Fix Windows Update Error 0x80070005: Install Updates Again

Windows Update error 0x80070005 means Windows was denied access while trying to install an update. Restart first, check disk space and the Windows Update troubleshooter, then test security software or VPN interference; if the error remains, reset the update caches and repair Windows system files with DISM and SFC.

What error 0x80070005 means and when these fixes apply

0x80070005

Windows uses this code for an access-denied failure. During an update, the update service might be unable to read or write a required folder, security software might block a change, the current account might lack the required rights, or Windows system files might be damaged.

The error can also appear when the system drive is nearly full, the update database or download cache is damaged, or Windows is waiting for a restart.

These steps apply to supported Windows 10 and Windows 11 installations using the normal Windows Update service. They are suitable for a personal PC. A work or school device might be controlled by administrator policies that prevent updates or restrict troubleshooting tools; changing local settings might not solve the problem.

Do not change permissions throughout the registry or grant broad access to system folders. Those changes can weaken Windows security and create new update failures.

You need an Administrator account for the service-reset and repair commands. The initial checks do not normally remove personal files, but save open work before restarting. Keep a current backup before any major recovery operation, such as an in-place repair install.

Start with the fixes that will not change Windows system files

Begin with these reversible checks. They can resolve a pending restart, an unavailable service, insufficient storage, or an update blocked by a temporary condition.

1. Restart the PC from Start > Power > Restart. A normal restart is preferable to shutting down and immediately powering on because Windows might need to finish a pending servicing operation.
2. Check free space on the system drive. Open Settings > System > Storage in Windows 11 or Windows 10. Remove only files you recognize. Do not manually delete files from C:\Windows or C:\Windows\System32.
3. Confirm the clock and time zone. Open Settings > Time & language > Date & time, turn on automatic time and automatic time zone when available, then select Sync now. An incorrect clock can interfere with update validation.
4. Run the built-in troubleshooter. In Windows 11, open Settings > System > Troubleshoot > Other troubleshooters, find Windows Update, and select Run. In Windows 10, open Settings > Update & Security > Troubleshoot > Additional troubleshooters, select Windows Update, and run it. Apply a suggested fix only when Windows identifies the related problem.
5. Temporarily check third-party antivirus, firewall, VPN, or endpoint-security software. Pause protection only through the product's own controls, disconnect the VPN, and try Windows Update once. Re-enable protection immediately after the test. Do not uninstall security software just to test this, and do not disable Microsoft Defender permanently.

If the update still fails, record the update name and try again after the restart. The troubleshooter might report that it could not identify a problem; continue with the next section if the error remains.

Reset Windows Update when the download or cache is stuck

Use an elevated Command Prompt for this procedure. It stops the services that use the update cache, renames the cache folders so Windows can create fresh ones, and starts the services again. Renaming is safer than deleting because the old folders remain available for diagnostics.

Do not run these commands in an ordinary Command Prompt. Do not change registry permissions or delete unrelated folders.

1. Open an elevated Command Prompt. Select Start, type cmd, right-click Command Prompt, choose Run as administrator, and approve the User Account Control prompt.
2. Stop the update-related services. Run each command on its own line.

net stop bits
net stop wuauserv
net stop appidsvc
net stop cryptsvc

A successful stop usually reports that the service was stopped successfully. If a service is not running, Windows might say that it was not started; that is normally acceptable. If access is denied, close the window, reopen Command Prompt with Run as administrator, and try again.

3. Rename the two update caches.

ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
ren %systemroot%\System32\catroot2 catroot2.old

If a folder with the .old name already exists, use a different name such as SoftwareDistribution.previous and catroot2.previous. If a rename fails because a file is in use, verify that the four services stopped, close other Windows management tools, and retry.

4. Start the services again.

net start bits
net start wuauserv
net start appidsvc
net start cryptsvc

A successful start reports that the service was started successfully. If a service does not start, note the exact message instead of continuing to delete folders or change permissions.

