The Error
You kick off Windows Update and it stalls with:
Windows Update error 0x80070005
You might also see it listed as ACCESS_DENIED or the decimal equivalent 2147942405. Sometimes the download completes but installation dies at 0%. Other times it bails out immediately, no progress bar at all.
Why This Happens
0x80070005 is Windows' generic access-denied code — the same one you'd see trying to delete a locked file. When Windows Update throws it, the usual suspects are:
- Corrupted or locked SoftwareDistribution folder — the staging cache where update files land before install
- Antivirus holding a file lock at exactly the wrong moment during installation
- Missing permissions on the Update service account for key system directories
- Corrupted system files the Update stack can't overwrite
- Stale Group Policy restrictions — especially common on machines that were once joined to a corporate domain
Step-by-Step Fix
Step 1: Run the Windows Update Troubleshooter
Before touching anything manually, let Windows take a swing at it. Open PowerShell as Administrator:
msdt.exe /id WindowsUpdateDiagnostic
Click through the wizard and apply whatever it suggests. Nothing fancy here — but it quietly resets service states and resets a handful of permissions automatically. That alone clears the error in roughly 30% of cases.
Step 2: Reset the Windows Update Components
When the troubleshooter isn't enough, this is your best shot. Open Command Prompt as Administrator and stop the four services that touch the update stack:
net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
With those stopped, rename the two caches most likely to be corrupted. Renaming — not deleting — lets you roll back if something goes wrong:
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
Restart the services:
net start wuauserv
net start cryptSvc
net start bits
net start msiserver
Windows rebuilds both folders fresh on the next update attempt. Head to Settings → Windows Update and try again.
Step 3: Fix Permissions on SoftwareDistribution
Still failing? The new SoftwareDistribution folder may have inherited broken permissions from the old one. In an elevated Command Prompt, reset them explicitly:
icacls C:\Windows\SoftwareDistribution /reset /T /C /Q
icacls C:\Windows\SoftwareDistribution /grant SYSTEM:(OI)(CI)F /T
icacls C:\Windows\SoftwareDistribution /grant Administrators:(OI)(CI)F /T
Then bounce the Update service:
net stop wuauserv && net start wuauserv
Step 4: Repair System Files
Corrupted system files can block installs even when permissions look fine. Start with SFC:
sfc /scannow
Let it run to completion — usually 5–10 minutes. If it reports corruption it couldn't repair, follow up with DISM:
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
DISM pulls replacement files directly from Microsoft's servers, so you need an active internet connection. Once both tools finish, run sfc /scannow a second time — DISM sometimes unlocks files that SFC can now replace on a second pass.
Step 5: Check for Antivirus Interference
Temporarily disable real-time protection and retry the update. It succeeds? The AV was locking a file mid-install. Add these paths to your antivirus exclusions permanently:
C:\Windows\SoftwareDistribution\C:\Windows\System32\catroot2\C:\Windows\WinSxS\
Re-enable protection once the update finishes. Don't leave real-time scanning off longer than necessary.
Step 6: Check Group Policy (Corporate or Domain-Joined Machines)
Machines that were once part of a domain sometimes carry stale Group Policy entries that silently block updates long after they've been removed from the domain. Open Group Policy Editor (gpedit.msc) and navigate to:
Computer Configuration
→ Administrative Templates
→ Windows Components
→ Windows Update
Any policies showing Enabled that restrict update behavior should be flipped to Not Configured. Apply the change:
gpupdate /force
No access to gpedit.msc? Nuke the relevant registry keys directly:
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /f
gpupdate /force
Verify the Fix
After any of the steps above:
- Open Settings → Windows Update
- Click Check for updates
- Watch it download and install past the point where it previously failed
- A restart prompt means you're done
Want a definitive confirmation? Pull the Update log:
Get-WindowsUpdateLog
This writes a readable log to %USERPROFILE%\Desktop\WindowsUpdate.log. Search for 0x80070005 — no new hits after your fix means the issue is gone.
Tips
- Reboot clean before updating — close everything, restart, then open Windows Update before launching any other apps. Fewer running processes means fewer file locks competing with the installer.
- Check disk health — a degraded drive can produce phantom permission errors. If nothing else has worked, run
chkdsk C: /f /r(requires a reboot to schedule) and let it finish before trying again. - Windows Update Medic Service — on Windows 11, this service auto-repairs the Update stack in the background. Tweaked or debloated installs sometimes disable it. Re-enable it with:
sc config WaaSMedicSvc start=demand. Fair warning: modifying this service requires taking ownership of its registry key first. - For Linux/cross-platform contexts — if you're also troubleshooting permission issues on Linux systems alongside this, the Unix Permissions Calculator on ToolCraft lets you verify chmod values visually before applying them. Free, browser-based, nothing uploaded.