Windows error 0x80070005 means E_ACCESSDENIED: a Windows process cannot access a file, folder, registry entry, service account, or other resource it needs. The right fix depends on where the code appears. For Windows Update, back up the system drive, inspect the update logs, run the repair commands in an elevated Command Prompt, reset the permissions on the update folders, and then reset the update components if necessary. Activation and Office errors use different permission layers, so applying the Windows Update procedure blindly can make the problem worse.
What error 0x80070005 means
Microsoft describes the Windows Update form of this error as an access-denied condition: the update process cannot reach required files, folders, registry entries, or related system resources. The code itself does not identify one damaged file. It tells you that the account or service performing an operation lacks the required access, or that another program or policy is blocking it.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Microsoft Windows 11 (USB) | $128.99 | Buy on Amazon |
| 2 |
|
Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC |... | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
The same hexadecimal code can appear in several products. Identify the operation that failed before changing permissions.
| Where the code appears | Likely permission layer | Use this article section |
|---|---|---|
| Windows Update or update installation | WinSxS, SoftwareDistribution, the component-servicing registry key, SYSTEM or TrustedInstaller, security software, or policy | Windows Update repair sequence |
Windows activation, including slmgr /ato |
Elevation or DCOM access for the SELF account | Activation and DCOM repair |
| Windows logon or an operation involving the Network Service profile | Permissions on the S-1-5-20 registry profile key |
Network Service registry repair |
| Office activation | Office licensing and activation components | Office-specific recovery |
0x80070005 is not, by itself, proof of malware or a failing disk. It is an authorization failure. Security software, a management agent, Group Policy, an interrupted update, or manually changed access-control lists can all produce it.
#1 Best Overall
- Less chaos, more calm. The refreshed design of Windows 11 enables you to do what you want effortlessly.
- Biometric logins. Encrypted authentication. And, of course, advanced antivirus defenses. Everything you need, plus more, to protect you against the latest cyberthreats.
- Make the most of your screen space with snap layouts, desktops, and seamless redocking.
- Widgets makes staying up-to-date with the content you love and the news you care about, simple.
- Stay in touch with friends and family with Microsoft Teams, which can be seamlessly integrated into your taskbar. (1)
Prepare safely before changing permissions
Permission repairs affect the operating system. Microsoft places a backup warning before its procedure, and that is good practice: create a current backup or system image of the Windows drive before editing ACLs, ownership, services, or the registry.
- Sign in with an administrator account. Being an administrator is not the same as running every console elevated; you still need an administrator prompt.
- Save open documents and close installers, update utilities, and system-tuning programs.
- If a business, school, or managed device uses Group Policy or an endpoint-management agent, record that fact. A policy can restore the restrictive setting after you repair it; ask the administrator to test the update instead of repeatedly forcing local changes.
- Temporarily check whether third-party security software is reporting that it has locked an update file. Do not leave protection disabled after a test, and do not treat disabling security software as a permanent fix.
Repair Windows Update error 0x80070005
1. Capture evidence before making changes
Logs help distinguish a permissions problem from a service, policy, or package failure. In PowerShell, run this command to create a static Windows Update log:
Get-WindowsUpdateLogAlso review CBS.log, which records component-based servicing activity. Search for entries such as Failed to create file. [HRESULT = 0x80070005 - E_ACCESSDENIED] or Failed to internally open package. [HRESULT = 0x80070005 - E_ACCESSDENIED]. Note the path, package, account, or service named immediately around the failure. A log entry that identifies a security product or management agent points to interference rather than a generic ACL reset.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →2. Open an elevated Command Prompt
- Open Start and type Command Prompt.
- Right-click Command Prompt and select Run as administrator.
- Approve the User Account Control prompt. The window title should include Administrator.
Run the commands below in that elevated window. A non-elevated prompt commonly returns another access-denied message even when your account belongs to Administrators.
