0x80070005 in Windows Update: How to Fix It (2026 Updated Guide)

Quick answer

When 0x80070005 appears in Windows Update specifically, the cause is almost always that the update process couldn’t write to one of three places: the SoftwareDistribution folder where downloads live, the Catroot2 folder that holds update signatures, or a system folder being rewritten by the update itself. Resetting those folders and the related services resolves the majority of cases. Don’t run a registry “permissions repair” tool — that’s the path that turns a fixable Windows Update error into an unfixable login problem.

Before you start

Three things to verify, fast.

  • Confirm this is the Windows Update version of 0x80070005. If you saw the error in Settings → Windows Update, in wuauclt output, or in the Windows Update history, you’re in the right place. If the error came from Office, OneDrive, or an installer, this isn’t your fix path — see the 0x80070005 code hub for the right scenario.
  • Check Microsoft’s known-issues page for the update that failed. Open Settings → Windows Update → Update history, find the failed update by KB number, then check the Windows release health dashboard for known issues. Around 1 in 5 cases of 0x80070005 on a recent KB is a Microsoft-side issue with a documented workaround that doesn’t require any of the steps below.
  • Make sure you have at least 15 GB free on C:. Updates that fail with 0x80070005 on near-full disks usually fail again with a different code if the disk isn’t cleared. Free up space first.

What this error means in Windows Update

Windows Update runs as a chain of services and processes: the Windows Update service (wuauserv), the Background Intelligent Transfer Service (BITS) that downloads update content, the Cryptographic Services (CryptSvc) that verify signatures, and the Windows Modules Installer (TrustedInstaller) that actually applies the update. Each of these has to be running with the right service identity, and each has to be able to read and write to specific folders that are otherwise locked down on a Windows install.

0x80070005 in this context means one of those services tried to read or write to one of those folders and was refused. The refusal is almost never a “your user account doesn’t have permission” problem — these services run as LocalSystem or NetworkService and don’t care about your user permissions. It’s that the folder’s ACL, the service’s token, or another process holding a file open is preventing the operation. Resetting the services and the folders rebuilds the state cleanly.

Where this error appears in the Windows Update flow

Three specific points in the update flow produce 0x80070005.

  • At the download stage. The error appears as “Some update files are missing or have problems. We’ll try to download the update again later.” with 0x80070005 in the details. Cause: BITS can’t write to SoftwareDistribution\Download.
  • At the install stage. The error appears as “Updates failed — there were problems installing some updates” after the download completed successfully. Cause: TrustedInstaller can’t write to a system folder being modified by the update.
  • At the cleanup stage. Less common — the update appears to install correctly, then fails on the post-install cleanup with 0x80070005 and the system reverts the update at the next reboot. Cause: a permission inheritance issue in WinSxS or a third-party security product holding the file.

The fix sequence below resolves all three.

Common causes

  • Stuck SoftwareDistribution folder. A failed previous update left the folder in a state where Windows Update won’t trust it. The fix is to reset it.
  • TrustedInstaller service not running with its expected token. Often after a half-completed servicing operation. The fix is to reset the service start type and restart it.
  • Antivirus or endpoint protection blocking writes. Common on devices running corporate endpoint security like Defender for Endpoint, SentinelOne, or CrowdStrike. The fix is to add the SoftwareDistribution folder to the AV’s exclusion list.
  • Pending reboot blocking the next install. Windows Update won’t run cleanly if the system has a pending reboot from a previous operation. The fix is to reboot and retry — easier than the rest of the list.
  • Corrupted Windows Update components. When the reset-folders fix doesn’t resolve it, the components themselves need rebuilding. That’s a longer process documented separately.

Fixes to try first

Run these in order. Stop when the error is gone.

1. Reboot and retry the update

Yes, really. About a fifth of 0x80070005 cases in Windows Update are pending-reboot conflicts that resolve cleanly with a clean restart. Reboot the device, go back to Settings → Windows Update, and click “Check for updates.” If it works, you’re done.

2. Run the Windows Update troubleshooter

Settings → System → Troubleshoot → Other troubleshooters → Windows Update → Run. The troubleshooter is unfairly maligned. It performs a known-good reset of the update services and clears a meaningful share of cases. It takes two minutes. Try it.

3. Reset the SoftwareDistribution folder manually

If the troubleshooter didn’t resolve it, do this manually so you can see what’s happening.

