Windows update Error 0x80070005 - Need a fix? Click here.

Anonymous
2009-07-02T19:01:34+00:00

The error code 0x80070005 is also described as ACCESS DENIED. 

Please follow these instructions if you are encountering this error code when checking or installing updates via Windows Udpate. 

To correct the problem, you can try the steps below. Keep in mind that these steps are still experimental. I look forward to your feedback and results. For the long term, we hope that we can create an automated solution for all.

  1. Download and install SubInACL from the Microsoft Download Center http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=23510
  2. Open Notepad (Click Start, type Notepad, and then press Enter)
  3. Copy and paste the following text into Notepad

Set OSBIT=32

IF exist "%ProgramFiles(x86)%" set OSBIT=64

set RUNNINGDIR=%ProgramFiles%

IF %OSBIT% == 64 set RUNNINGDIR=%ProgramFiles(x86)%

subinacl /subkeyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" /grant="nt service\trustedinstaller"=f

  1. Close Notepad, and make sure you save it. When you save the text, make sure that you set

Save as Type to “All Files (*.*)”. Very important! The file name needs end with .CMD. For example: fix.cmd. Lastly, when you save the file, make sure you save it at a location where it will be easy for you to find.

  1. Right click on the file that you just saved in step #4, and select “Run as Adminstrator”

To confirm that you have the symptoms and to validate the problem, please see the below:

The following is applicable to Windows 7 and Windows Vista .

  1. Download AccessChk (Sysinternals).  This tool allows you to evaluate the access level of specific users or groups of resources including files, directories, Registry keys, global objects and Windows services.  Here's the link to download the tool: http://technet.microsoft.com/en-us/sysinternals/bb664922.aspx

2. Save the zip file on your desktop, and extract the file:

  • Right click on the file, and select Extract All...
  • Click Next when prompted for the Destination.

As a result, you should see a folder called AccessChk  on your desktop.

  1. Open the folder AccessChk 
  2. Hold the shift-key and right click in the window.  Select "Open Command Prompt Here"
  3. A command prompt window should open with a similar prompt:

C:\Users<USERNAME>\Desktop\accesschk>

6.  Type the following command, and press Enter:

accesschk.exe -s -n "nt service\trustedinstaller" -k "hklm\software\Microsoft\Windows\CurrentVersion\Component Based Servicing" >accesskchk.txt

Tip: You should be able to copy and paste the command into the command prompt.

  1. Close the Command Prompt Window.  Open the Accesschk folder on yoru desktop (if it has been closed).
  2. Double click on Accesschk.txt (the text file), this should open Notepad.

9.  Copy and Paste your results with a new question on the Windows Update forum.  (Make sure you write 0x80070005 in the subject line).

Cheers!

Kim N. L.

Microsoft Partner Technical Technical Lead

Windows for home | Windows 11 | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2011-10-13T21:55:56+00:00

Hello all,

I would like to apologize for the delayed response on this thread.  All the results (logs) that you have all posted in the thread are helpful.    Based on the various results, it’s evident that the problem has a common cause.  

Here’s a little background on the problem that you are experiencing:

When you use Windows Update to install updates for Windows Vista and Windows 7, the process relies on the Windows Module Installer (trustedinstaller.exe).  The TrustedInstaller is the online interface to the servicing stack.  To keep things simple, it’s one of the most important components when you install updates.   This method also allows Windows to be serviced (to install updates) without the need of an administrator.  In fact, when the components of Windows are being updated, it’s the TrustedInstaller that is used to update the operating system files. 

Furthermore, when you look at the security settings of certain servicing components of Windows, you would notice that the TrustedInstaller is the only item listed under the User Name and Groups with full permissions.   This is only true if the respective folder or registry key is kept at its default state.  In other words, changes to these security settings would cause the ACCESS DENIED (0x80070005).  It’s difficult to associate a culprit to the unwanted changes.   A possible cause that was previously mentioned is malware.

