A message that starts with 0x800700 is incomplete: the final characters identify the actual Windows Update problem. Capture the complete code (for example, 0x80070005 or 0x8007000d), note whether the failure occurs while checking, downloading, or installing, and record the KB number if Windows shows one. Then follow the branch that matches your suffix. Microsoft associates 0x80070005 with access denied, 0x8007000d with damaged update files or cache, and 0x80070002, 0x80070003, and 0x80070057 with update-installation failures.
Why the complete 0x800700 code matters
Windows error values use a hexadecimal HRESULT format. The 0x800700 portion is a shared prefix, not a diagnosis. The suffix points to a different failure path, so applying a permission repair to a cache-corruption error—or deleting update data when a policy is blocking access—can waste time or create a new problem.
As an Amazon Associate I earn from qualifying purchases.
| Full code | What Microsoft associates with it | Start with |
|---|---|---|
0x80070005 (E_ACCESSDENIED) |
The update process cannot access required files, folders, or registry entries. | Check account rights, security-software interference, and management policy before changing permissions. |
0x8007000d |
Damaged Windows Update files or cache data. | Reset the update cache, then repair the component store and system files if needed. |
0x80070002, 0x80070003, or 0x80070057 |
Windows Update installation-failure categories. | Run the troubleshooter, reset update services and cache, and use DISM and SFC when corruption is indicated. |
The same code can appear at different stages. A download failure usually keeps the problem in the update service, cache, or network-access path; an installation failure can involve the component store, system files, permissions, or a device-management rule. The stage and KB number are therefore as important as the digits.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Before changing anything: capture the failure safely
- Copy the full code. Open the Windows Update page or the dialog that displays the error and write every character after
0x800700. Do not troubleshoot from the prefix alone. - Record the stage. Note whether Windows fails while checking for updates, downloading them, or installing them. If the message names a KB update, record that identifier.
- Use an administrator account. Several repair commands and service changes require elevation. If the computer belongs to an employer or school, the account may still be restricted by device-management policy.
- Save your work and plan a restart. Cache resets and servicing repairs normally require a reboot before you test Windows Update again.
- Back up the operating-system disk before invasive work. This is especially important before any manual permission or registry change. Microsoft advises identifying the exact object that denied access rather than applying broad, recursive permission changes.
Run the built-in Windows Update Troubleshooter
The troubleshooter is the lowest-risk first action for all of the suffixes listed above. It can detect common service and configuration problems before you alter cached files or permissions.
#1 Best Overall
- Open Settings.
- Select System, then Troubleshoot.
- Open Other troubleshooters.
- Find Windows Update and select Run.
- Apply any correction it offers, restart Windows if requested, and retry the same update.
If the troubleshooter reports that it could not repair the issue, keep its result and the original code. That information helps you choose between an access check, a cache reset, and servicing repair instead of repeating the same scan.
When the suffix is 0x80070005: investigate access denied
Microsoft describes 0x80070005 (E_ACCESSDENIED) as a failure to access files, folders, or registry entries required by the update process. Listed causes include incorrect permissions on the WinSxS or SoftwareDistribution folders, incorrect permissions on the Component Based Servicing registry key, third-party antivirus or endpoint-security software locking update files, missing SYSTEM full control on the Windows directory, and Group Policy or other management restrictions.
Check the account and management context
- Sign in with an account that has administrator rights, then run the update again.
- If the PC is managed by an organization, ask the administrator whether Group Policy or another device-management rule restricts Windows servicing or writes to system locations. A local permission change cannot override a policy that is reapplied centrally.
- Do not assume that an administrator account has permission to rewrite every servicing object. Windows protects parts of WinSxS, the Component Based Servicing registry area, and the Windows directory for reliability.
Test security-software interference
Third-party antivirus and endpoint-security products can lock files while Windows Update is trying to replace them. Temporarily test whether the security product is the blocker using its supported pause or maintenance procedure, then immediately restore protection and retry the update. This is a diagnostic test, not a recommendation to leave protection disabled. If the update works only while the product is paused, obtain the product’s documented Windows Update exception or contact its administrator rather than repeatedly disabling it.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsDo not make broad permission repairs first
Changing ownership or recursively granting access to the Windows directory, WinSxS, SoftwareDistribution, or servicing registry keys can make the operating system less reliable. Microsoft’s guidance is to inspect the logs, identify the particular file, registry key, or object that denied access, and only then consider a narrowly scoped correction. Make a backup before such work, and escalate to Microsoft Support if the documented sequence does not resolve the error.
Reset the Windows Update cache
A damaged download or stale metadata in C:WindowsSoftwareDistribution can produce 0x8007000d and several installation failures. Resetting this cache is narrower and more reversible than changing system permissions. Windows will recreate the folder’s working data as it checks for updates again.
Basic SoftwareDistribution reset
- Open Command Prompt with Run as administrator.
- Stop the Windows Update service with
net stop wuauserv. Wait for the confirmation that the service has stopped. - Open
C:WindowsSoftwareDistributionin File Explorer and remove or rename its contents. Renaming the folder (for example, toSoftwareDistribution.old) preserves a rollback copy while forcing Windows to create a fresh cache. - Return to the elevated Command Prompt and run
net start wuauserv. - Restart the PC, open Settings > Windows Update, and try the same update again.
