Windows Update Error 0x80070005 (Access Denied): How to Fix It

Windows Update error 0x80070005 is an “access denied” error (E_ACCESSDENIED). It appears when the update process can’t reach files, folders or registry entries it needs to install an update. The quickest fixes are to make sure you’re using an administrator account and to reset the Windows Update components.

The steps below work on Windows 11 and Windows 10. Start at the top: the early fixes are quick and safe, and the later ones are for stubborn cases.

What causes error 0x80070005

Microsoft lists these causes:

• Your account doesn’t have administrator rights to install updates.
• The TrustedInstaller service account lacks permissions on the %windir%\WinSxS or %windir%\SoftwareDistribution folder.
• Permissions on the Component Based Servicing registry key aren’t correct.
• A third-party antivirus or security tool has locked update files or folders.
• The SYSTEM account doesn’t have Full Control of the Windows folder.
• A Group Policy setting or management agent restricts writes to system folders (common on work PCs).

How to fix Windows Update error 0x80070005

Fix	Cause it addresses	Admin rights
1. Administrator account	Your account can’t install updates	Needed to change
2. Date, time and restart	Pending restart or wrong clock	No
3. Windows Update troubleshooter	Common update problems	No
4. Reset update components	Damaged update cache	Yes
5. DISM	Damaged component store	Yes
6. sfc /scannow	Corrupted system files	Yes
7. Pause third-party antivirus briefly	Security software locking update files	Yes
8. Reset folder permissions (advanced)	Wrong permissions on WinSxS or SoftwareDistribution	Yes

Fix 1: Use an administrator account

Installing updates needs admin rights. To check your account type on a home PC:

1. Select Start, type Control Panel and open it.
2. Select User Accounts > Change your account type.
3. Make sure Administrator is selected.

If you can’t select Administrator, ask the person who manages the PC to install the update or change your account type. On a work or school PC that’s joined to a domain, contact IT, since policies there can block updates on purpose.

Fix 2: Check the date and time, then restart

1. Go to Start > Settings > Time & language > Date & time.
2. Turn on setting the time and time zone automatically, then select Sync now if it’s available.
3. Restart from Start > Power. If you see Update and restart, choose it.

Also unplug external drives, docks and other hardware you don’t need, then try the update again.

Fix 3: Run the Windows Update troubleshooter

• Windows 11: Go to Start > Settings > System > Troubleshoot > Other troubleshooters and run Windows Update. You can also open the Get Help app and search for windows update troubleshooter.
• Windows 10: Go to Start > Settings > Update & Security > Troubleshoot > Additional troubleshooters, select Windows Update and run it.

Fix 4: Reset the Windows Update components

This clears the update cache and restarts the services that handle updates.

Important: These commands need an elevated Command Prompt and change system folders. Microsoft recommends backing up your system drive before troubleshooting this error. Open the prompt by searching for command prompt, selecting Run as administrator, then Yes. Our elevated command prompt guide shows other ways to open it.

Run these commands one at a time and let each one finish:

net stop wuauserv
net stop bits
net stop cryptSvc

These stop the Windows Update, Background Intelligent Transfer and Cryptographic services.

ren %windir%\SoftwareDistribution SoftwareDistribution.old
ren %windir%\System32\catroot2 catroot2.old

These rename the update cache folders so Windows builds fresh ones. Your old copies stay in place with .old at the end.

net start cryptSvc
net start bits
net start wuauserv

These start the services again. Restart the PC and try Windows Update.

Fix 5: Repair the component store with DISM

In the elevated Command Prompt, run:

DISM /Online /Cleanup-Image /RestoreHealth

DISM checks the Windows component store and repairs it, using Windows Update as the repair source by default. It can take a while. Restart when it finishes, then try the update again. If DISM doesn’t report success, run the command again.

Fix 6: Check system files with sfc

Next, run:

sfc /scannow

System File Checker scans protected Windows files and repairs corrupted ones. Restart after it finishes without errors, then retry the update.

Fix 7: Rule out your antivirus

Third-party security software can lock the files Windows Update needs.

Important: Only pause protection for a short time, and don’t browse or open downloads while it’s off. Turn it back on right after the update installs.

1. Temporarily pause real-time protection in your third-party antivirus or firewall.
2. Run Windows Update again.
3. Turn protection back on and update the security software. Check that it supports your version of Windows.

If pausing doesn’t help, Microsoft also suggests temporarily uninstalling the third-party product, updating Windows, and reinstalling it.

IT staff can go one step further. Run fltmc in an elevated prompt to list file system filter drivers. If a non-Microsoft filter driver appears, fltmc unload <DriverName> temporarily unloads it so you can test the update.

Fix 8: Reset permissions on the update folders (advanced)

If nothing else works, Microsoft’s fix for wrong permissions is to reset them on the component store and the update cache.

Important: This changes permissions on core Windows folders. Back up your system drive first, run the commands exactly as written, and if you aren’t comfortable doing this, ask IT or a repair shop.

icacls "%windir%\WinSxS" /reset /t /c /q
icacls "%windir%\SoftwareDistribution" /reset /t /c /q

These restore the default permissions on both folders. Restart and try the update. If it still fails, make sure TrustedInstaller owns the WinSxS folder:

icacls "%windir%\WinSxS" /setowner "NT SERVICE\TrustedInstaller" /t /c /q

Restart once more and retry Windows Update.

If it still doesn’t work

• Read the logs. IT staff can open %windir%\Logs\CBS\CBS.log and look for 0x80070005 - E_ACCESSDENIED entries, or run Get-WindowsUpdateLog in PowerShell to create a readable Windows Update log.
• Check free space. Microsoft recommends at least 20 GB free on 64-bit Windows for updates.
• Work PCs: If a Group Policy or management agent is blocking writes, only your IT department can change it.
• Escalate. If every step fails, contact Microsoft Support or your PC maker.

Update problems sometimes come with other symptoms. If your PC is also slow, see why is my computer so slow, and if a domain PC can’t sign in, read our guide to the trust relationship between this workstation and the primary domain failed. More fixes are in PC repairs and our computer repair tips.