Awhile ago, I asked the community to run a Sysinternal Tool known as Access Check to capture the details of the problem.  The output of the tool would list all of the servicing components where the security permissions restricted the TrustedInstaller.  As a result, when you try to install updates for Windows, you would obtain the error 0x80070005 – also known as ACCESS DENIED.  In summary, it is the TrustedInstaller that has been denied of access to a component that it should have access to.

Here’s an example of the output:

HKLM\software\Microsoft\Windows\CurrentVersion\Component Based Servicing\Retry Agent

HKLM\software\Microsoft\Windows\CurrentVersion\Component Based Servicing\Sqm

HKLM\software\Microsoft\Windows\CurrentVersion\Component Based Servicing\Sqm\VistaSP1-KB936330~31bf3856ad364e35~x86~~6.0.1.18000

HKLM\software\Microsoft\Windows\CurrentVersion\Component Based Servicing\Sqm\VistaSP1-KB936330~31bf3856ad364e35~x86~~6.0.1.18000\InstallCounter

As you can see from the above, there are four registry keys with unexpected security settings.

...The Solution...

To correct the problem, you can try the steps below.  Keep in mind that these steps are still experimental.   I look forward to your feedback and results.  For the long term, we hope that we can create an automated solution for all.

1.       Download and install  SubInACL from the Microsoft Download Center http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=23510

2.       Open Notepad (Click Start, type Notepad, and then press Enter)

3.       Copy and paste the following text into Notepad

Set OSBIT=32

IF exist "%ProgramFiles(x86)%" set OSBIT=64

set RUNNINGDIR=%ProgramFiles%

IF %OSBIT% == 64 set RUNNINGDIR=%ProgramFiles(x86)%

subinacl /subkeyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" /grant="nt service\trustedinstaller"=f

4.       Close Notepad, and make sure you save it.  When you save the text, make sure that you set

Save as Type to “All Files (*.*)”.  Very important!  The file name needs end with .CMD.  For example:  fix.cmd.  Lastly, when you save the file, make sure you save it at a location where it will be easy for you to find.

5.       Right click on the file that you just saved in step #4, and select “Run as Adminstrator”

Thanks and I look forward to your feedback.

Kim

Was this answer helpful?

700+ people found this answer helpful.
0 comments

128 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2009-08-12T19:53:29+00:00

    Hi again,

    Please, all help is welcome but pleeaasee could anybody just answer my questions!!

    Thanks and be well

    Pedro Borba

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2009-08-12T19:08:44+00:00

    Try running checkdisk - schedule it to run at next start and then Apply OK your way out then restart.

    How to Run Check Disk at Startup in Vista

    http://www.vistax64.com/tutorials/67612-check-disk-chkdsk.html

    if no joy :

    Try Startup Repair -

    This tells you how to access the System Recovery Options

    http://windowshelp.microsoft.com/Windows/en-US/Help/326b756b-1601-435e-99d0-1585439470351033.mspx

    Try StartUp Repair from Recovery Options

    How to do a Startup Repair

    http://www.vistax64.com/tutorials/91467-startup-repair.html

    And try runnng Chkdsk from Recovery Options

    (this is a more efficient manner to run than at reboot and might work)

    How To Perform a Repair Installation For Vista

    http://www.vistax64.com/tutorials/88236-repair-install-vista.html

    This tells you how to access the System Recovery Options

    http://windowshelp.microsoft.com/Windows/en-US/Help/326b756b-1601-435e-99d0-1585439470351033.mspx

    Rob - Bicycle - Mark Twain said it right.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  3. Anonymous
    2009-08-11T21:41:32+00:00

    Hi again,

    Thank u SpiritX for your reply, i think u replied my previous post here, but even if it isn't the case thanks anyway, all the help is welcome.

    Well i have to confess that all of this is indeed very interesting but i´m light years from truly understand these computer things, so i really have to go very slow on this to, at the minimum, chew them before i can digest them, all this ____ talk to say that i had to read again, several times, what u suggested, in general i think i have the picture, offcourse there is always some things, here and there, i guess mere technical concepts that i don't know them, things like (u'll probaly be laughing now) what's a [SR] tag. For u probably thats just trivial for me it just interrupts the entire context of the reading because simply i don´t know what it is, but like i said in general i think i´ve got the picture, about the parts where it is ok and when it is corrupted, i guess.

