Windows update Error 0x80070005 - Need a fix? Click here.

Question

The error code 0x80070005 is also described as ACCESS DENIED. 

Please follow these instructions if you are encountering this error code when checking or installing updates via Windows Udpate. 

To correct the problem, you can try the steps below. Keep in mind that these steps are still experimental. I look forward to your feedback and results. For the long term, we hope that we can create an automated solution for all.

1. Download and install SubInACL from the Microsoft Download Center http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=23510
2. Open Notepad (Click Start, type Notepad, and then press Enter)
3. Copy and paste the following text into Notepad

Set OSBIT=32

IF exist "%ProgramFiles(x86)%" set OSBIT=64

set RUNNINGDIR=%ProgramFiles%

IF %OSBIT% == 64 set RUNNINGDIR=%ProgramFiles(x86)%

subinacl /subkeyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" /grant="nt service\trustedinstaller"=f

4. Close Notepad, and make sure you save it. When you save the text, make sure that you set

Save as Type to “All Files (*.*)”. Very important! The file name needs end with .CMD. For example: fix.cmd. Lastly, when you save the file, make sure you save it at a location where it will be easy for you to find.

5. Right click on the file that you just saved in step #4, and select “Run as Adminstrator”

To confirm that you have the symptoms and to validate the problem, please see the below:

The following is applicable to Windows 7 and Windows Vista .

1. Download AccessChk (Sysinternals).  This tool allows you to evaluate the access level of specific users or groups of resources including files, directories, Registry keys, global objects and Windows services.  Here's the link to download the tool: http://technet.microsoft.com/en-us/sysinternals/bb664922.aspx

2. Save the zip file on your desktop, and extract the file:

• Right click on the file, and select Extract All...
• Click Next when prompted for the Destination.

As a result, you should see a folder called AccessChk  on your desktop.

3. Open the folder AccessChk 
4. Hold the shift-key and right click in the window.  Select "Open Command Prompt Here"
5. A command prompt window should open with a similar prompt:

C:\Users<USERNAME>\Desktop\accesschk>

6.  Type the following command, and press Enter:

accesschk.exe -s -n "nt service\trustedinstaller" -k "hklm\software\Microsoft\Windows\CurrentVersion\Component Based Servicing" >accesskchk.txt

Tip: You should be able to copy and paste the command into the command prompt.

7. Close the Command Prompt Window.  Open the Accesschk folder on yoru desktop (if it has been closed).
8. Double click on Accesschk.txt (the text file), this should open Notepad.

9.  Copy and Paste your results with a new question on the Windows Update forum.  (Make sure you write 0x80070005 in the subject line).

Cheers!

Kim N. L.

Microsoft Partner Technical Technical Lead

Answer 1

Hello all,

I would like to apologize for the delayed response on this thread.  All the results (logs) that you have all posted in the thread are helpful.    Based on the various results, it’s evident that the problem has a common cause.  

Here’s a little background on the problem that you are experiencing:

When you use Windows Update to install updates for Windows Vista and Windows 7, the process relies on the Windows Module Installer (trustedinstaller.exe).  The TrustedInstaller is the online interface to the servicing stack.  To keep things simple, it’s one of the most important components when you install updates.   This method also allows Windows to be serviced (to install updates) without the need of an administrator.  In fact, when the components of Windows are being updated, it’s the TrustedInstaller that is used to update the operating system files. 

Furthermore, when you look at the security settings of certain servicing components of Windows, you would notice that the TrustedInstaller is the only item listed under the User Name and Groups with full permissions.   This is only true if the respective folder or registry key is kept at its default state.  In other words, changes to these security settings would cause the ACCESS DENIED (0x80070005).  It’s difficult to associate a culprit to the unwanted changes.   A possible cause that was previously mentioned is malware.

Awhile ago, I asked the community to run a Sysinternal Tool known as Access Check to capture the details of the problem.  The output of the tool would list all of the servicing components where the security permissions restricted the TrustedInstaller.  As a result, when you try to install updates for Windows, you would obtain the error 0x80070005 – also known as ACCESS DENIED.  In summary, it is the TrustedInstaller that has been denied of access to a component that it should have access to.

