Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWindows Update error 0x80070005 is E_ACCESSDENIED: the servicing process was denied access to a file, folder, registry entry, or policy-controlled resource. Back up the Windows drive, inspect the update logs, then repair permissions and Windows Update components before running DISM and SFC. The sequence below targets the Windows 10 version 2004 upgrade failure without jumping straight to a reinstall.
What 0x80070005 means during a Windows 10 2004 update
The hexadecimal code is an access-denied result, not a diagnosis of one specific defective update package. Windows servicing may need to read or write the WinSxS component store, the SoftwareDistribution download cache, the Component Based Servicing registry key, protected Windows folders, or files controlled by the SYSTEM account. If one of those operations is refused, the upgrade can stop with 0x80070005.
As an Amazon Associate I earn from qualifying purchases.
Microsoft also identifies third-party antivirus or security software, drivers, startup programs, and organization-managed policies as possible blockers. A home PC and a business-managed PC can therefore show the same code for different reasons. Fixing the error means identifying or repairing the denied resource rather than repeatedly downloading the same update.
Before changing permissions
- Back up the operating-system disk. Permission and ownership changes affect protected Windows resources. Use a system image or another recovery method that you have verified can restore the machine.
- Sign in with an administrator account. Every command below must run from an elevated Command Prompt unless the step specifically says PowerShell.
- Disconnect unnecessary peripherals. Leave the keyboard, mouse, display, and network connection attached, but temporarily remove nonessential USB devices and external storage.
- Record the failure time. The timestamp helps you match the Windows Update event with entries in CBS.log.
Do not take ownership of the entire Windows directory or grant broad “Everyone” permissions as a shortcut. Those changes can weaken the operating system and do not identify the object that caused the failure.
#1 Best Overall
- Fresh USB Install With Key code Included
- 24/7 Tech Support from expert Technician
- Top product with Great Reviews
Find the denied object in the logs
Logs can show whether the refusal concerns a file, registry key, component, or account before you alter permissions. This is especially useful when a permission reset alone does not work.
- Open Windows PowerShell (Admin) from the Start menu.
- Run
Get-WindowsUpdateLog. Windows creates a readable static Windows Update log on the desktop or in the location reported by the command. - Open
%windir%\Logs\CBS\CBS.login a text editor. Search for0x80070005,error, andaccess denied. - Match the entries’ timestamps with the moment the version 2004 update failed. Note the exact path, registry location, component, or account named in the entry.
If the log names a managed policy or a security product, address that cause before making a broad permission change. If it identifies WinSxS or SoftwareDistribution, continue with the staged repairs below.
Repair 0x80070005 in Microsoft’s escalation order
1. Reset permissions on WinSxS and SoftwareDistribution
These commands reset inherited permissions on the component store and Windows Update cache. They do not delete the files. Open Command Prompt (Admin), run each command, wait for it to finish, and restart Windows before trying the update again.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →icacls "%windir%\WinSxS" /reset /t /c /q
icacls "%windir%\SoftwareDistribution" /reset /t /c /q/reset replaces access-control entries with inherited defaults; /t includes subfolders and files; /c continues if an individual item reports an error; and /q reduces output. Review any access-denied lines rather than assuming the command repaired every object. Restart, sign in again, and retry Windows Update.
2. Restore TrustedInstaller ownership of WinSxS
If the log or the first step indicates an ownership problem in the component store, run this additional command in an elevated Command Prompt:
icacls "%windir%\WinSxS" /setowner "NT SERVICE\TrustedInstaller" /t /c /qRestart after the command completes and run the update again. TrustedInstaller is the Windows servicing identity intended to own protected component-store content. Do not substitute your personal account or Administrators for it merely to make the update proceed.
3. Reset the Windows Update components
A damaged or incorrectly permissioned cache can keep supplying the same failure. This procedure stops the services that use the cache, renames the existing folders so Windows can create clean ones, starts the services again, and then restarts the computer.
- In Command Prompt (Admin), stop the services:
net stop wuauserv
net stop bits
net stop cryptSvcEach service should report that it has stopped. If a service refuses to stop, close Settings, the Windows Update troubleshooter, and other installers, then retry. Do not rename the folders while their files are actively in use.
- Rename the two caches:
ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
ren %systemroot%\System32\catroot2 catroot2.oldRenaming preserves the old folders for rollback or inspection. If a folder with the .old name already exists, choose another unused suffix such as .old2; do not overwrite an existing backup.
- Start the services again:
net start wuauserv
net start bits
net start cryptSvc- Restart Windows. Open Settings > Update & Security > Windows Update, select Check for updates, and retry the version 2004 operation.
The first scan after a reset can take longer because Windows rebuilds its cache and catalog data. If the update fails with the same code, continue rather than repeatedly resetting the same folders.
Rank #2
- Comprehensive Solution: This Windows 10 reinstall DVD provides a complete solution for resolving various system issues, including crashes, malware infections, boot failures, and performance slowdowns. Repair, Recover, Restore, and Reinstall any version of Windows.