    Still in my cbs.log file there are a few things i woul like to clarify like when i have this: 

    POQ 69 ends.2009-08-10 21:34:49, Info                  CSI    0000016d [SR] Verify complete2009-08-10 21:34:50, Info                  CSI    0000016e [SR] Verifying 100 (0x00000064) components2009-08-10 21:34:50, Info                  CSI    0000016f [SR] Beginning Verify and Repair transaction2009-08-10 21:35:05, Info                  CSI    00000170 Repair results created:POQ 70 starts:     0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\82b9876c021aca01c91e0000b80e6009._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"    1: Move File: Source = [l:218{109}]"\SystemRoot\WinSxS\Temp\PendingRenames\82b9876c021aca01ca1e0000b80e6009.program_files_ffd0cbfc813cc4f1.cdf-ms", Destination = [l:130{65}]"\SystemRoot\WinSxS\FileMaps\program_files_ffd0cbfc813cc4f1.cdf-ms"    2: Move File: Source = [l:252{126}]"\SystemRoot\WinSxS\Temp\PendingRenames\427c8c6c021aca01cb1e0000b80e6009.program_files_windows_defender_3e33901162166ae9.cdf-ms", Destination = [l:164{82}]"\SystemRoot\WinSxS\FileMaps\program_files_windows_defender_3e33901162166ae9.cdf-ms"    3: Move File: Source = [l:322{161}]"\SystemRoot\WinSxS\Temp\PendingRenames\023f916c021aca01cc1e0000b80e6009.programdata_microsoft_windows_defender_definition_updates_default_44e57bb5c1e3d0e8.cdf-ms", Destination = [l:234{117}]"\SystemRoot\WinSxS\FileMaps\programdata_microsoft_windows_defender_definition_updates_default_44e57bb5c1e3d0e8.cdf-ms"    4: Move File: Source = [l:264{132}]"\SystemRoot\WinSxS\Temp\PendingRenames\82cfad6c021aca01cd1e0000b80e6009.program_files_windows_defender_pt-pt_a60806ab0baaf162.cdf-ms", Destination = [l:176{88}]"\SystemRoot\WinSxS\FileMaps\program_files_windows_defender_pt-pt_a60806ab0baaf162.cdf-ms"

    POQ 70 ends.2009-08-10 21:35:05, Info                  CSI    00000171 [SR] Verify complete2009-08-10 21:35:05, Info                  CSI    00000172 [SR] Verifying 100 (0x00000064) components2009-08-10 21:35:05, Info                  CSI    00000173 [SR] Beginning Verify and Repair transaction2009-08-10 21:35:10, Info                  CSI    00000174 Repair results created:POQ 71 starts:

    If i´m not wrong, the upper sample excerpt from my CBS.log file shows that the SFC.exe program did not identify any problems with the Windows Vista system files, what i don´t know is wich parts of this excerpt belongs to the POQ 70, and so on with all the rest of what´s in the cbs.log file, i hope i´m making myself understandable.

    The second situation:

