Fix 0x80070005 Access Denied in Windows Defender

That error is a pain, I get it. One minute Windows Defender is running fine, the next it's throwing 0x80070005 (Access Denied) during a scan or update. Let's get it sorted.

The Quick Fix: Reset Defender's Registry Keys

The most common cause is corrupted permissions on Defender's registry keys, often after a third-party antivirus install or a botched Windows update. Here's how to reset them.

Right-click the Start button and select Windows PowerShell (Admin) or Terminal (Admin).
Run this command to take ownership of the Defender registry path:

takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y

After running it, you'll see a bunch of lines saying SUCCESS: The file (or folder) "..." now owned by user "Administrators". That's what we want.

Now grant full control to administrators and system:

icacls "C:\ProgramData\Microsoft\Windows Defender" /grant Administrators:F /grant SYSTEM:F /t /c

You'll see processed file: ... and Successfully processed 1234 files at the end. If you get any errors, that's okay, we're not done yet.

Open Registry Editor (type regedit in the Start menu, press Enter).

Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender

Right-click the Windows Defender key, select Permissions.
Click Advanced, then check the box that says Replace owner on all child objects. Click OK.
Back in Permissions, make sure Administrators and SYSTEM have Full Control. If not, check the boxes.
Click Apply, then OK.

After you do that, close the Registry Editor and restart your PC. When it boots back up, try running a Defender scan or update again. It should work now. If not, move on to the next step.

Why This Works

Defender stores its settings and quarantine data in that folder and registry key. When a third-party AV (or even a Windows update) messes with the ACLs, Defender can't read or write its own files. The takeown command resets the owner to Administrators, and icacls rebuilds the permissions from scratch. That usually clears the error.

Less Common Variations

If the folder reset didn't do it, the problem might be deeper. Here are a few variations I've seen.

Corrupted Defender Service

Sometimes the service itself is damaged. Open an admin PowerShell and run:

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 0 -Type DWord

That re-enables the service if something turned it off. Then restart the service with:

Restart-Service WinDefend

You should see no error. If you get a message saying the service isn't running, check the Services app (services.msc) for Windows Defender Antivirus Service and set it to Automatic and start it manually.

Group Policy Interference

If this is a work or school PC, a domain policy might be blocking Defender. Open gpedit.msc and go to Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus. Look at Turn off Windows Defender Antivirus – if it's set to Enabled, change it to Not Configured or Disabled. Then run gpupdate /force in a command prompt.

Third-Party AV Leftovers

If you recently uninstalled another antivirus, its leftover drivers can block Defender. Use the official removal tool from that vendor (e.g., McAfee Removal Tool, Norton Removal Tool). I've seen Symantec's tool do the trick when nothing else would.

Prevention

To avoid this from coming back, do these three things:

Don't install more than one real-time antivirus. They fight over resources and permissions.
Before uninstalling any AV, use the vendor's dedicated removal tool, not just Add/Remove Programs.
If you're using a registry cleaner, stop. They strip permissions that legitimate programs need.

That's it. This error is annoying but fixable. If you're still stuck after these steps, check the Windows Event Viewer under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational for the exact failed operation – that'll point you to the specific file or registry key causing the issue.