0x80070005 is the Windows HRESULT for E_ACCESSDENIED (“Access denied”). It is a permission failure, not a diagnosis of one particular fault. The string in the supplied title, 0X800070005, has an extra zero; verify the exact value in the dialog or log. The correct code used in Windows and Classic OPC documentation is 0x80070005.
Use the repair path that matches the operation that failed. Windows Update needs file, registry and component-store access; activation can require DCOM permissions for the SELF account; Classic OPC/OPC DA commonly needs matching DCOM permissions on both the client and server. The sections below give the manual checks and fixes in a safe order.
As an Amazon Associate I earn from qualifying purchases.
What 0x80070005 means
Windows returns 0x80070005 when a process requests a file, folder, registry entry or DCOM operation and the security system denies it. The code does not identify which permission is missing. A system update, activation service, OPC server, antivirus product, Group Policy or a management agent can all be involved.
The same HRESULT can therefore appear in unrelated applications. Do not apply an OPC fix to Windows Update, or reset broad permissions before you know which subsystem failed. First record the exact message, the application, whether the operation is local or remote, and the Windows account involved.
#1 Best Overall
- Fresh USB Install With Key code Included
- 24/7 Tech Support from expert Technician
- Top product with Great Reviews
Choose the correct repair path
| Where the error appears | Typical access being denied | Start with |
|---|---|---|
| Windows Update or an update installation | Update files, the component store, registry entries, TrustedInstaller or SYSTEM access | Capture WindowsUpdate.log or CBS.log, then repair the documented update-directory permissions |
| Windows activation | DCOM access for the activation components, including the SELF account | Check Component Services default access permissions |
| Classic OPC/OPC DA client | DCOM launch, activation, access or impersonation between client and server | Check both computers, the actual service accounts, firewall and event logs |
| Another application, Office or Store operation | Application-specific files, registry keys, security policy or a locked resource | Identify the denied resource and account before changing permissions |
Prepare before changing permissions
- Write down the complete error text, the time, the program and whether the target is on this computer or another computer.
- Confirm that your account is an administrator. Some operations require an elevated administrator process, not merely membership in the Administrators group.
- Back up important data and note the original settings before changing DCOM or access-control entries. A broad permission change can expose files or allow an unintended account to activate a component.
- If the computer is managed by an organization, check with the administrator before changing Group Policy, endpoint-security rules or service identities. A management agent can restore the old setting or block the repair.
- Do not grant
Everyonebroad rights or disable security software as a first step. Determine the required account and the narrowest scope instead.
Fix 0x80070005 in Windows Update
Microsoft describes this Windows Update error as occurring when the update process cannot access required files, folders or registry entries. Documented causes include incorrect permissions for TrustedInstaller, SYSTEM or the component store; antivirus or other security software locking files; and restrictions imposed by Group Policy or a management agent.
1. Confirm that Windows Update is the failing operation
- Retry the update once and record the exact code and message. Make sure the dialog or log says
0x80070005, rather than a similar-looking value. - Capture the relevant
WindowsUpdate.logorCBS.log. Search for the HRESULT and nearby lines that identify the file, folder, registry operation or account that was denied. A representative entry isFailed to create file [HRESULT = 0x80070005 - E_ACCESSDENIED]. - Note whether the failure occurs while downloading, installing, servicing the component store or restarting. That context helps distinguish a locked cache file from a component-store permission problem.
2. Reset the documented update-directory permissions
Open Command Prompt with Run as administrator. Enter each command exactly as shown. The first targets the Windows component store; the second targets the update download and metadata cache.
icacls "%windir%WinSxS" /reset /t /c /qicacls "%windir%SoftwareDistribution" /reset /t /c /q
/reset replaces access-control entries with inherited defaults, /t processes the directory tree, /c continues if an individual item reports an error, and /q reduces output. The command can take time on a large component store. Do not close the window simply because there is no immediate progress.
3. Restart and test
- Restart Windows after both commands finish.
- Run Windows Update again and record whether the same update, a different update or the whole update service fails.