    POQ 51 ends.2009-08-10 21:32:49, Info                  CSI    00000121 [SR] Verify complete2009-08-10 21:32:49, Info                  CSI    00000122 [SR] Verifying 100 (0x00000064) components2009-08-10 21:32:49, Info                  CSI    00000123 [SR] Beginning Verify and Repair transaction2009-08-10 21:32:53, Info                  CSI    00000124 Repair results created:POQ 52 starts:     0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\e2db351e021aca01e5160000b80e6009._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"    1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\62613f1e021aca01e6160000b80e6009.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps$$.cdf-ms"    2: Move File: Source = [l:214{107}]"\SystemRoot\WinSxS\Temp\PendingRenames\42484b1e021aca01e7160000b80e6009.$$_system32_21f9a9c4a2f8b514.cdf-ms", Destination = [l:126{63}]"\SystemRoot\WinSxS\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms"    3: Move File: Source = [l:252{126}]"\SystemRoot\WinSxS\Temp\PendingRenames\020b501e021aca01e8160000b80e6009.$$_system32_licensing_issuance_426a5d59f324a6ff.cdf-ms", Destination = [l:164{82}]"\SystemRoot\WinSxS\FileMaps$$_system32_licensing_issuance_426a5d59f324a6ff.cdf-ms"    4: Move File: Source = [l:212{106}]"\SystemRoot\WinSxS\Temp\PendingRenames\8290591e021aca01e9160000b80e6009.$$_tracing_bca9e27848ac4cc0.cdf-ms", Destination = [l:124{62}]"\SystemRoot\WinSxS\FileMaps$$_tracing_bca9e27848ac4cc0.cdf-ms"

    POQ 52 ends.2009-08-10 21:32:53, Info                  CSI    00000125 [SR] Verify complete2009-08-10 21:32:54, Info                  CSI    00000126 [SR] Verifying 100 (0x00000064) components2009-08-10 21:32:54, Info                  CSI    00000127 [SR] Beginning Verify and Repair transaction2009-08-10 21:32:58, Info                  CSI    00000128 Hashes for file member ??\C:\Windows\System32\pt-PT\secpol.msc do not match actual file [l:20{10}]"secpol.msc" :  Found: {l:32 b:YY6LgIThBcYM4MQ1DR9loVECNZ32Q3ioIRPFp1Ak3cU=} Expected: {l:32 b:2z3tAv7dAgi7HrN5G1d3gxVlt0BeJP61oftUju49sDU=}2009-08-10 21:32:58, Info                  CSI    00000129 [SR] Repairing corrupted file [ml:520{260},l:58{29}]"??\C:\Windows\System32\pt-PT"[l:20{10}]"secpol.msc" from store2009-08-10 21:32:58, Info                  CSI    0000012a WARNING: File [l:20{10}]"secpol.msc" in [l:58{29}]"??\C:\Windows\System32\pt-PT" switching ownership    Old: Microsoft-Windows-SecurityConfigurationManagement-PolicyTools-Ex.Resources, Version = 6.0.6001.18000, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"pt-PT", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral    New: Microsoft-Windows-SecurityConfigurationManagement-PolicyTools.Resources, Version = 6.0.6000.16386, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"pt-PT", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral2009-08-10 21:32:58, Info                  CSI    0000012b Repair results created:POQ 53 starts:

    And if i'm not wrong again, on this sample excerpt from my CBS.log file it shows that the SFC.exe program has identified problems with the Windows Vista system files, once again i´m lost in what belongs to what.

    Here is the third situation, wich i didn't find anything related with in the Article ID: 928228 from Microsoft Help&Support;

    POQ 70 ends.2009-08-10 21:35:05, Info                  CSI    00000171 [SR] Verify complete2009-08-10 21:35:05, Info                  CSI    00000172 [SR] Verifying 100 (0x00000064) components2009-08-10 21:35:05, Info                  CSI    00000173 [SR] Beginning Verify and Repair transaction2009-08-10 21:35:10, Info                  CSI    00000174 Repair results created:POQ 71 starts: POQ 71 ends.2009-08-10 21:35:10, Info                  CSI    00000175 [SR] Verify complete2009-08-10 21:35:11, Info                  CSI    00000176 [SR] Verifying 100 (0x00000064) components2009-08-10 21:35:11, Info                  CSI    00000177 [SR] Beginning Verify and Repair transaction2009-08-10 21:35:18, Info                  CSI    00000178 Ignoring duplicate ownership for directory [l:54{27}]"??\C:\Windows\Inf\UGTHRSVC" in component WindowsSearchEngine, Version = 7.0.6001.16503, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral

    2009-08-10 21:35:18, Info                  CSI    00000179 Ignoring duplicate ownership for directory [l:64{32}]"??\C:\Windows\Inf\UGTHRSVC\0000" in component WindowsSearchEngine, Version = 7.0.6001.16503, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral

