Windows Server 0x80070005 Access Denied Fix

Getting the 0x80070005 error on Windows Server is frustrating — especially when you're in the middle of a critical update or trying to add a role. I've seen this pop up on Server 2016, 2019, and even 2022, and it always comes down to a permissions issue or corrupted component store. Here's what actually works.

Quick Fix: Reset Windows Update Components

This is the first thing I try on any server with that error. Open an admin PowerShell prompt — right-click Start and pick "Windows PowerShell (Admin)" — and run these commands one after another:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old

net start wuauserv
net start cryptSvc
net start bits
net start msiserver

That clears out the download cache and re-registers the services. For most folks, this alone fixes the error. Had a client last month whose entire print queue died because of this — after resetting, updates ran fine.

If That Doesn't Work: Run SFC and DISM

Sometimes the component store itself is borked. Run these two commands in the same admin PowerShell:

DISM /Online /Cleanup-Image /RestoreHealth
SFC /SCANNOW

DISM fixes the system image. SFC scans system files and replaces corrupted ones. Wait for the first one to finish before starting the second. If DISM fails with a source file error, you might need an offline repair — but 9 times out of 10, it works.

Permission Reset for Windows Volume

The error often hides a deeper permissions screw-up on the C: drive. I've seen servers where someone manually locked down permissions and broke TrustedInstaller's access. Run this command:

icacls C:\* /grant TrustedInstaller:F /T /Q

That grants full control to TrustedInstaller recursively. It can take a minute — let it run. After that, re-scan with SFC or try the update again.

Less Common Variations

• GPO block: Some security GPOs prevent Windows Update from accessing the store. Check gpresult /h report.html for policies related to Windows Update. If a GPO forces WSUS and the server doesn't have access to it, you'll see 0x80070005. Bypass by setting HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DoNotConnectToWindowsUpdateInternetLocations to 0 (DWORD) and restart.
• Corrupted CBS.log: The Component-Based Servicing log can blow up in size (10GB+). Rename it: ren C:\Windows\Logs\CBS\CBS.log CBS.log.bak. That clears the blockage. Then run DISM again.
• Third-party security software: I've seen Sophos and McAfee block the Windows Update service. Temporarily disable real-time scanning or uninstall the product. Then test the update.

Prevention Tips

1. Never manually lock down system folders. If you need to restrict access, use Group Policy or NTFS inheritance properly. Don't remove TrustedInstaller from the ACL.
2. Monitor CBS.log size. Set a scheduled task to check if it's over 1GB and rotate it automatically.
3. Run monthly DISM health scans. I have a scheduled script that runs DISM /Online /Cleanup-Image /CheckHealth and logs the result. Catches corruption early.
4. Keep WSUS reachable. If you use WSUS, verify the server can reach the WSUS server every week. DNS or firewall changes can break it silently.

That's it. The 0x80070005 error on Windows Server is almost always fixable in under 15 minutes with these steps. If you're still stuck, check the event logs under Applications and Services Logs\Microsoft\Windows\WindowsUpdateClient\Operational — the detailed error message often points to the exact file or folder that's blocked.