Windows & BSOD · medium

How to fix Windows Update Error 0x80070005 (Access denied)

Error code: WU-0x80070005

What this error means

A Windows update fails with 0x80070005, E_ACCESSDENIED. Microsoft explains that the update process could not access required files, folders or registry entries. Its listed causes are wrong permissions on the WinSxS or SoftwareDistribution folders or the servicing registry key, a third-party antivirus or security tool locking update files, the SYSTEM account lacking full control of the Windows folder, or a group policy or management agent restricting writes. Microsoft's fix resets those permissions and update components step by step.

Updated

Applies to
Windows 11 and Windows 10
Difficulty
Intermediate
Before changes
Medium; permission changes on system folders need care

Reviewed by Matyáš Rada · Documentation checked: 2026-10-31 · Checked against Microsoft's troubleshooting article for Windows Update error 0x80070005; not tested on every configuration.

Before you begin

Microsoft recommends backing up the operating system disk before these steps. Restart and try Windows Update after each step, and stop as soon as it works. Run all commands in Command Prompt as administrator. If Windows cannot start, see the startup guide.

Work through these checks

0 of 7 complete
01Check whether the PC is managed

Microsoft lists group policy and management agents that restrict system folders as a cause, which only your IT department can change.

  1. Open Settings > Accounts > Access work or school. If an organization is connected, the PC may be managed.
  2. On a work or school PC, contact IT instead of changing permissions.
What to expect

You know whether you may change system settings.

If it does not help

On a personal PC, continue with step 2.

Browse related errors
02Reset folder permissions with icacls

Microsoft's first resolution step resets the permissions on the folders Windows Update uses.

  1. Search for cmd, right-click Command Prompt and choose Run as administrator.
  2. Run icacls "%windir%\WinSxS" /reset /t /c /q
  3. Run icacls "%windir%\SoftwareDistribution" /reset /t /c /q, then restart and try the update.

Type the commands exactly; they reset permissions to inherited defaults.

What to expect

The update installs.

If it does not help

The WinSxS command can take several minutes. If the error remains, continue with step 3.

Browse related errors
03Restore TrustedInstaller as owner of WinSxS

Microsoft lists missing TrustedInstaller permissions on WinSxS as a cause.

  1. In Command Prompt (Admin), run icacls "%windir%\WinSxS" /setowner "NT SERVICE\TrustedInstaller" /t /c /q
  2. Restart and try the update.
What to expect

The update installs.

If it does not help

If not, reset the update components in step 4.

Browse related errors
04Reset the Windows Update components

Microsoft's next step renames the update download folder and catalog database so Windows recreates them.

  1. In Command Prompt (Admin), run net stop wuauserv, net stop bits and net stop cryptSvc.
  2. Run ren %windir%\SoftwareDistribution SoftwareDistribution.old and ren %windir%\System32\catroot2 catroot2.old.
  3. Run net start cryptSvc, net start bits and net start wuauserv, then check for updates.

Use Command Prompt, not PowerShell, for these commands.

What to expect

Windows Update downloads the update again and installs it.

If it does not help

The update history may look empty afterwards; installed updates are not affected.

Browse related errors
05Repair system files with DISM and SFC

Microsoft's steps 4 and 5 repair the component store and system files.

  1. Run DISM /Online /Cleanup-Image /RestoreHealth and wait for it to finish.
  2. Run sfc /scannow, then restart and try the update.
What to expect

DISM and SFC complete and the update installs.

If it does not help

If DISM fails because it cannot get files, see the 0x800F081F guide on this site.

Browse related errors
06Check antivirus and filter drivers

Microsoft lists third-party antivirus or security tools locking update files as a cause.

  1. Temporarily turn off real-time protection in your third-party antivirus.
  2. In Command Prompt (Admin), run fltmc to list file system filter drivers. Non-Microsoft entries usually belong to antivirus, backup or encryption software.
  3. Uninstall or pause that software, restart and try the update.

Turn protection back on afterwards. Microsoft Defender takes over while another antivirus is removed.

What to expect

The update installs without the third-party software interfering.

If it does not help

Microsoft also describes unloading individual filter drivers with fltmc unload; uninstalling the program is safer for most users.

Browse related errors
07Repair Windows if it still fails

An in-place upgrade replaces system files and resets their permissions while keeping your data.

  1. Download the Windows ISO for your version from Microsoft and mount it.
  2. Run setup.exe and choose to keep personal files and apps.

Back up important files before starting.

What to expect

Windows is repaired and updates install.

If it does not help

Run Windows Update afterwards.

Browse related errors

Possible causes

  • Wrong permissions on the WinSxS or SoftwareDistribution folders
  • Third-party antivirus or security software locking update files
  • Damaged Windows Update components
  • The SYSTEM account lacking full control of the Windows folder
  • Group policy or management software restricting system folders

Sources & further reading