- If the error returns, capture a fresh log. The new entries may identify a specific account, path or policy that the reset did not address.
4. Check the remaining permission and policy causes
- TrustedInstaller and SYSTEM: Verify that these service identities still have the permissions required by the affected Windows directories and registry locations. Do not replace them with a generic user account.
- Windows directory ACLs: If the log points to another Windows directory, inspect that directory rather than resetting unrelated parts of the system.
- Security software: Antivirus or endpoint-security software can lock an update file. Review its events and policy with the security administrator; use a temporary exception only when the administrator approves it, and restore the policy immediately afterward.
- Group Policy or management agents: A managed setting can deny writes or restore restrictive ACLs. The device owner or domain administrator may need to change the policy at its source.
- Administrator elevation: Microsoft’s activation and update guidance distinguishes ordinary administrator membership from the elevated privileges required by the requested action. Reopen the console with Run as administrator before retrying.
Fix 0x80070005 during Windows activation
In an activation-specific case, the SELF account may lack the DCOM access needed by the activation components. This path is separate from the Windows Update directory reset.
1. Open Component Services
- Press Windows+R, type
dcomcnfg, and press Enter. - In the console tree, open Component Services > Computers > My Computer.
- Right-click My Computer, choose Properties, and open the COM Security tab.
2. Add SELF to default access permissions
- Under Access Permissions, select Edit Default.
- If
SELFis absent, add the account. - Allow Local Access and Remote Access for the required activation operation. Grant only the rights that the activation component needs.
- Save the changes, close Component Services and restart Windows.
Retry activation after the restart. If the error persists, record the activation error and inspect the related event entries rather than adding broad permissions to unrelated accounts.
Fix 0x80070005 in Classic OPC or OPC DA
Siemens describes this OPC case as one in which the client successfully launches the OPC server or OpcEnum but cannot receive a reply because DCOM access-control or impersonation settings block communication. The denied permission can be on the OPC server computer or on the client computer. A local connection and a remote connection therefore need different checks.
1. Establish the connection scope and account identities
- Determine whether the client and OPC server run on the same computer or on two computers.
- Identify the Windows account that actually runs the OPC client. Then identify the account used by the OPC server service or application identity. A user who is logged on interactively may not be the account making the DCOM request.
- For a remote connection, record the names of both computers and the direction of the request. The client account may lack rights on the server, while the server account may lack rights needed on the client.
- Write down the OPC server’s CLSID or APPID when it is available. These identifiers make event-log entries and application-specific DCOM settings easier to match.
2. Review computer-wide DCOM permissions on both computers
- On the client and the server, run
dcomcnfg. - Open Component Services > Computers > My Computer > Properties > COM Security.
- Review Access Permissions and Launch and Activation Permissions. Check both the default permissions and any limits configured for the computer.
- Confirm that the required account is allowed the appropriate local or remote access, launch and activation rights. Apply the narrowest account and scope that matches the deployment.
3. Review the OPC application’s identity and permissions
- In Component Services, open Component Services > Computers > My Computer > DCOM Config.
- Locate the OPC server application using its name, CLSID or APPID, then open its properties.
- Check the application identity and its launch, activation and access permissions. Ensure that the configured identity is the account you identified in the first step and that the account has the required rights on the appropriate computer.
- Do not solve an unknown identity problem by granting full access to every user. Correct the service identity or add the specific account that the vendor’s deployment requires.
4. Check impersonation
Review the default impersonation level in the DCOM settings. Siemens identifies an Anonymous setting without an appropriate Anonymous Logon access-control entry as one possible cause of 0x80070005. If the client relies on anonymous access, verify that the required ACE exists on the relevant computer; otherwise use the authenticated identity required by the OPC deployment. Change one setting at a time and test after each change.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →5. Check firewall and endpoint-security rules
DCOM can be correctly configured and still fail when Windows Firewall or endpoint-security policy blocks the traffic. On both computers, review the rules and security events for the OPC client, server and required DCOM communication. Ask the security administrator to create a narrowly scoped rule for the documented computers, accounts and ports rather than disabling the firewall globally.