If Windows says files are in use, the service did not stop completely. Close Settings and other update-related windows, verify the service state, and repeat the stop operation rather than deleting files while they are locked.
Advanced service and catalog reset
When the basic reset does not help, Microsoft’s advanced procedure resets the services that download updates and validate their catalogs. Use an elevated Command Prompt and enter these commands in order:
net stop wuauserv
net stop bits
net stop cryptsvc
rename C:WindowsSoftwareDistribution SoftwareDistribution.old
rename C:WindowsSystem32catroot2 catroot2.old
net start cryptsvc
net start bits
net start wuauservwuauserv is Windows Update, BITS handles background transfers, and cryptsvc supports certificate and catalog validation. The rename commands keep the previous folders available instead of permanently deleting them. If a service reports that it is already stopped, continue with the sequence; if a rename fails because the path is missing or locked, stop and resolve that condition before proceeding. Restart Windows after the commands complete.
Repair the component store and protected system files
Use servicing repair when the code persists after a cache reset, when installation fails repeatedly, or when logs indicate damaged component-store or system-file data. Run both tools from an elevated Command Prompt, in this order:
- Run
DISM /Online /Cleanup-Image /RestoreHealth. - Wait for DISM to finish. Do not close the window because the progress can pause while the component store is checked and repaired.
- Run
sfc /scannow. - When SFC reaches 100 percent, restart Windows.
- Retry Windows Update and record whether the same KB and suffix appear.
DISM repairs the Windows component store that supplies replacement files; SFC checks protected system files against that store. Running SFC first can leave it without a healthy source, which is why DISM comes first in this sequence. These commands address corruption evidence; they do not replace an investigation of access-denied permissions or a management policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use logs to identify the object that failed
When the supported resets and repairs do not resolve the problem, inspect the logs before changing permissions manually. Generate or review WindowsUpdate.log, then inspect the newest entries in CBS.log around the exact time of the failed check, download, or installation. Search for “error” and compare the timestamp with the failure you recorded.
- For
0x80070005, look for the file, folder, registry key, or other object named near the access-denied entry. That object—not every system folder—is the possible target for a narrowly scoped fix. - For
0x8007000d, look for cache or file-validation failures. A service/cache reset is generally the safer next step than permissions work. - For
0x80070002,0x80070003, or0x80070057, note whether the failure occurs while staging or committing an installation and whether a particular KB is named. - Keep a copy of the relevant log lines when seeking support. Include the full code, KB number, failure stage, and the commands already attempted.
A log that identifies a specific denied object gives you evidence for escalation. A log that shows broad servicing corruption supports DISM and SFC. If the entries are inconclusive, avoid guessing at registry or ACL changes.
Best Value
Retry in a controlled order
After each intervention, restart if requested and test the same update. Changing several unrelated settings at once makes it impossible to tell which action worked and can obscure a new failure.
- Run the Windows Update Troubleshooter.
- If the full code is
0x80070005, check administrator access, security-software locking, and management policy. - Reset
SoftwareDistribution; use the advancedwuauserv,BITS,cryptsvc, andcatroot2sequence if the basic reset fails. - Run DISM, then SFC, restart, and test again.
- Review
WindowsUpdate.logandCBS.logif the error remains. - Use the log evidence to decide whether a narrowly scoped permission investigation or support escalation is warranted.
Choosing the next action by suffix and risk
| Situation | Likely direction | Relative intervention |
|---|---|---|
0x8007000d with download or file-validation symptoms |
Reset the SoftwareDistribution cache, then run DISM and SFC if corruption remains. | Cache reset is narrower and easier to reverse than permission changes. |
0x80070005 with an access-denied log entry |
Check administrator rights, security-software locking, and policy; identify the named object in the logs. | Permission repair has higher escalation risk and should be evidence-led. |
0x80070002, 0x80070003, or 0x80070057 during installation |
Run the troubleshooter, reset update services and cache, then repair servicing files. | Service/cache reset and DISM/SFC are supported first-line repairs before invasive changes. |
| Any suffix that persists after the supported sequence | Back up the system disk, preserve logs, and contact Microsoft Support. | Escalation avoids unsupported broad changes to protected folders or registry keys. |
When to stop and seek support
Stop making manual changes when the error survives the troubleshooter, the appropriate cache reset, and DISM/SFC, or when logs point to a protected servicing object you cannot identify confidently. Before invasive permission or servicing work, back up the operating-system disk. Give support the complete HRESULT, failure stage, KB number, restart history, command results, and the relevant Windows Update and CBS log entries. Microsoft specifically advises contacting Support when the documented steps do not resolve 0x80070005.
Quick Recap
As an optional shortcut after trying the manual steps, Outbyte PC Repair can address more than 100 common Windows issues, including broken system elements and shared DLL problems, and includes cleanup, settings, vulnerability checks, a real-time boost, file shredding, and an app-crash log. It runs on Windows 11, 10, 8, and 7; its free trial is offered by category for at least two days before a paid subscription. It complements antivirus software rather than replacing it, and results vary—no tool repairs every crash.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