- USB will work on any type of computer (make or model). Creates a new copy of Windows! DOES NOT INCLUDE product key.
- Windows not starting up? NT Loader missing? Repair Windows Boot Manager (BOOTMGR), NTLDR, and so much more with this DVD. Clean Installation: Allows you to perform a fresh installation of Windows 11 64-bit, effectively wiping the system and starting from a clean slate.
- Step by Step instructions on how to fix Windows 10 issues. Whether it be broken, viruses, running slow, or corrupted our disc will serve you well
- Please remember that this DVD does not come with a KEY CODE. You will need to obtain a Windows Key Code in order to use the reinstall option
4. Repair the component store with DISM
Deployment Image Servicing and Management can repair corruption in the Windows component store that the upgrade relies on. In an elevated Command Prompt, run:
DISM /Online /Cleanup-Image /RestoreHealthAllow the command to reach 100 percent. Microsoft notes that DISM normally obtains repair files through Windows Update, so a broken update service or network connection can cause DISM itself to report that it could not find source files. If it completes successfully, restart Windows before testing the update. If it fails, record the error text and proceed to SFC; do not delete WinSxS manually.
5. Check protected system files with SFC
After DISM, or when DISM cannot complete, run System File Checker from an elevated Command Prompt:
sfc /scannowWait until verification reaches 100 percent. Restart the computer, then retry Windows Update once. SFC may report that it found and repaired files, found no integrity violations, or could not repair some files. Keep that result: it helps distinguish system-file corruption from a permissions or policy block.
6. Remove temporary interference without weakening security permanently
Third-party antivirus and other security software can intercept update files or prevent changes to protected locations. Drivers, startup utilities, and management agents can do the same. Use the following controlled checks:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Install the latest available updates for your security software and hardware drivers before retrying.
- Temporarily pause a third-party security product only if its documentation provides a supported maintenance mode. Re-enable protection immediately after the test.
- Perform a clean-boot diagnostic if a startup program may be locking files. Record which services you disable so you can restore the original startup configuration.
- On a work or school PC, ask the administrator whether Group Policy, endpoint management, or update rings restrict servicing. Do not attempt to bypass an organizational policy.
- Ensure the system drive has sufficient free space and that the computer remains on reliable power and network service during the retry.
Disabling protection indefinitely is not a repair. If the update succeeds only when a product or policy is disabled, identify the specific rule or agent and obtain a supported configuration from its vendor or administrator.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to choose the next repair
The options differ in how much they change and how much evidence they provide. Use the least disruptive step that matches the log evidence.
| Option | Risk | Scope | Evidence it uses | Reversibility |
|---|---|---|---|---|
| Reset WinSxS and SoftwareDistribution permissions | Higher than a cache reset because protected ACLs are changed | Specific folders involved in servicing and update downloads | CBS.log or Windows Update entries naming those paths | Restart and retry; restore from the backup if required |
| Restore TrustedInstaller ownership | Targeted ownership change; incorrect use can create new servicing problems | WinSxS ownership | Log evidence of an ownership or servicing-identity mismatch | Targeted and repeatable, provided the original state was backed up |
| Reset Windows Update components | Moderate; existing caches are renamed | SoftwareDistribution and catroot2 catalogs and downloads | Repeated cache or catalog failures | Old folders remain under the renamed suffix until removed |
| DISM and SFC | Built-in repair with less direct permission editing | Component store and protected system files | DISM servicing state and SFC integrity results | Changes are managed by Windows; restart is required |
| Installation or upgrade recovery | Highest; may change or reinstall Windows | Broad system state rather than one component | Failure of the preceding repairs and Microsoft’s installation guidance | Depends on the chosen recovery path and a verified backup |
If the error remains after all servicing repairs
Do not jump directly to an arbitrary ISO, reset option, or unofficial download. Microsoft’s installation and upgrade error guidance is the appropriate fallback when permission repair, component reset, DISM, SFC, and interference checks have not resolved the failure.
- Confirm the exact Windows edition, architecture, language, and current build before obtaining installation media.
- Back up personal files and verify that you have the product-activation and application-recovery information needed for your system.
- Choose an in-place repair, upgrade, reset, or clean installation only after reading what each option preserves and removes. There is no single physical product or method that is correct for every system state.
- Keep the CBS and Windows Update logs, command results, and failure timestamp. They are useful to Microsoft support or an organization administrator if the installation path also fails.
A reinstall is a recovery path, not the first response to 0x80070005. The code identifies denied access; the logs and staged repairs determine whether the cause is a permission, cache, component, security product, or policy issue.
Quick Recap
If you want an optional shortcut after trying the manual steps, Outbyte PC Repair can check for and fix more than 100 common Windows issues where possible, including broken system elements and invalid redirects, while also offering settings adjustments, temporary-file cleanup, privacy warnings, vulnerability checks, a real-time boost, file shredding, and an app-crash log. It runs on Windows 11, 10, 8, and 7; a free trial is available by category for at least two days, followed by a paid subscription. It complements antivirus software, results vary, and no tool repairs every crash.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
