
3. Check LocationServices.log for the selected update point and WUAHandler.log or ScanAgent.log for the scan request and response.

If the update point is unavailable or incorrectly scoped, correct the boundary-group assignment before repeatedly starting scans.

2. Account for the documented fallback timer

Microsoft documents that a client tries its last known-good software update point for 120 minutes before it begins fallback. During that interval, logs can look like a permissions or download failure even though the client is following the configured selection policy. Record when the last-known-good attempt began and allow the documented interval to elapse after correcting the assignment.

3. Trigger a fresh policy and scan after the assignment is fixed

On the client, open Control Panel > Configuration Manager > Actions and run Machine Policy Retrieval & Evaluation Cycle. After policy arrives, run Software Updates Scan Cycle. Watch the update logs for a new point selection and a scan that progresses beyond the original error. If the client still selects the old point, collect the location and policy logs before making another infrastructure change.

Fix CCMSetup source and installation-parameter failures

CCMSetup must communicate with a management point or distribution point to obtain the installation files. A client-push operation can therefore pass the remote-copy stage and still fail with 0x80070057 when the target cannot reach its configured source.

1. Validate the source path from the target

Check that the target can resolve the management-point and distribution-point names and reach them over the transport used by your site. For an HTTP(S) site, confirm the required certificate and transport settings; for a site using enhanced HTTP or another configured mode, use the settings defined by that site rather than copying switches from a different environment.

2. Review the properties passed to CCMSetup

Inspect the command line or client-push properties for the site code, management point, certificate options, and transport settings. A typo in a site code, an obsolete management-point name, or a property that does not apply to the current authentication mode can be reported as an invalid parameter. Use the exact values published by your site configuration. Do not add undocumented switches simply because the hexadecimal code contains the word “invalid.”

3. Follow the setup logs in order

Start with ccmsetup.log to determine whether the failure is source discovery, file download, prerequisite evaluation, or handoff to Windows Installer. Then inspect client.msi.log for installation-specific errors. A source-download error must be fixed at the management-point/distribution-point or network layer; an MSI error requires a separate review of local prerequisites and installer permissions.

Use a failure-stage decision path

Common mistakes that prolong the error

• Changing every setting at once: You lose the evidence that identifies the original stage. Change permissions, boundaries, source properties, or update-point assignment one category at a time.
• Testing from the wrong computer: A workstation may reach a share that the site server cannot. Run remote-access tests from the site server and source-download tests from the affected client.
• Confusing device visibility with content availability: A device appearing in the console does not mean it has a usable distribution point or software update point.
• Ignoring VPN location changes: The client’s current IP range or VPN boundary controls site-system selection; its historical office location is not enough.
• Repeating an update scan during the fallback window: Repeated scans do not cancel the documented 120-minute last-known-good behavior.
• Assuming the hexadecimal code names the cause: The first meaningful log transition is more useful than the code printed in a final summary message.

What to collect if the manual fixes do not work

Prepare a compact evidence set for the Configuration Manager administrator: device name and current network location, site code, exact action that failed, timestamp with time zone, the first error from the applicable log, boundary-group membership, selected distribution point or software update point, and the client-push account used. Include the relevant sections of ccm.log, ccmsetup.log, LocationServices.log, WUAHandler.log, or transfer logs rather than an unrelated full log archive.

This information distinguishes an access-denied push from a content-location failure and from a source-download failure that merely happens to display the same hexadecimal value.

Quick Recap

SaleBestseller No. 1

Microsoft Windows 11 (USB)

Make the most of your screen space with snap layouts, desktops, and seamless redocking.; FPP is boxed product that ships with USB for installation

$128.99

Bestseller No. 2

Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC | Branded by Microsoft

GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.

As an optional shortcut for broader Windows errors around system elements, settings, temporary files, or application crashes, Outbyte PC Repair can check and repair some common issues. It complements antivirus software rather than replacing it, results vary, and no tool repairs every SCCM or Windows failure; it offers a free trial before a subscription.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

0x80070057Boundary GroupsCCMSetupclient pushConfiguration ManagerDistribution PointsSCCMsoftware updates