Windows Update Error 0x80070005: Access Denied Fix

Jake's shop laptop refused three Patch Tuesday updates in a row before he called: every attempt stopped dead at 0x80070005, "Access Denied." The direct fix is almost always a permissions problem on two hidden Windows folders — not a virus, not a broken download, and almost never your account. Here's the counterintuitive part: the account that's usually missing permission isn't yours at all. It's TrustedInstaller, the hidden system account that owns most of Windows itself. Reset its permissions on two folders and most 0x80070005 errors clear in under ten minutes.

What error 0x80070005 actually means

0x80070005 is Windows shorthand for a Win32 error code, and the plain-English translation is E_ACCESSDENIED — access is denied. When it shows up during a Windows Update run, it means the update process itself tried to write to, delete, or read a file, folder, or registry entry it needed, and the operating system's own permission system said no. It isn't a download failure, a network fault, or (in most cases) malware. It's Windows refusing itself permission to finish the job.

You can see this directly if you're willing to dig into the logs. Windows Update failures get written to two places: CBS.log (the Component-Based Servicing log, which tracks the actual installation of update packages) and the Windows Update log itself, which isn't stored as plain text by default anymore — you generate a readable copy by opening PowerShell as administrator and running Get-WindowsUpdateLog. Search either output for 0x80070005, and next to it you'll typically see a line like Failed to create file or Failed to internally open package, both tagged with the same access-denied code. That confirms the error is coming from Windows Update's own component-servicing process, not a random app.

The five real causes behind it

There's a lot of vague "corrupted files or incorrect configurations" language floating around about this error. The actual documented causes are narrower than that, and knowing which one you've got saves you from running six fixes when you only needed one.

Before you touch anything

Every command below is safe on a normal PC, but back up your files first anyway — that's the standard advice before any permissions or component-store repair, and it costs you five minutes against the possibility of a bad afternoon. Then run through this short list, because it clears the error for a meaningful share of people before you ever open a command line.

1. Back up your files. Copy anything irreplaceable to a USB drive or OneDrive. If you sign in with a Microsoft account, most system settings restore automatically once you're back online after any repair.
2. Confirm you're signed in as an administrator. Some updates require it outright. Go to Settings > Accounts > Your info and check the label under your name, or ask whoever set up the PC to run the update for you if you're on a standard account.
3. Unplug anything you don't need. External drives, docks, and USB hubs occasionally interfere with servicing operations. Disconnect what isn't essential and try the update again before doing anything else.
4. Check your date and time. Settings > Time & language > Date & time, and make sure "Set time automatically" and "Set time zone automatically" are both on. A clock that's drifted can break the secure connection Windows Update relies on.
5. Run the built-in troubleshooter once. Settings > System > Troubleshoot > Other troubleshooters > Windows Update > Run. It won't fix a permissions problem on its own, but it clears a handful of adjacent issues fast, and it's worth ruling out before the manual fixes.

If none of that clears it, the problem is genuinely a permissions or component-store issue, and the fixes below are listed in the order to run them — cheapest and safest first, most drastic last.

Fix 1: Reset permissions on the component store

The "component store" is the folder where Windows keeps every version of every system file it might ever need to roll back to or repair from — it's how Windows can undo a bad update. If the permissions on that folder, or on the folder where downloaded updates land, get scrambled, the update process can't write to either one, and you get 0x80070005.

Open Command Prompt or Terminal as administrator (search for it, right-click, "Run as administrator"), and run these two commands one at a time, letting each finish:

icacls "%windir%\WinSxS" /reset /t /c /q
icacls "%windir%\SoftwareDistribution" /reset /t /c /q

icacls is the built-in Windows tool for reading and changing NTFS permissions from the command line; it replaced the older cacls tool years ago, and it's what you should be using — not the standalone subinacl download some older forum threads still recommend, which hasn't been the supported route for this problem in a long time. /reset restores the folder's permissions to their inherited defaults, /t applies it to every subfolder and file, /c tells the command to keep going past any individual file it can't touch instead of stopping, and /q keeps the output quiet. This doesn't delete or move anything; it only rewrites who's allowed to access what. Restart, then check for updates again.