Rank #2
- Dual USB-A & USB-C Bootable Drive – compatible with nearly all Windows PCs, laptops, and tablets (UEFI & Legacy BIOS). Works with Surface devices and all major brands.
- Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
- Complete Windows Repair Toolkit – includes tools to remove viruses, reset passwords, recover lost files, and fix boot errors like BOOTMGR or NTLDR missing.
- Reinstall or Upgrade Windows – perform a clean reinstall of Windows 7 (32bit and 64bit), 10, or 11 (amd64 + arm64) to restore performance and stability. (Windows license not included.). Includes Full Driver Pack – ensures hardware compatibility after installation. Automatically detects and installs drivers for most PCs.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
6. Use event logs to identify the denied principal
- Reproduce the OPC failure once after recording the current settings.
- Review the Windows event logs on both the client and server for the same timestamp.
- Look for the denied security identifier (SID), the CLSID or APPID, and whether the failure was Local Activation, Remote Activation, local access or remote access.
- Use those identifiers to adjust the matching DCOM entry, then test again. If the event points to the opposite computer, make the change there rather than repeatedly changing the client.
7. Escalate vendor-specific OPC configuration
Classic OPC deployments vary in their service accounts, anonymous-logon requirements and vendor-specific DCOM settings. If the logs identify a vendor application but do not make the required identity clear, obtain the vendor’s DCOM configuration guidance. Preserve the original settings and the event details so the change can be reviewed or reversed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When the error appears elsewhere
For an Office, Store or another application operation, the HRESULT still means access was denied, but the correct resource is application-specific. Use the same diagnostic sequence without applying unrelated fixes:
- Capture the exact message and the operation that failed.
- Identify the account and whether the resource is local or remote.
- Use the application’s log or Windows event log to identify the denied file, registry entry, CLSID, APPID or security identifier.
- Check administrator elevation, Group Policy, management-agent restrictions and security-software locks.
- Change only the permission or policy that the evidence identifies, then retry and record the result.
If no resource or account is identified, stop before changing system-wide ACLs. An unexplained broad reset can create a larger security problem while leaving the original denial untouched.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Common mistakes and recovery
Using the malformed code
Searches for 0X800070005 can miss the authoritative documentation. Recheck the dialog, log or event entry and use 0x80070005 when comparing guidance.
Resetting permissions on the wrong subsystem
The WinSxS and SoftwareDistribution commands address a Windows Update failure. They do not repair OPC DCOM ACLs or activation permissions. Conversely, changing DCOM settings will not repair an update cache ACL.
Changing only one side of a remote OPC connection
A remote OPC request crosses two security boundaries. Check the client and server accounts, access rights, launch and activation rights, impersonation and firewall policy on both computers.
Granting excessive rights
Adding Everyone, allowing every remote activation or disabling endpoint security may hide the symptom while weakening the system. Use the denied SID, CLSID or APPID from the event log to make a limited change and document it.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFailing to restart or retest
Activation and service-account changes may not affect an already running process. Restart Windows when the procedure requires it, restart the affected service when permitted by its administrator, and reproduce the same operation so the new log entry can be compared with the old one.
Quick Recap
Final decision checklist
- The exact value is
0x80070005and the failing subsystem is known. - The account making the request, and whether the request is local or remote, are documented.
- Windows Update logs identify the denied path, or the documented component-store and cache ACL reset has been completed from an elevated console.
- Activation troubleshooting includes
SELFin the required default COM access permissions. - OPC troubleshooting checks DCOM access, launch and activation, application identity, impersonation, firewall and event logs on both computers.
- Any policy or security-software change is approved, narrowly scoped and reversible.
As an optional shortcut for non-driver Windows permission and cleanup problems, Outbyte PC Repair can address more than 100 common Windows issues, adjust settings, clean temporary and cache files, check vulnerabilities and provide an app-crash log. It runs on Windows 11, 10, 8 and 7, offers a free trial by category for at least two days, and then requires a subscription. It complements antivirus software rather than replacing it; results vary, and no tool repairs every crash.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
