CERTUTIL - access denied

Question

(using Windows 10 21H2) I ran into issues a few months back with routine MS updates - "We couldn't connect to the update service."

Been puzzling over this for a while, as there is no issue with the Internet connection (1 Gb fibre), and finally came across some references to CERTUTIL and problems with certificate updates.

So I ran via elevated CMD, and used

certutil.exe -generateSSTFromWU c:\temp\roots.sst

Access is Denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED) -- authrootstl.cab

(etc...)

Also ran using TrustedInstaller, and same result.

So, is certutil having a problem or is something else having a problem.

Please note, this is a Windows 10 PC.

Answer 1

In fact, Windows 10 is currently updated to 22H2, and I think you can try upgrading directly through the Upgrade Assistant to see if you can solve this problem.

You can go here and click "Update Now" to get the update helper.

Answer 2

Hi

Its my personal PC on a home network.

I've run through the 'clean boot' process and this has not made any difference.

My current suspicion is that there is a corruption somewhere regards the certutil.exe

thanks

Answer 3

Thank you for your reply.

I would like to reconfirm whether your computer is for personal use and is on a private network or a company computer and has joined the domain environment or is using the company network?

Considering that you checked for a certificate problem and had a "access denied" error, I wonder if this means that your computer has domain control or a third-party software is blocking the update.

If your computer is for personal use, try a clean boot before checking for updates.

Disclaimer: A “clean boot” starts Windows with a minimal set of drivers and startup programs. It helps to determine whether a background program is interfering with your game or program and to isolate the cause of a problem. 

These steps of "clean boot" might look complicated at first glance. However, to avoid any trouble for you, please follow them in order and step-by step so that it will help you get you back on track.

If your computer is in a domain environment, IT is recommended that you contact your IT staff to check if any group policy controls prevent updates.

Answer 4

That's the odd thing. There isn't -

"We couldn't connect to the update service. We'll try again later, or you can check now. If it still doesn't work, make sure you're connected to the Internet."

Regards the troubleshooting, I've run that any number of times, and it doesn't find anything to correct.

Windows update history currently returns a blank page.

Answer 5

Hi old.goat,

Welcome to Microsoft Community.

May I ask if you see an error code when Windows Update shows "We cannot connect to the update service"? Please provide a screenshot of the problem if you can (mainly to confirm the name of the update that can't be installed/downloaded). The main reasons for certificate errors are: there is a problem with the update (which may be a known problem with subsequent updates to fix, or a BUG), and there is a problem with the update service for your computer.

For known issues, you can click here to see if the updated KB you encounter is one of the KB of the known issue.

If it's not a known problem, click search on the taskbar, type "Troubleshooting" and open it, select Troubleshooting to run Windows Update, wait to check the problem to see the diagnostic results, please post the diagnostic results in this thread, and I'll help you see the problem.

Your patience and cooperation are highly appreciated. If there is anything not clear, please do not hesitate to let me know.

Best Regards,

Manson - MSFT | Microsoft Community Support Specialist