What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“Error 5: Access is denied” is a message, not a diagnosis. Windows uses it in different situations, including service startup, SQL Server startup, Active Directory replication, and file or software operations. The right fix depends on what failed, which account tried to do it, and which resource that account could not access.
Start by recording the full message and the action that triggered it. Then follow the path for that specific operation. Running a program as an administrator may help with an elevation problem, but it does not automatically grant a service account access to a folder or repair a domain policy or event-log permission.
As an Amazon Associate I earn from qualifying purchases.
First identify what returned Error 5
Write down the complete error text, the program or service involved, and the action immediately preceding the failure. “System error 5 has occurred” from a command, an installer’s access-denied message, and a service-start failure may share the same wording without sharing the same cause.
Recommended Free Tools
Use these questions to choose a troubleshooting path:
#1 Best Overall
- Dual USB-A & USB-C Bootable Drive – compatible with nearly all Windows PCs, laptops, and tablets (UEFI & Legacy BIOS). Works with Surface devices and all major brands.
- Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
- Complete Windows Repair Toolkit – includes tools to remove viruses, reset passwords, recover lost files, and fix boot errors like BOOTMGR or NTLDR missing.
- Reinstall or Upgrade Windows – perform a clean reinstall of Windows 7 (32bit and 64bit), 10, or 11 (amd64 + arm64) to restore performance and stability. (Windows license not included.). Includes Full Driver Pack – ensures hardware compatibility after installation. Automatically detects and installs drivers for most PCs.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
- What failed? A command or file operation, software download or installation, Task Scheduler service startup, SQL Server startup, or domain-controller replication?
- Which identity performed the operation? Your signed-in account, the SYSTEM account, a configured service account, or a domain identity?
- Which resource was denied? A file or folder, the System event log, a service, or a network or domain resource?
- Where did it happen? On a personal Windows PC or in a managed Windows Server or domain environment?
These distinctions matter: Microsoft documents different causes and remedies for Task Scheduler, Active Directory replication, and SQL Server, despite the shared Error 5 wording.
Check elevation and the identity that actually runs the operation
If the failed action is a command or installer, determine whether it needs an elevated process and whether it was launched with the expected account. If it is already running elevated, do not assume that elevating again will solve the problem. Elevation does not by itself change a resource’s access-control rules or remove a policy restriction.
For a service, check its configured service account rather than relying on the permissions of the person who started it. A service can run under an identity with different permissions from your interactive account. Microsoft’s SQL Server guidance, for example, directs administrators to check the service account’s access to the installation folder.
Free tools Windows power users keep installed
One-click scans. No signup required.
Match the remedy to the failure
| What failed | Identity or resource to investigate | Relevant guidance |
|---|---|---|
| Task Scheduler service startup | SYSTEM’s write access to the System event log; the event log’s security descriptor | Microsoft’s Task Scheduler service startup troubleshooting |
| Active Directory replication | Domain-controller security, trust, authentication, time, network, and policy conditions | Microsoft’s Active Directory replication Error 5 guidance |
| SQL Server service startup | The configured SQL Server service account’s effective permissions on the installation folder, including any explicit Deny | Microsoft’s SQL Server startup guidance |
| Software download or installation | The specific file operation, account, installer source, and any security-product detection or quarantine record | A Microsoft Q&A report of one software-download case |
Task Scheduler service will not start
For this particular service-start failure, Microsoft states: “This error occurs because the NT AUTHORITYSYSTEM account doesn’t have write permissions to the System event log.” A customized CustomSD value may have removed the expected access.
Check the System and Task Scheduler event logs and follow Microsoft’s procedure for inspecting the event-log security descriptor. The documented registry location is HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventLogSystemCustomSD. Verify the SYSTEM access entry against Microsoft’s scenario-specific guidance; do not copy or improvise an SDDL value from unrelated advice. A change to this descriptor can affect security, so make it only when the evidence points to this Task Scheduler issue.
Active Directory replication fails with Error 5
Treat a replication failure as a domain-controller diagnosis, not as a generic desktop permissions problem. Microsoft lists possible causes including an invalid security channel or password mismatch, a broken trust, a full security log combined with CrashOnAuditFail, excessive time skew, RPC restrictions, missing network logon rights, SMB signing mismatch, and other Kerberos or network conditions.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
Begin with the diagnostics Microsoft recommends, including DCDIAG /TEST:CheckSecurityError and NETDIAG, then investigate the condition those checks identify with an administrator familiar with the domain. Do not apply registry workarounds just because replication returned Error 5. Microsoft cautions that incorrect registry changes can cause serious problems and advises backing up the registry before making them.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →SQL Server service will not start
Find the account configured for the SQL Server service and inspect its effective access on the relevant SQL Server installation folder. Check for an explicit Deny as well as missing permissions; a Deny can prevent access even when other permissions appear to allow it. Microsoft’s guidance focuses on the service account and folder permissions, so changing the interactive administrator’s access is not a substitute for checking the account the service uses.
A download or installer reports access denied
Check whether the account can access the exact destination or file involved, confirm that the installer came from a source you trust, and review your security product’s detection or quarantine records. In one Microsoft Q&A case, the person reported that antivirus detection of a Rust package tool explained an “(os error 5)” denial despite running PowerShell as administrator. That is a report about one case, not evidence that antivirus is generally responsible or that protection should be disabled.
A command or other file operation fails
Confirm which command failed, what file or folder it was trying to use, and which account the process ran as. Check that resource’s permissions and look for an applicable explicit Deny or policy restriction. “Run as administrator” is relevant only if the operation needs elevation; it cannot be assumed to correct every access-control failure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Make the narrowest supported change, then verify
- Capture the failure. Record the full error, the operation, the affected resource, and—if it is a service—the configured service identity.
- Choose the matching scenario. Use the relevant Microsoft procedure above rather than a fix intended for a different service or environment.
- Confirm the denied access. Check the permissions, identity, event logs, diagnostics, or security-product records appropriate to that scenario.
- Change only what the diagnosis supports. Avoid broad ownership changes, wholesale permission resets, indiscriminate security-software disabling, or unrelated registry edits.
- Retry and inspect the relevant logs. Confirm whether the original operation succeeds and whether a new event or diagnostic points to a remaining issue.
If the failure involves a managed domain or server and the diagnostics point to trust, authentication, policy, or network conditions, involve an administrator responsible for that environment rather than applying desktop-oriented permission advice.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
