Fix Windows Update error 0x80070005 (Access Denied)

Windows Update fails with 0x80070005 when the update agent cannot write to its own folders or registry keys. Reset permissions, clear the cache, and retry.

What the error means

0x80070005 is the Win32 error E_ACCESSDENIED wrapped in an HRESULT. Windows Update, the Microsoft Store, or an installer tried to write somewhere it isn't allowed to — usually C:\Windows\SoftwareDistribution, C:\Windows\System32\catroot2, or a key under HKLM\SOFTWARE.

Common causes

Third-party antivirus or endpoint protection locking update files.
A broken ACL on SoftwareDistribution after a disk clone or restore.
Group Policy pointing clients at a WSUS server they can no longer authenticate to.
Running an installer without elevation.

Fix

1. Reset the update components

Open an elevated command prompt and run:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserver

2. Repair system files

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

3. Check WSUS policy

Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' |
  Select-Object WUServer, WUStatusServer

If the server listed no longer exists, fix the GPO or remove the keys and run gpupdate /force.

Verify

Run Settings → Windows Update → Check for updates. Confirm success in Get-WindowsUpdateLog or Event Viewer under Microsoft → Windows → WindowsUpdateClient → Operational.

If the error persists only on domain-joined machines, compare a working and failing host with gpresult /h report.html.