    2009-08-10 21:35:18, Info                  CSI    0000017a Ignoring duplicate ownership for directory [l:56{28}]"??\C:\Windows\Inf\UGatherer" in component WindowsSearchEngine, Version = 7.0.6001.16503, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral

    2009-08-10 21:35:18, Info                  CSI    0000017b Ignoring duplicate ownership for directory [l:66{33}]"??\C:\Windows\Inf\UGatherer\0000" in component WindowsSearchEngine, Version = 7.0.6001.16503, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral

    2009-08-10 21:35:18, Info                  CSI    0000017c Ignoring duplicate ownership for directory [l:62{31}]"??\C:\Windows\Inf\wsearchidxpi" in component WindowsSearchEngine, Version = 7.0.6001.16503, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral

    2009-08-10 21:35:18, Info                  CSI    0000017d Ignoring duplicate ownership for directory [l:72{36}]"??\C:\Windows\Inf\wsearchidxpi\0000" in component WindowsSearchEngine, Version = 7.0.6001.16503, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral

    2009-08-10 21:35:18, Info                  CSI    0000017e Ignoring duplicate ownership for directory [l:64{32}]"??\C:\Windows\Inf\UGTHRSVC\0816" in component WindowsSearchEngine.Resources, Version = 7.0.6001.16503, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"pt-PT", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral

    2009-08-10 21:35:18, Info                  CSI    0000017f Ignoring duplicate ownership for directory [l:66{33}]"??\C:\Windows\Inf\UGatherer\0816" in component WindowsSearchEngine.Resources, Version = 7.0.6001.16503, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"pt-PT", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral

    2009-08-10 21:35:18, Info                  CSI    00000180 Ignoring duplicate ownership for directory [l:72{36}]"??\C:\Windows\Inf\wsearchidxpi\0816" in component WindowsSearchEngine.Resources, Version = 7.0.6001.16503, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"pt-PT", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral

    2009-08-10 21:35:18, Info                  CSI    00000181 Repair results created:POQ 72 starts:

    Wich i don't even dare to think anything about it.

    Once again thanks for your time and concern about this, offcourse i'd appreciate all incoming help on this.

    Be well.

    Pedro Borba

    Was this answer helpful?

    0 comments
  4. Anonymous
    2009-08-11T17:50:17+00:00

    How to analyze the log file entries that the Microsoft Windows Resource Checker (SFC.exe) program

    generates in Windows Vista

    http://support.microsoft.com/kb/928228

    You can paste the error sections into a message here however each section often repeats so only paste

    each section once - usually 8 - 10 liines per section.

    An Update to my message :

    See the Title fix and others such as Permissions section by Nuero_Jim

    Download these - SAVE, disable your anti-virus and try both.

    1st run Disk Cleanup

    Start - All Programs - Accessories - System Tools - Disk Cleanup

    2nd this : TO RUN THESE - go to where you saved them - RIGHT CLICK on file - RUN AS ADMIN

    http://support.microsoft.com/kb/290301

    Description of the Windows Installer CleanUp Utility

    The Windows Installer CleanUp utility deletes all files and registry settings associated with a program's Windows Installer configuration. Does NOT remove an application, allows you to re-install one.

    http://technet.microsoft.com/en-us/magazine/2008.08.utilityspotlight.aspx 

    3rd : (New Part) Install this

    Windows Installer 4.5 Redistributable

    http://www.microsoft.com/downloads/details.aspx?FamilyID=5a58b56f-60b6-4412-95b9-54d056d6f9f4&displaylang=en

    4th : TO RUN THESE - go to where you saved them - RIGHT CLICK on file - RUN AS ADMIN

    Description of the System Update Readiness Tool for Windows Vista and for Windows Server 2008

    http://support.microsoft.com/kb/947821

    Rob - Bicycle - Mark Twain said it right.

    Was this answer helpful?

    0 comments