Immediate Fix: Reset Windows Update Components and Permissions
The error 0x80070005 is a classic “Access Denied” message. In Windows Server 2022, this usually occurs because the system lacks the necessary permissions to access specific update folders or services are being blocked.
To resolve this immediately, you must reset the Windows Update folders using an elevated Administrative Command Prompt. Run the following commands in sequence:
net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserverAfter executing these commands, restart your server and attempt the update again. This process clears the cache and forces Windows to recreate the update directories with fresh permissions.
Technical Explanation: Why 0x80070005 Occurs
At its core, error code 0x80070005 translates to E_ACCESSDENIED. On Windows Server 2022, this often signifies that the Windows Update service (wuauserv) or the TrustedInstaller account cannot write to the SoftwareDistribution folder.
This can be triggered by aggressive Group Policy Objects (GPOs), third-party security software locking files, or file system corruption within the Component Store. Since Windows Server 2022 uses hardened security modules, any mismatch in Access Control Lists (ACLs) will halt the update process to prevent system instability.
Alternative Methods
Method 1: Use SubInACL to Repair Permissions
If the standard reset fails, you may need to re-assert permissions across the registry and system folders. Use the following table to verify the status of critical services before proceeding.
| Service Name | Recommended Status | Startup Type |
|---|---|---|
| Background Intelligent Transfer Service (BITS) | Running | Automatic (Delayed) |
| Windows Update | Running | Manual (Trigger) |
| Cryptographic Services | Running | Automatic |
Method 2: Run DISM and SFC Scans
Corruption in the system image can also cause “Access Denied” errors during patching. Run the Deployment Image Servicing and Management (DISM) tool to repair the underlying Windows image.
dism /online /cleanup-image /restorehealth
sfc /scannowMethod 3: Manual Installation via Microsoft Update Catalog
If the automated service continues to fail, identify the specific KB number that is stuck. Visit the Microsoft Update Catalog, search for that KB, and download the standalone MSU installer for Windows Server 2022. Running the installer manually often bypasses service-level permission blocks.