5. Restart the PC, then open Settings > Windows Update and select Check for updates. Windows will rebuild the renamed caches, and the first scan might take longer than usual.

If the update installs, leave the .old folders alone until you confirm that Windows Update works normally. Windows can remove or reuse them later; you can remove them through Storage settings after a successful update if they remain and you need the space. If the reset changes nothing, continue to system-file repair rather than repeating it many times.

Repair Windows system files if the error remains

Use the Deployment Image Servicing and Management tool (DISM) first, then System File Checker (SFC). DISM repairs the Windows component store that SFC uses as a source for replacement files. Run these commands when the update still fails after the earlier checks or when Windows shows other signs of damaged system files. They require an elevated Command Prompt and can take time without showing much progress.

1. Open Command Prompt as an administrator.
2. Check and repair the Windows component store with DISM.

DISM.exe /Online /Cleanup-Image /RestoreHealth

A successful run normally ends with output similar to this:

The restore operation completed successfully.
The operation completed successfully.

The exact wording varies by Windows version. If DISM reports that it cannot find source files, the component store might be too damaged for this online repair or Windows might be unable to obtain the required files. Do not substitute random files from another PC. Restart once, make sure the PC has a working internet connection, and run the command again. If it still fails, an in-place repair install is safer than manually replacing system files.

3. After DISM finishes successfully, run SFC.

sfc /scannow

A healthy result can say:

Windows Resource Protection did not find any integrity violations.

If SFC repaired files, it might report:

Windows Resource Protection found corrupt files and successfully repaired them.

Restart after a repair, then check Windows Update. If SFC says it found corrupt files but could not repair some of them, run DISM again, restart, and run SFC once more. If Windows reports that a repair is pending, restart before trying again. Do not interrupt either command simply because the percentage appears to pause.

How to confirm the update is fixed and what to do next

Do not assume the problem is fixed because a repair command completed. Confirm that Windows Update installs the failed update.

1. Open Settings > Windows Update and select Check for updates. Allow the download and installation to finish, then restart if Windows requests it.
2. Review the result in update history. In Windows 11, open Settings > Windows Update > Update history. In Windows 10, open Settings > Update & Security > Windows Update > View update history. The update should appear under its relevant category without a failed status.
3. Confirm the installed Windows version. Press Windows key + R, enter winver, and select OK. The version and build shown there should match the release you expect. You can also open Settings > System > About and check Windows specifications.

A successful Windows Update screen, a completed entry in update history, and a normal winver result confirm that the fix worked. If the same update still returns 0x80070005, try a clean boot to rule out third-party startup software, then retry the update. Restore normal startup services after the test.

If that fails, use an in-place repair install with installation media or the official Windows setup process for the same edition and language. Choose the option to keep personal files and apps, and read each screen carefully before proceeding. This repairs Windows while normally preserving your data, but maintain a current backup first.

On a work or school PC, contact the administrator instead of changing policy or permissions. Device management, update rings, endpoint security, or account restrictions might be the direct cause.

Conclusion

Run the checks in order, verify the update in Windows Update and update history, and stop before changing registry or system-folder permissions. If the error remains, use a clean boot or an in-place repair install; contact the device administrator if the PC is managed.

Frequently Asked Questions

Will resetting SoftwareDistribution delete my personal files?

No. Renaming `SoftwareDistribution` and `catroot2` resets Windows Update’s cached data, not your documents, photos, installed applications, or personal settings. Windows creates new cache folders after the services start.

Do I need to run DISM and SFC if the update cache reset worked?

No. If Windows Update installs the update successfully after the cache reset, do not run repair commands just because they are available. Use DISM followed by SFC when the error continues or Windows shows other signs of damaged system files.

Why does 0x80070005 keep returning on a work computer?

A management policy, endpoint-security product, restricted account, or update server configuration might be enforcing the failure. Do not change local permissions to bypass it; ask the organization’s administrator to check the device and update policy.