Knowledge Base →5 min readUpdated: 2026-09-21

How to Fix Windows Update Error 0x80070005 in Windows 11

Error 0x80070005 is the Windows message “Access is denied”: the update service cannot read or write the files it needs, most often because folder permissions are broken, a security policy is in the way, or antivirus is blocking the updater. The fix nearly always comes down to three steps — run the built-in troubleshooter, reset the update components, repair system files — and takes 15–20 minutes.

What error 0x80070005 actually means

The code is a wrapped Win32 error: the 5 at the end is the classic “Access is denied”, so the update service is being refused a file operation it considers routine. The refusal rarely comes from Windows itself — it comes from broken NTFS permissions on the update folders, a policy that locks the updater down, or security software stepping between the service and its files. The error can appear while downloading, while installing, or during a feature update, and it almost always repeats on retry until the underlying cause is removed.

The good news is that the list of possible causes is short. Each cause has a direct, well-documented fix. Work through them in order of likelihood and you will rarely reach the end of the list.

  • Broken NTFS permissions on C:\Windows\SoftwareDistribution or C:\Windows\System32\catroot2
  • A Group Policy or registry rule that restricts Windows Update access
  • Third-party antivirus blocking the updater's file operations
  • Leftover files from a failed update that the service cannot overwrite
  • Corrupted system files breaking the servicing stack itself

How to fix 0x80070005: troubleshooter and component reset

Start with the built-in troubleshooter: Settings → System → Troubleshoot → Other troubleshooters → Windows Update → Run. It resets several update settings automatically and clears the error in a fair share of cases. If the error returns, open Terminal (or Command Prompt) as administrator and stop the four services involved: net stop wuauserv, net stop cryptSvc, net stop bits, net stop msiserver. Then rename the two folders the updater works in: ren C:\Windows\SoftwareDistribution SoftwareDistribution.old and ren C:\Windows\System32\catroot2 catroot2.old.

Restart the services in reverse order (net start wuauserv, net start cryptSvc, net start bits, net start msiserver) and reboot. Windows rebuilds both folders from scratch and re-downloads only the updates that were still pending. If a rename fails with “access denied” even in an elevated prompt, the folder permissions themselves are broken: open the folder's Properties → Security tab and make sure Administrators and SYSTEM have full control before trying again.

Policies, antivirus and system files: the deeper fixes

If the error survives a component reset, check whether something is deliberately restricting updates. Third-party antivirus is the most common offender — disable it temporarily, run the update, re-enable it afterwards. On machines managed by a company, a Group Policy may block updates; home users should still open gpedit.msc (if their edition includes it) and confirm that nothing under Administrative Templates → Windows Components → Windows Update is set to Enabled, particularly the policy “Remove access to use all Windows Update features”. The registry twin of that policy lives under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate — export a backup before changing anything there.

Finally, repair the system files themselves: run sfc /scannow in an elevated prompt. If SFC reports corruption it cannot fix, follow with DISM /Online /Cleanup-Image /RestoreHealth and reboot. In practice, the permission and component reset above solve most 0x80070005 cases; the policy and antivirus checks catch nearly all the rest.

Questions and Answers

What does Windows Update error 0x80070005 mean?

It is the Win32 “Access is denied” error: the update service was refused access to a file or folder — because of broken permissions, a restrictive policy, or antivirus interference.

Is it safe to rename SoftwareDistribution and catroot2?

Yes. Windows re-creates both folders automatically. You lose only the local download cache and the update history list — installed updates are not affected.

Why does error 0x80070005 keep coming back?

Because the underlying block is still in place — most often broken folder permissions or a policy. Repeat the component reset, then check the Security tab and the policy locations above.

Know what is included before you buy.

The one-time 30-minute trial covers core tools. PRO-labelled features stay locked until a paid license is activated.

Read next

All articles · FAQ

Write to us: [email protected]