Open PowerShell as administrator and run, line by line:

Stop-Service -Name wuauserv -Force
Stop-Service -Name bits -Force
Stop-Service -Name cryptSvc -Force
Stop-Service -Name msiserver -Force

Rename-Item -Path "C:\Windows\SoftwareDistribution" -NewName "SoftwareDistribution.old"
Rename-Item -Path "C:\Windows\System32\catroot2" -NewName "catroot2.old"

Start-Service -Name wuauserv
Start-Service -Name bits
Start-Service -Name cryptSvc
Start-Service -Name msiserver

Then go back to Settings → Windows Update and check for updates again. Windows will rebuild SoftwareDistribution and Catroot2 from scratch on the next update attempt. If the error is gone, you can delete the renamed .old folders after a week of clean updates.

4. Add SoftwareDistribution to your AV exclusions

If the manual reset didn’t fix it and you’re running endpoint protection, add the following folders as scan exclusions in the AV product:

  • C:\Windows\SoftwareDistribution
  • C:\Windows\System32\catroot2

This is reversible — once Windows Update runs cleanly once, you can remove the exclusion. On a corporate device, this is something to ask your IT team about rather than do yourself.

5. Check if your update is on the known-issues list

If you’ve reset the folders and the error is still occurring on the same KB number, search Microsoft’s release health dashboard for that KB. Microsoft sometimes pushes a known-broken update and then issues a hold or a re-release; if you’re hitting the broken version, the fix is to wait for the corrected one rather than to keep retrying.

Advanced fixes

When the basic sequence hasn’t worked.

Reset Windows Update components fully

The folder reset above is a partial reset. The full reset includes re-registering the Windows Update DLLs and resetting the BITS queue. There’s a longer guide that walks through the complete sequence: → How to reset Windows Update components.

Run the full reset if the abbreviated version above didn’t work. It’s a longer procedure but it resolves cases the partial reset misses.

Run DISM and SFC

If a Windows Update is failing with 0x80070005, there’s a non-zero chance the underlying component store (WinSxS) has been damaged. Run, in PowerShell as administrator:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

The DISM step takes 10–30 minutes depending on the connection. SFC is faster. Reboot, then retry the update.

Check the CBS log

If you’re comfortable reading logs, the file C:\Windows\Logs\CBS\CBS.log records what happened during the last update attempt. Search the log for 0x80070005 and read the lines before each occurrence — they usually name the specific file or folder that was refused. This is the most useful diagnostic available when the standard fixes haven’t worked.

If you are on a work or school device

Don’t reset SoftwareDistribution on a managed device without authorization. Many corporate environments use Windows Server Update Services (WSUS) or Microsoft Configuration Manager to control update content, and clearing the local cache can put the device into a state that triggers compliance alerts. Open a ticket and let your IT team handle it — they have a known fix sequence for 0x80070005 in their environment.

If your IT team has paused updates intentionally (because there’s a known compatibility issue with a corporate application), 0x80070005 may be the visible symptom of that pause rather than a fault. Confirm before troubleshooting.

When to stop

Stop and escalate if any of the following is happening.

  • The error has appeared after multiple resets and runs across different KBs. That’s the signal that the underlying problem isn’t a stuck folder — it’s broader system damage. The right next step is an in-place reinstall of Windows (Settings → System → Recovery → Reinstall now), which preserves your apps and files but rebuilds the system files. Don’t keep applying piecemeal fixes.
  • The device is reporting other unrelated issues — apps crashing, shell behaving oddly, intermittent BSODs. Don’t fix 0x80070005 in isolation; you have a bigger problem.
  • You’ve made changes to the registry or to file ACLs as part of older advice you found elsewhere, and the problem is worse now. Restore from a backup or system restore point. Stop changing things.

Official references

FAQ

Is 0x80070005 in Windows Update the same problem as 0x80070005 in Office activation? No. Same code, different scenarios, different fixes. The Office activation version is an identity-and-token problem; the Windows Update version is a service-and-folder problem. See the code hub if you’re not sure which one you’re dealing with.

Will deleting SoftwareDistribution lose my updates? It deletes the cached copies of updates that haven’t installed yet, not the installed ones. Anything already installed stays. The next update check will re-download what’s needed, which is exactly what you want.

Why does the troubleshooter fix it sometimes and not other times? The troubleshooter handles the common cases — stuck services, partial resets, registry settings out of sync. It doesn’t handle component store corruption or AV interference, which are the two cases where the manual fix sequence is required.

Does running as administrator help? Not for Windows Update specifically. The Windows Update services already run as LocalSystem, which has higher privileges than your user account does. Running Settings as administrator doesn’t change anything about what Windows Update can or can’t access.

How long should I wait between retry attempts? At least one full reboot cycle. If you check for updates immediately after a failure, you’ll often hit the same error because the failed state is still cached. Reboot, then retry.

Can I disable Windows Update to stop seeing this error? You can, but it’s a bad idea on a connected device. The right fix is to resolve the error so updates install cleanly. Disabling Windows Update means missing security patches, which is a much worse problem than the one you started with.

↑ Back to top