Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Windows Update error 0x80070005 means access denied: the update process cannot read or write a required file, folder, registry entry, or other system resource. The code is commonly shown as E_ACCESSDENIED. The title’s 0X800700005 has an extra zero; use 0x80070005 when searching logs or Microsoft documentation.
Start with the built-in troubleshooter and logs, then repair permissions, reset the update cache, repair the component store with DISM, and finally check protected files with SFC. The command-based repairs require an elevated Command Prompt and a restart between major stages.
As an Amazon Associate I earn from qualifying purchases.
What Windows Update error 0x80070005 means
Microsoft defines 0x80070005 as an access-denied error. Windows Update has reached a file, directory, registry key, or service resource that it needs, but the account or service performing the update is not allowed to use it. This is a permissions and access problem, not a product-specific failure and not, by itself, proof of malware.
The same code can appear while installing a feature update, a cumulative update, servicing-stack components, or another package. The visible message may only say that Windows could not install the update; the more useful detail is usually in the Windows Update log or the Component-Based Servicing log.
#1 Best Overall
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
Microsoft’s troubleshooting article applies to supported Windows client and server versions and Azure virtual machines. The exact policy, security software, and directory permissions on a managed computer can differ from those on a personal PC, so a generic command sequence is not always safe for an organization-controlled device.
Why the error occurs
Windows Update uses several services and protected locations. A change to any one of them can produce the same hexadecimal code. Microsoft identifies these common causes:
- Incorrect permissions on the component store. The TrustedInstaller service may lack the required access to
%windir%WinSxS, the directory that holds Windows component files. - Incorrect permissions on the update cache. Windows Update may be unable to create or replace files in
%windir%SoftwareDistribution. - A damaged or restricted servicing registry key. Permissions on
HKLMSOFTWAREMicrosoftWindowsCurrentVersionComponent Based Servicingcan prevent component installation. - Security software locking update files. A third-party antivirus or endpoint-security product can intercept a file while Windows is trying to replace it.
- Missing SYSTEM rights on the Windows directory. The SYSTEM account needs the permissions required to service Windows under
%windir%, normallyC:Windows. - Group Policy or management controls. A domain policy, device-management agent, or other administrator control may deliberately restrict writes or update behavior.
Because several causes share the same code, the order of diagnosis matters. A troubleshooter and log review are low-risk; changing access-control lists or ownership is more invasive and should be done only after you have a recovery path.
Free tools Windows power users keep installed
One-click scans. No signup required.
Prepare before changing permissions or services
- Confirm the code. Open Windows Update’s history or the error details and verify that the value is
0x80070005, not a visually similar code. - Back up the operating-system disk. Create a system image or otherwise maintain a restore path before changing permissions, ownership, or the servicing image. Keep the backup available until the update succeeds.
- Use an administrator account. Every command in the repair sequence must run with elevation. A standard user will receive access-denied messages even when the underlying Windows installation is healthy.
- Save your work and connect reliable power. Component repairs can take time, and an interrupted servicing operation can leave Windows in a pending state.
- Record the failed update. Note the update’s KB number, the time of failure, and whether the failure happens during download, installation, or a restart. This information helps an administrator match the event to the relevant log entry.
- Check whether the PC is managed. If it belongs to a company, school, or virtual-desktop environment, contact the administrator before altering ACLs or disabling security controls. Policy may be the intended reason that writes are denied.
Run the Windows Update troubleshooter first
On current Windows 11 builds, open Settings > System > Troubleshoot > Other troubleshooters. Find Windows Update and select Run. Follow the suggested actions, allow the troubleshooter to apply a correction when it offers one, and restart if requested.
The troubleshooter can identify common service, cache, and configuration problems without manually rewriting permissions. It does not replace the deeper checks below: if it reports that it could not repair the problem, continue to the logs rather than repeatedly running the same wizard.
Generate logs and identify the denied object
Create a readable Windows Update log
- Open Windows PowerShell as administrator. In Start search, right-click PowerShell and choose Run as administrator.
- Run:
Get-WindowsUpdateLogWindows creates a static WindowsUpdate.log file from the system’s event traces. Open that file and search for 0x80070005, E_ACCESSDENIED, or the KB number you recorded. Look at entries immediately before and after the failure; they can reveal the component or path that was refused.
Inspect the Component-Based Servicing log
Open %windir%LogsCBSCBS.log in a text editor with administrator rights. Search for 0x80070005, Failed to create file, Failed to internally open package, or HRESULT = 0x80070005 - E_ACCESSDENIED. Microsoft’s error guidance recommends locating the relevant error entry near the end of CBS.log, identifying the file or registry object named there, and correcting that object’s permissions rather than changing unrelated parts of the system.