Fix 2: Make TrustedInstaller the owner of WinSxS again

If the error survives Fix 1, the next thing to check is ownership, which is a separate setting from permissions. A folder can have all the right permissions listed and still misbehave if the wrong account owns it. TrustedInstaller — a built-in Windows service account, not a person, not your antivirus, and not something you can select from a normal user list — is supposed to own the WinSxS folder specifically so ordinary programs, including malware, can't tamper with core system files.

icacls "%windir%\WinSxS" /setowner "NT SERVICE\TrustedInstaller" /t /c /q

Type the account name exactly as shown, including the backslash — "TrustedInstaller" on its own is not a valid account name and the command will fail. Restart and try the update again.

Fix 3: Reset the Windows Update components

This one is aimed at a slightly different problem: not the folder permissions themselves, but corrupted files sitting inside the update cache that Windows keeps re-trying and re-failing on. Renaming the cache folders forces Windows to rebuild them from scratch the next time the update service starts.

net stop wuauserv
net stop bits
net stop cryptSvc

ren %windir%\SoftwareDistribution SoftwareDistribution.old
ren %windir%\System32\catroot2 catroot2.old

net start cryptSvc
net start bits
net start wuauserv

Run each line in order and let it complete before the next. The three services you're stopping handle the update service itself (wuauserv), the background transfer of downloaded files (bits), and the cryptographic signature checks Windows runs on every update package (cryptSvc) — all three need to be stopped before you rename their working folders, and restarted afterward. Windows recreates fresh, empty versions of both folders automatically. The old folders aren't deleted, just renamed, so nothing is lost; you can remove SoftwareDistribution.old and catroot2.old later once you've confirmed updates are installing again.

Fix 4: Repair the component store with DISM

If permissions and ownership are fine but the error keeps citing the Component Based Servicing registry key specifically, the actual component files are likely damaged, not just mis-permissioned. DISM (Deployment Image Servicing and Management) can rebuild them.

DISM /Online /Cleanup-Image /RestoreHealth

This uses Windows Update itself as the source to pull down clean replacement files, so it needs an internet connection, and it can take anywhere from a few minutes to over an hour depending on how much needs replacing — let it run without interrupting it. You'll see a confirmation that the restore operation completed successfully. If it doesn't confirm, run the exact same command a second time; DISM sometimes needs two passes.

Fix 5: Run System File Checker

Once DISM has fixed the component store, run System File Checker to confirm the individual system files that store draws from are also intact:

sfc /scannow

Let it reach 100% before closing the window. If it reports that it found and repaired corrupted files, that's a good sign — it's confirming the earlier steps had something real to fix. If it reports it found no issues, that's fine too; it means the component store itself, not individual files, was the problem, and DISM already handled it. Restart and try the update once more.

Fix 6: Rule out antivirus and third-party filter drivers

Security software works by inserting itself into the file system to inspect files as they're written, which is precisely what an update installation does hundreds of times over. If your antivirus is misreading that activity as suspicious, it can quietly block the write and hand Windows the exact same access-denied result a permissions fault would.

Temporarily pause real-time protection in your antivirus software's settings, then list the file system filter drivers currently loaded:

fltmc

Anything in that list that isn't a Microsoft driver is a candidate. You can unload one temporarily with fltmc unload DriverName, using the exact name from the list, then try the update again. Don't leave real-time protection off any longer than the test takes, and don't uninstall security software permanently just to chase this error — pause it, test, and turn it back on.

Doing this on Windows 11

The commands above are identical on Windows 11, but a few things around them are worth flagging.

1. Try the built-in troubleshooter first. Settings > System > Troubleshoot > Other troubleshooters > Windows Update > Run. On current Windows 11 builds this can also launch from the Get Help app as a guided automated tool.
2. Watch for the "Fix issues" button. If Windows Update in Settings shows a "Can't install updates" notice, there's usually a Fix issues button right there on the Windows Update page that runs a similar automated check before you ever need a command line.
3. Elevated Terminal replaces the old right-click menu. Right-clicking Start no longer shows "Command Prompt (Admin)" directly — search for "Terminal," right-click the result, and choose "Run as administrator," or use the Win + X quick-link menu, which still opens an elevated Terminal.
4. If nothing above clears it, Settings > System > Recovery offers a "Fix problems using Windows Update" option that reinstalls the current version of Windows using a repair download, without wiping your files. It's a step short of a full clean install and worth trying before that.