3. Reset permissions on the update folders
Microsoft identifies incorrect TrustedInstaller permissions on %windir%WinSxS and %windir%SoftwareDistribution as documented causes. In the elevated Command Prompt, run:
icacls "%windir%WinSxS" /reset /t /c /q
icacls "%windir%SoftwareDistribution" /reset /t /c /qicacls resets access-control entries under each directory, traverses subfolders with /t, continues past errors with /c, and suppresses routine output with /q. The command can report files it could not process; record those paths rather than assuming every item changed. Restart Windows after both commands, then try Windows Update again.
4. Restore TrustedInstaller ownership of WinSxS
If the update still fails, restore the component store’s owner to the Windows Modules Installer service account (TrustedInstaller):
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchicacls "%windir%WinSxS" /setowner "NT SERVICETrustedInstaller" /t /c /qRestart the computer and retry the update. Do not substitute your personal account or the local Administrators group as the permanent owner; Windows servicing expects TrustedInstaller to control this store.
5. Reset the Windows Update components
A damaged or locked update cache can preserve the error after permissions are corrected. In the same elevated Command Prompt, stop the services that use the cache, rename the two folders, and start the services again:
net stop wuauserv
net stop bits
net stop cryptSvc
ren %windir%SoftwareDistribution SoftwareDistribution.old
ren %windir%System32catroot2 catroot2.old
net start cryptSvc
net start bits
net start wuauservThe ren commands preserve the old directories as SoftwareDistribution.old and catroot2.old while Windows creates fresh working folders. If a net stop command says the service is not running, continue; if a rename says the folder is in use, close update-related programs, reboot, and repeat from an elevated prompt. Do not delete the old folders while troubleshooting; keeping them makes rollback and log comparison easier. After the services restart, reboot once and retry the update.
6. Run the built-in troubleshooter and verify services
If the reset does not work, run the Windows Update troubleshooter from Settings > System > Troubleshoot > Other troubleshooters on current Windows 11 builds, or the corresponding Update & Security > Troubleshoot area on Windows 10. Apply only the changes it reports and restart when prompted.
Open Services (services.msc) and check that Windows Update, Background Intelligent Transfer Service, and Cryptographic Services are not disabled. Their startup behavior can differ by Windows version, so do not force a permanent startup type simply because a guide uses a different setting. Start a stopped service, retry the update, and inspect the logs again if it stops immediately.
7. Check for policy or security interference
Microsoft lists third-party security locks, missing SYSTEM full control on %windir%, incorrect permissions on HKLMSOFTWAREMicrosoftWindowsCurrentVersionComponent Based Servicing, and Group Policy or management-agent restrictions among the causes. Compare the failing timestamp in Windows Update or CBS logs with your security product’s event log and with any management-policy refresh. If the same file is repeatedly locked, have the security or device-management administrator create an approved exception or correct the policy. Repeatedly resetting ACLs without fixing the lock will not solve the underlying failure.
Rank #2
- STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
- PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
- GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.
Fix Windows activation error 0x80070005
When slmgr /ato reports elevated privileges
Microsoft documents an activation message that reads: Error: 0x80070005 Access denied: the requested action requires elevated privileges. First, open Command Prompt with Run as administrator and run the activation command again. If the command is elevated and the error persists, Microsoft identifies missing SELF DCOM permissions as one possible cause.
Restore SELF DCOM access
- Press Windows key + R, enter
dcomcnfg, and press Enter. - In Component Services, expand Computers, right-click My Computer, and choose Properties.
- Open the COM Security tab.
- Under Access Permissions, select Edit Default.
- Add SELF if it is missing.
- Allow Local Access and Remote Access for SELF, then apply the change.
- Restart Windows and retry activation.
DCOM settings are system-wide. Change only the documented SELF entry; do not grant broad access to unknown accounts. If the device is managed, confirm that a policy is not restoring the previous DCOM security descriptor.