If the log names a specific directory, file, or registry key, write it down. A precise object identified by CBS.log is more useful than applying broad permissions to the entire Windows tree.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Repair Windows Update in a least-invasive order
Use an elevated Command Prompt for the following stages. To open one, search for Command Prompt, right-click it, and select Run as administrator. Type each command exactly, wait for it to finish, and restart Windows at the point specified. If a stage fixes the update, stop there; do not continue to more invasive repairs unnecessarily.
1. Reset permissions on WinSxS and SoftwareDistribution
This stage resets inherited access-control entries on the component store and update cache. It does not delete the directories or their contents.
icacls "%windir%WinSxS" /reset /t /c /q
icacls "%windir%SoftwareDistribution" /reset /t /c /qWait for each command to complete. The switches reset permissions recursively, continue through errors, and suppress most per-file output. Restart Windows, then try Windows Update again. If the code returns, continue to the TrustedInstaller stage.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Do not replace %windir% with a guessed path. On a normal installation it expands to C:Windows, but the variable is safer on systems installed to another drive.
2. Restore TrustedInstaller ownership of WinSxS when required
TrustedInstaller is the Windows servicing identity that should own protected component-store files. If CBS.log or the preceding permission reset indicates an ownership problem, run:
icacls "%windir%WinSxS" /setowner "NT SERVICETrustedInstaller" /t /c /qRestart Windows after the command finishes and retry the update. This command changes ownership recursively, so keep your backup or restore path available. Do not substitute a personal administrator account for TrustedInstaller simply to make the command succeed.
3. Reset Windows Update’s service state and caches
Renaming the two cache directories makes Windows create fresh copies while preserving the old directories for rollback or inspection. In the elevated Command Prompt, run the following block:
net stop wuauserv
net stop bits
net stop cryptSvc
ren %windir%SoftwareDistribution SoftwareDistribution.old
ren %windir%System32catroot2 catroot2.old
net start cryptSvc
net start bits
net start wuauservAfter the commands complete, restart Windows and check for updates. The .old directories remain on the disk; do not remove them until the update works and you are certain you no longer need their contents. If Windows refuses to rename a directory because a service still has it open, verify that the stop commands completed and retry from an elevated prompt after a restart.
Rank #3
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
4. Repair the Windows component store with DISM
Deployment Image Servicing and Management checks the online Windows image and repairs component-store corruption. Run:
DISM /Online /Cleanup-Image /RestoreHealthProgress can pause for an extended period; allow the command to finish. By default, DISM uses Windows Update as its repair source. If Windows Update itself is unavailable or the source files are damaged, Microsoft documents alternate-source procedures; use a source that matches the installed Windows edition and servicing level rather than an arbitrary image.
Restart after DISM reports completion, then try Windows Update. If DISM reports that it could not find source files, keep the exact error text and move to the SFC stage only after you have considered an appropriate repair source or administrator assistance.
5. Check protected system files with SFC
System File Checker verifies protected Windows files and replaces damaged copies from the component store. In the elevated Command Prompt, run:
sfc /scannowLet the scan reach 100 percent. If it reports that it repaired files, restart Windows before trying the update again. If it says that some files could not be repaired, review the result and CBS.log; do not repeatedly run SFC while ignoring an unresolved component-store problem.
Choose the repair stage that matches the evidence
| Approach | Invasiveness | Elevation | Primary problem addressed | Reversibility |
|---|---|---|---|---|
| Windows Update troubleshooter | Low | Not required to start | Common service and configuration faults | Guided changes |
| Windows Update and CBS log review | Low | Elevated PowerShell for log generation | Identifies the denied file, folder, or registry object | Read-only diagnosis |
| ICACLS permission reset | Medium | Elevated Command Prompt | Incorrect ACLs on WinSxS or SoftwareDistribution | Requires a restore path |
| TrustedInstaller ownership restore | High | Elevated Command Prompt | Incorrect owner on WinSxS | Requires a restore path |
| Cache and service reset | Medium | Elevated Command Prompt | Stale or corrupt update cache and service state | Old directories are retained as .old |
| DISM RestoreHealth | Medium | Elevated Command Prompt | Component-store corruption | Image repair can be significant |
| SFC scan | Low to medium | Elevated Command Prompt | Damaged protected system files | Windows controls replacements |
If error 0x80070005 remains
Temporarily isolate third-party security software
A third-party antivirus or endpoint-security product can lock a file while Windows is servicing it. Use the product’s documented pause or maintenance mode only long enough to retry the update, and restore protection immediately afterward. If the update works only while the product is paused, ask the security vendor or your administrator for an update rule rather than leaving protection disabled.