Group Policy Editor (gpedit.msc) is Pro, Enterprise, and Education only — Windows 11 Home doesn't include it, so if a cause points at a Group Policy restriction, Home users won't have that panel to check locally at all; that's covered under hard cases below.

Doing this on Windows 10

Every command in this guide runs the same way on Windows 10. The troubleshooter path is Settings > Update & Security > Troubleshoot > Additional troubleshooters > Windows Update. But before you spend time on permissions fixes, there's a question worth asking first that most guides skip entirely.

If you are enrolled in ESU, or you're troubleshooting a normal in-support update, everything in Fixes 1 through 6 applies exactly as written. One honest note: Windows 10 will keep booting and running fine without ESU, but treating an unsupported machine's update failures the same as a supported one's is where a lot of wasted troubleshooting time comes from. If you're weighing whether to keep fighting Windows 10 updates or move on, the hardware and setup side of that decision is covered in what's new in the August 2026 Windows 11 cumulative update.

When nothing above works

A small number of cases don't clear with any of the six fixes above, and it's worth being upfront about which ones and why.

Domain-joined or managed work laptops. If your device is managed by an employer or school through Group Policy or a mobile device management agent, write access to system directories can be restricted centrally, and no local command you run will override that. You'll need your IT administrator to check the policy or the management console on their end — this is one of the documented causes, and it's outside what any local fix can touch.

Persistent corruption after a full repair pass. If DISM and SFC both report they can't fix what they find, the underlying disk or file system may have deeper damage. chkdsk /f C: from an elevated command line, followed by a restart to let it run, is the next honest step — but if that also comes back with unrepairable sectors, the realistic options become the "Fix problems using Windows Update" recovery reinstall mentioned above, or, as a last resort, Microsoft's clean installation tool from the official Windows 11 download page. A clean install wipes the drive, so it's genuinely last on the list, not a shortcut.

Third-party "permission repair" tools. A search for this error turns up a fair number of standalone registry cleaners and "one-click permission fixers" claiming to solve it automatically. There's no way to verify what any of them actually change under the hood, and running an unfamiliar tool with elevated access against your system permissions is a real risk, not a shortcut. The commands in this guide come directly from Microsoft's own troubleshooting documentation for this exact error and touch only the folders documented as the cause — stick to those.

Which fix should you actually run first

Ethan put it this way when Jake asked whether it was safe to just run every fix at once and save time: "Don't. Run them in order and test after each one — if you jump straight to a DISM repair and it happens to work, you'll never know it was actually the icacls reset that would've fixed it in two minutes flat. Skipping the order just means you'll be back here next time with no idea which step actually matters."

For IT admins: the same error at fleet scale

On managed fleets, 0x80070005 during updates usually is not a per-machine permissions accident — it is policy or tooling stepping on the servicing stack. Three places to look before touching icacls on fifty machines: first, security software with filter drivers deployed fleet-wide (the same Fix 6 logic, but one exclusion policy for C:\Windows\SoftwareDistribution and catroot2 fixes every seat at once). Second, GPOs or MDM profiles that harden file-system ACLs or restrict the Windows Update service account — a hardening baseline applied a little too enthusiastically is a classic source. Third, the client-side logs at scale: Get-WindowsUpdateLog and %windir%\Logs\CBS\CBS.log name the exact object access that was denied, and Intune remediation scripts (or ConfigMgr run scripts) can run the Fix 3 service-reset non-interactively across a collection. If devices are WSUS or Windows Update for Business clients, check compliance reporting for whether the failure clusters on one update or one hardware model before assuming every machine needs hands-on repair.

Frequently asked questions

What does error 0x80070005 actually mean?

It's the Windows error code for E_ACCESSDENIED — access is denied. During Windows Update it means the update process couldn't write to, read, or delete a file, folder, or registry entry it needed to finish installing.

Is 0x80070005 the same as "Access Denied" in the Microsoft Store?

They share the same underlying error code and general cause — a permissions or ownership problem — but the affected folders are different. Windows Update issues center on WinSxS and SoftwareDistribution; Microsoft Store issues more often involve the WindowsApps folder or the Store's own cache, which is cleared with the separate wsreset command rather than the fixes in this guide.

Do I need to be signed in as an administrator to fix this?

Yes. Every command in this guide requires an elevated Command Prompt or Terminal, which requires an administrator account. If you're on a standard account, either ask an administrator on the device to run these steps or have your account elevated first.