Fix the Network Service registry variant
A separate Windows logon or activation scenario requires the Network Service account to have full control and read permissions on:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionProfileListS-1-5-20Before editing the registry, create a restore point or export the key from Registry Editor. Then:
- Press Windows key + R, type
regedit, and press Enter. - Navigate to the key above.
- Right-click the key, choose Permissions, and add NETWORK SERVICE if it is absent.
- Grant that account Full Control and Read, apply the change, and close Registry Editor.
- Restart Windows and repeat the operation that produced 0x80070005.
Use this change only when the error matches the Network Service profile scenario. It is not a general substitute for the Windows Update ACL commands. An elevated prompt may still be required for other commands that happen to return the same code.
When 0x80070005 appears during Office activation
Office activation has its own licensing components and should not be treated as a Windows Update component-store failure. Update Office first, then use Microsoft’s Microsoft 365 activation troubleshooter. Sign in with the account that owns the subscription or license, verify that the installed edition matches that license, and restart Office after the troubleshooter completes. If the activation error remains, the Office activation result and its sign-in or licensing details are more useful than resetting WinSxS or changing DCOM permissions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose the repair path from the symptom
| Observed symptom | First evidence to collect | Most appropriate next action |
|---|---|---|
| Download or installation fails in Windows Update | WindowsUpdate.log and CBS.log entries naming a path or package | Elevated prompt, WinSxS and SoftwareDistribution ACL reset, then TrustedInstaller ownership |
| Updates fail after a security product or management change | Matching timestamps in security or policy logs | Resolve the lock or policy with the administrator; do not repeatedly rewrite permissions |
slmgr /ato returns the activation message |
Whether the console was elevated and whether DCOM access was changed | Run elevated; if still failing, inspect SELF permissions under COM Security |
| Logon or activation references Network Service | Permissions on the S-1-5-20 profile key |
Back up the registry and grant Network Service the documented permissions |
| Office alone cannot activate | Office update state and Microsoft 365 account/license status | Update Office and run the Microsoft 365 activation troubleshooter |
Common mistakes and recovery
Using a normal Command Prompt
Commands that modify protected folders or services can fail immediately when the window is not elevated. Close it and reopen Command Prompt with Run as administrator; do not compensate by granting your everyday account permanent control of system folders.
Applying every fix to every occurrence
The code is shared by Windows Update, activation, logon, and Office. WinSxS resets do not repair an Office licensing problem, and DCOM changes do not repair a locked update cache. Match the procedure to the product named in the error.
Ignoring a policy or locked file
If logs identify a security program, Group Policy, or management agent, local ACL changes may be overwritten or blocked. Coordinate with whoever manages the device and test after the policy or lock is corrected.
Deleting caches before confirming the rename worked
Renaming the update directories is reversible and leaves evidence. If a folder cannot be renamed, a service or process still has it open. Reboot, stop the services again from an elevated prompt, and verify the exact folder path before retrying.
Skipping a restart
Ownership, service handles, and newly created update folders may not be active until Windows restarts. Reboot after ACL or ownership changes and again after the component reset before judging the result.
As an optional shortcut after trying the manual steps, Outbyte PC Repair can address more than 100 common Windows issues where possible, including broken system elements, invalid redirects, shared DLL files, settings that increase CPU, RAM or disk load, temporary and cache files, privacy warnings, vulnerability checks, a real-time boost, file shredding and an app-crash log. It runs on Windows 11, 10, 8 and 7, offers a free trial by category for at least two days, and then requires a subscription; it complements antivirus software rather than replacing it, and results vary.
When to stop and seek administrator help
- The computer is managed by an employer, school, or other organization and policy controls update or DCOM permissions.
- The same ACL error returns immediately after a restart, indicating an active policy or security lock.
- Registry or DCOM changes produce new logon, service, or activation failures.
- The backup or restore point cannot be created, leaving no safe rollback path.
Provide the administrator or support technician with the exact operation that failed, the timestamp, the relevant WindowsUpdate.log or CBS.log lines, and the command output. That information is more actionable than the hexadecimal code alone.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
