Windows · Windows Server  ·  medium  ·  Windows Update & servicing

0x80070005 — access denied during update or activation

The update or activation service was refused access to a file, a registry key or a folder it owns.

What you see

Updates fail, activation fails, or a Store app will not install, all with 0x80070005. Frequently follows a security hardening exercise or a permissions script.

What is actually wrong

Permissions on SoftwareDistribution, catroot2 or the registry hives have been changed — by a GPO, a hardening baseline, or a third-party cleaner. Occasionally antivirus is holding the files.

Codes and articles

0x8007000580070005E_ACCESSDENIEDERROR_ACCESS_DENIED

The fix

Restore the default permissions on the update paths
Elevated PowerShell25 minutesmedium risknot reversible

Updates or activation fail with access denied. Note that resetting ACLs cannot be undone in place — export them first.

  1. Record the current ACLs before changing anything.

    Command Prompt
    icacls C:\Windows\SoftwareDistribution /save C:\temp\sd-acl.txt /Ticacls C:\Windows\System32\catroot2 /save C:\temp\catroot2-acl.txt /T

    icacls /restore replays these files exactly. Without them there is no way back to whatever the hardening baseline set.

  2. Temporarily disable real-time antivirus scanning and retry once — if it works, the fix is an exclusion, not an ACL change.

  3. Reset the ownership and permissions on the update folders.

    Command Prompt
    takeown /F C:\Windows\SoftwareDistribution /R /D Yicacls C:\Windows\SoftwareDistribution /reset /T /C

  4. Do the same for the catalogue store.

    Command Prompt
    takeown /F C:\Windows\System32\catroot2 /R /D Yicacls C:\Windows\System32\catroot2 /reset /T /C

  5. Confirm the update services run as the accounts they should.

    PowerShell
    Get-CimInstance Win32_Service -Filter "Name='wuauserv' or Name='bits' or Name='cryptsvc'" | Format-Table Name, StartName, State -AutoSize

  6. Restart and retry.

Confirm it workedUpdates scan and install.
If you need to undo iticacls C:\Windows\SoftwareDistribution /restore C:\temp\sd-acl.txt

Related faults

Hyper-V: a VM will not start — 0x80070569 or "failed to open attachment"Windows Server

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.