Will resetting permissions on WinSxS delete any of my files?

No. The icacls /reset command only changes who has permission to access the folder and its contents — it doesn't move, delete, or modify any file inside it. Backing up beforehand is still good general practice before any system repair, but this specific command carries no deletion risk.

What is TrustedInstaller and why does it own my Windows folders?

TrustedInstaller is a built-in Windows service account, not a user account you can log into. It's designed to own core system folders and files specifically so that ordinary programs, including malicious ones, can't modify or delete critical Windows components — only the servicing process itself, running as TrustedInstaller, is normally allowed to.

Can antivirus software really cause this error?

Yes. Security software inspects files as they're written to disk, which is exactly what happens during an update installation. If it misreads that activity, it can block the write attempt, and Windows reports the resulting failure as the same access-denied code a genuine permissions problem would produce.

Do I need to reinstall Windows to fix 0x80070005?

Almost never. A full reinstall is the last option in this guide, listed only for cases where DISM and SFC both fail to repair what they find. Most people never need to go past the first two fixes.

Why does the error come back after I fix it once?

If it returns after a later update rather than immediately, the permissions were likely reset correctly the first time but something — a cleanup tool, a manual permission edit, or an interrupted install — disturbed them again. Fix 2, which restores TrustedInstaller as the folder's owner, tends to be more durable against this than Fix 1 alone.

Is Windows 10 support really over, and does that cause this error?

Windows 10 support ended October 14, 2025. It doesn't directly cause 0x80070005, but on a device that isn't enrolled in Extended Security Updates, there may simply be no update available to install, which can look similar to a stuck or failed update from the user's side. Check your ESU enrollment status before assuming it's a permissions issue.

Can I still get security updates on Windows 10 without paying?

Yes, if you enroll in consumer Extended Security Updates and choose to sync your settings through Windows Backup, enrollment is free. The alternatives are 1,000 Microsoft Rewards points or a one-time payment of roughly $30. As of a June 2026 extension, enrolled consumer devices are covered through October 2027.

What's different about fixing this on Windows 11 Home versus Pro?

The command-line fixes in this guide are identical on both editions. The difference is Group Policy Editor: it's included on Pro, Enterprise, and Education, but not on Home. If a Group Policy restriction turns out to be the cause, Home users won't have a local panel to check it in and will need to work around the restriction another way, such as through the underlying registry keys the policy controls.

What is CBS.log and how do I read it?

CBS.log is the Component-Based Servicing log, located under C:\Windows\Logs\CBS, and it records the actual installation attempts for update packages. Open it in Notepad and search for the error code you're troubleshooting; lines containing "Failed to create file" or "Failed to internally open package" alongside 0x80070005 confirm an access-denied failure during servicing.

Does the DISM repair command need an internet connection?

Yes, by default. DISM /Online /Cleanup-Image /RestoreHealth uses Windows Update as its source for replacement files, so it needs to reach the internet. If you're on a metered or unreliable connection, be aware the download size varies with how much needs repairing.

Can Group Policy cause this error on a work laptop?

Yes — a Group Policy setting or a management agent restricting write access to system directories is one of the documented causes of this error, and it's specific to domain-joined or centrally managed devices. No local fix in this guide overrides a policy set by an administrator; that requires a change on their end.

What if icacls itself says "Access is denied"?

Make sure the Command Prompt or Terminal window title actually shows it's running as administrator — a non-elevated window will fail every command in this guide with the same access-denied message. If it's already elevated and still failing, restart into Safe Mode and run the same commands there; a locked file or an active security-software hook can sometimes block the change during normal startup.

Should I use third-party "permission repair" tools I found online?

It isn't advisable. There's no way to verify what changes an unfamiliar third-party tool actually makes with elevated system access, and running one against core Windows permissions carries real risk. The commands in this guide are built-in Windows tools, documented for this exact error, and touch only the folders known to cause it.

Revision note. Written August 2026, covering supported Windows 11 releases and Windows 10 (including devices enrolled in Extended Security Updates). This will need a fresh look if Microsoft changes how ESU enrollment works after October 2027 or restructures how component-store permissions are managed in a future release. If you've been staring at that "Access Denied" message for a while now, take a breath — this is one of the more mechanical fixes on the site, and you're closer to done than it feels.