Windows Update error 0x80070005 is more specific than most update failures. Microsoft identifies it as E_ACCESSDENIED: the update process tried to use a required file, folder, or registry entry, but Windows would not allow access.
That can happen when permissions on the Windows component store or update cache are wrong. Microsoft also lists third-party security software, restricted SYSTEM permissions, Group Policy, and device-management agents as possible causes. The message does not mean you should give your own account control of every Windows folder. Broad ownership and “Everyone: Full Control” fixes can weaken security and create a larger servicing problem.
Use the low-risk checks first. The permission commands later in this guide come directly from Microsoft’s current 0x80070005 procedure.
Start with the account and troubleshooter
Some updates require an administrator account. If this is your PC, sign in with an account that shows Administrator under Settings > Accounts > Your info, or ask the PC’s administrator to install the update. When Windows displays a User Account Control prompt, approve it only for the Windows tool you intentionally opened.
If the device belongs to your employer or school, pause here. Microsoft says a Group Policy setting or management agent can intentionally restrict system directories. Your IT team should check the update policy; trying to override it locally may violate the organization’s setup.
For a personal PC:
- Restart Windows.
- Open Settings > System > Troubleshoot > Other troubleshooters.
- Select Run beside Windows Update and complete the prompts.
- Restart once more, then go to Settings > Windows Update > Check for updates.
If 0x80070005 returns, note the failed update’s KB number in Windows Update > Update history and continue.
Back up before changing permissions
Microsoft’s dedicated 0x80070005 article says to back up the operating-system disk before its advanced repairs. Verify a current system-drive backup; at minimum, back up important personal files. If device encryption is enabled, confirm that you can access the BitLocker recovery key.
The commands below must be run from Command Prompt as administrator. Copy them exactly. %windir% represents the Windows system folder, normally C:\Windows.
1. Reset permissions on the component store and update cache
Search for Command Prompt, right-click it, select Run as administrator, and approve the prompt. Run these commands one at a time:
icacls "%windir%\WinSxS" /reset /t /c /q
icacls "%windir%\SoftwareDistribution" /reset /t /c /q2. Restore TrustedInstaller as the WinSxS owner
If the error remains, reopen administrator Command Prompt and enter Microsoft’s ownership command:
icacls "%windir%\WinSxS" /setowner "NT SERVICE\TrustedInstaller" /t /c /qTrustedInstaller is the Windows servicing account; seeing its name here is normal. Let the command finish, restart, and test the update again.
3. Rebuild the Windows Update working folders
Still seeing Access Denied? Reset the update components so Windows can create fresh working folders. In administrator Command Prompt, run each line separately:
net stop wuauserv
net stop bits
net stop cryptSvc
ren %windir%\SoftwareDistribution SoftwareDistribution.old
ren %windir%\System32\catroot2 catroot2.old
net start cryptSvc
net start bits
net start wuauserv4. Repair the component store and system files
Permission problems can exist alongside component corruption. Open administrator Command Prompt and run:
DISM /Online /Cleanup-Image /RestoreHealthWait for DISM to complete successfully, then run:
sfc /scannowDo not close the window before SFC reaches 100 percent. Restart and try Windows Update again. DISM normally uses Windows Update as a repair source, so if it fails because it cannot obtain source files, keep the exact DISM error for Microsoft Support.
5. Check third-party security software carefully
Microsoft lists antivirus or security tools that lock update-related files as another possible cause. This applies to third-party security suites, not a reason to dismantle Windows Security.
First update the security program itself. If its vendor provides a documented temporary-pause option, pause real-time protection only long enough to test Windows Update, then turn it back on immediately. Do not download files or browse during the test. If the update works only while the suite is paused, install a compatible version or ask its vendor for help.
Microsoft’s technical article also discusses unloading non-Microsoft file-system filter drivers. That is a support-level step; home users should not unload drivers by guesswork.
6. Repair-reinstall the current Windows version
Windows 11 can reinstall its current version specifically to repair system files and components while preserving apps, files, and settings.
Open Settings > System > Recovery. Under Fix problems using Windows Update, select Reinstall now. Keep the PC connected to power and the internet until it finishes, and restart when prompted. If the option is not displayed, the PC may be managed or may not have the prerequisite Windows updates; Microsoft documents both limitations.
If Access Denied still appears
Generate a readable Windows Update log by opening PowerShell as administrator and running:
Get-WindowsUpdateLogThe command writes WindowsUpdate.log to the current user’s desktop. Search it for 0x80070005. The component servicing log is at %windir%\Logs\CBS\CBS.log. Give the logs, failed KB number, and Windows build from winver to Microsoft Support or your IT administrator. Avoid manually editing Component Based Servicing registry permissions unless support has identified the exact denied object.
Frequently asked questions
Is 0x80070005 always a Windows Update error?
No. E_ACCESSDENIED can appear in apps, Microsoft Store, activation, backups, and other contexts. These steps are for the code shown while Windows Update downloads or installs an update.
Should I take ownership of the entire Windows folder?
No. Microsoft’s procedure targets WinSxS and SoftwareDistribution and restores TrustedInstaller ownership on WinSxS. A blanket ownership change can damage the permission model Windows servicing expects.
Will resetting SoftwareDistribution remove installed updates?
No. The reset moves aside Windows Update’s working cache; it does not roll back updates already installed. Pending packages may need to download again.
Why does my work PC keep rejecting the commands?
It may be intentionally managed. Microsoft lists Group Policy and management-agent restrictions among the causes of 0x80070005. Send the error and KB number to IT instead of trying to bypass those controls.
Official Microsoft sources
- Microsoft Learn: Troubleshoot Windows Update error 0x80070005
- Microsoft Support: Troubleshoot problems updating Windows
- Microsoft Support: Repair missing or corrupted system files with DISM and System File Checker
- Microsoft Support: Fix issues by reinstalling the current version of Windows
- Microsoft Learn: Get-WindowsUpdateLog PowerShell command
- Microsoft Support: Verify administrator status in Windows
- Microsoft Support: Find your BitLocker recovery key