Windows built-in protections and third-party security products have different policies. Do not conclude that an access-denied code means the computer is infected, and do not uninstall security software as a first response.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Inspect file-system filter drivers
File-system filter drivers can intercept reads and writes. In an elevated Command Prompt, run:
Rank #4
- 【Efficient Performance】 Powered by Intel Core i3 processor (2 cores, 4 threads, up to 3.4GHz) with 12GB RAM and 256GB SSD. Handles multitasking, office software, online classes, and HD video streaming smoothly. Integrated Intel UHD Graphics 620
- Backlit Keyboard & Complete Package】Comes with a cool backlit keyboard. Comes with awebcam, dual stereo speakers (8Ω/1.0W each), DC charger, and user manual – ready for late-night studying, online classes, video conferencing, and daily productivity
- 【Vibrant Display】 15.6-inch Full HD (1920x1080) anti-glare screen with 16:9 aspect ratio delivers crisp images and vivid colors – perfect for studying, watching lectures, or entertainment. Thin-bezel design maximizes viewing area
- 【Fast Connectivity & Expansion】 Equipped with WiFi 6 (802.11ax) and Bluetooth 5.2 for stable, high-speed wireless. Features 3 x USB 3.0, HDMI 2.1, Type-C (supports PD3.0 fast charging), and a TF card slot expandable up to 2TB – easily connect external monitors, mice, drives, or expand storage for all your files
- 【Long Battery Life & Portable】 Built-in 11.55V 5000mAh/57.75Wh high-capacity battery delivers approximately 7 hours of mixed-use battery life – enough for a full day of classes and assignments. Lightweight at just 1.63kg (3.6 lbs) and 19.5mm thin, plus a compact packing size – easily slips into a backpack for campus, library, or coffee shop
fltmcReview the listed filters for non-Microsoft drivers that belong to antivirus, backup, encryption, storage, or synchronization software. Record the names and consult the vendor or administrator before changing them. Removing a filter driver without its supported uninstallation process can make the system unstable.
Check SYSTEM permissions on the Windows directory
Microsoft specifically calls out the SYSTEM account’s required access to %windir%. In File Explorer, open the properties of the Windows directory, select Security, and inspect the effective permissions for SYSTEM without making broad changes blindly. If SYSTEM lacks the rights expected for a standard installation, use the CBS.log path and an administrator-approved repair procedure. A domain policy may reapply the restriction after you change it locally.
Review Group Policy and management agents
On a managed device, Group Policy, mobile-device management, patch-management software, or a virtual-machine agent can restrict writes intentionally. Check with the organization that controls the device before resetting ACLs, renaming caches, or disabling a security control. The correct fix may be a policy change or a centrally approved update rather than a local command.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUse an offline image procedure for offline or virtual-machine repair
If Windows cannot boot normally or you are servicing a detached operating-system volume, keep an offline image backup and use DISM’s offline form documented by Microsoft:
DISM /Image:<Drive>: /Cleanup-Image /RestoreHealthReplace <Drive>: with the drive letter assigned to the offline Windows installation in the recovery environment. Drive letters can change in that environment, so identify the volume by its Windows directory before running the command. Do not use the online form against an offline installation.
When to stop and escalate
Contact Microsoft Support or your organization’s administrator when the sequence fails and any of these conditions applies:
- CBS.log identifies a registry key or file whose permissions cannot be restored safely.
- DISM requires source files you do not have, or the image reports errors after repair.
- A managed-device policy, security agent, or filter driver continues to deny writes.
- The computer is a production server or virtual machine where a permission change could affect services or other users.
- Windows cannot boot reliably after servicing attempts and you need offline recovery.
Provide the exact 0x80070005 entry, the relevant CBS.log lines, the failed update’s KB number, and the commands already run. That evidence lets support target the denied object instead of repeating broad cache resets.
Recommended Free Tools
Quick Recap
As an optional shortcut after the manual steps, Outbyte PC Repair can address more than 100 common Windows issues, including broken system elements, invalid redirects, shared DLL files, temporary and cache cleanup, settings that affect CPU, RAM and disk load, vulnerability checks, a real-time boost, file shredding, and an app-crash log. It runs on Windows 11, 10, 8 and 7, offers a category-based free trial of at least two days, and then requires a subscription. It complements antivirus software rather than replacing it; results vary and no tool repairs every update failure.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