Here’s an example of the output:

HKLM\software\Microsoft\Windows\CurrentVersion\Component Based Servicing\Retry Agent

HKLM\software\Microsoft\Windows\CurrentVersion\Component Based Servicing\Sqm

HKLM\software\Microsoft\Windows\CurrentVersion\Component Based Servicing\Sqm\VistaSP1-KB936330~31bf3856ad364e35~x86~~6.0.1.18000

HKLM\software\Microsoft\Windows\CurrentVersion\Component Based Servicing\Sqm\VistaSP1-KB936330~31bf3856ad364e35~x86~~6.0.1.18000\InstallCounter

As you can see from the above, there are four registry keys with unexpected security settings.

...The Solution...

To correct the problem, you can try the steps below.  Keep in mind that these steps are still experimental.   I look forward to your feedback and results.  For the long term, we hope that we can create an automated solution for all.

1.       Download and install  SubInACL from the Microsoft Download Center http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=23510

2.       Open Notepad (Click Start, type Notepad, and then press Enter)

3.       Copy and paste the following text into Notepad

Set OSBIT=32

IF exist "%ProgramFiles(x86)%" set OSBIT=64

set RUNNINGDIR=%ProgramFiles%

IF %OSBIT% == 64 set RUNNINGDIR=%ProgramFiles(x86)%

subinacl /subkeyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" /grant="nt service\trustedinstaller"=f

4.       Close Notepad, and make sure you save it.  When you save the text, make sure that you set

Save as Type to “All Files (*.*)”.  Very important!  The file name needs end with .CMD.  For example:  fix.cmd.  Lastly, when you save the file, make sure you save it at a location where it will be easy for you to find.

5.       Right click on the file that you just saved in step #4, and select “Run as Adminstrator”

Thanks and I look forward to your feedback.

Kim

Answer 2

Hi Gamer000...,

I followed the advice on this post and it worked for me:  http://social.answers.microsoft.com/Forums/en-US/vistawu/thread/a9a2c92d-793b-4050-bdb1-720bb97bd78d/?prof=required

Here is what they said to do:

The error code 80070005 usually means that you do not have enough permission to install updates.

First please confirm you have logged on an account with administrative privileges.

If the issue still occurs, lets’ try the following method to reset the permissions:

1. Download the subinacl.msi file from the following link and save the installation patch onto the Desktop:

http://www.microsoft.com/downloads/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en#AffinityDownloads

2. Go to the Desktop and double click the downloaded file.

3. Select the C:\Windows\System32 folder as the Destination Folder during the installation. Later we will use this tool to reset the permission settings on the current machine.

**Note:**If the UAC (User Account Control) window is prompted for permission to continue, please click Continue.

4. Click Start, in the Start Search bar, type: "notepad" (without quotes) and press Enter.

5. Copy the following commands and then paste them into the open Notepad window:

@echo off

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f

subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f

subinacl /subdirectories %SystemDrive% /grant=administrators=f

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f

subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f

subinacl /subdirectories %SystemDrive% /grant=system=f

@Echo

@Echo Finished.

@Echo

@pause

6. After pasting the above commands, please close the Notepad window. Choose Save when you are prompted to save the file. Type "reset.bat" as the file name and choose Desktop from the left panel as the save location.

7. Refer to the Desktop and right click the reset.bat file, and then choose "Run as administrator."

8. You will see a DOS-like window processing.

**Note:**It may take several minutes. Please be patient. When it is completed, you will be prompted with the message: "Finished, press any key to continue".

Try to install the updates again.

This issue can be also caused by third-party security programs such as firewalls and anti-virus software. You can disable or remove them to check the issue.

Answer 3

all i got is:

"Invalid account name: NT SERVICE\TRUSTEDINSTALLER"

did i type something wrong? running vista 64 ultimate

Answer 4

I followed the advice on the following post and it fixed the problem:

http://social.answers.microsoft.com/Forums/en-US/vistawu/thread/a9a2c92d-793b-4050-bdb1-720bb97bd78d/?prof=required

Thanks,

Jim

Answer 5

all i got is:

"Invalid account name: NT SERVICE\TRUSTEDINSTALLER"

did i type something wrong? running vista 64 ultimate

Hey loudog_jon,

The command line should be correct.  Perhaps a typo? 

Which of the two commands did you encounter the error?

It might help if you took a screenshot.  Windows Vista comes with a tool that allows you to take a screenshot:

1. Click Start
2. Type "Snippet" in the search box
3. The Snippet Tool should be listed in the search result, then you can click on it to launch

You can also use the Live Skydrive to save the screenshot so that it can be shared.  Here's the link: http://skydrive.live.com/

Regards,

-k