Install error - 0x800700aa

sandhya rani 0 Reputation points
2026-11-11T06:48:50.6466667+00:00

Install error - 0x800700aa

Windows 10/11 - Update for Microsoft Defender for Endpoint - KB5005292 (Version 10.8839.26080.2008) - Current Channel (Broad)

Windows for home | Other | Windows update
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vikki-T 13,945 Reputation points Microsoft External Staff Moderator
    2026-11-11T13:53:10.7666667+00:00

    Hello sandhya rani,

    Since KB5005292 is an update for the Microsoft Defender for Endpoint sensor, please confirm whether the computer is managed by a workplace or school.

    If it is organization-managed, check Windows Update history to see whether a newer revision of the update has already installed. If the failure keeps returning, the organization’s IT or Defender administrator should review the device’s onboarding and update-management configuration.

    If this is a personal device, please let us know whether Microsoft Defender for Endpoint was intentionally installed, as this update is normally associated with devices enrolled in an organization’s Defender environment. Thank you so much for your understanding.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-11-11T06:50:00.4366667+00:00

    Check the installed Microsoft Defender for Endpoint sensor version first, because KB5005292 applies only when the installed MsSense.exe version is older than the offered version 10.8839.26080.2008.

    1. Compare the installed and offered versions

    Open Command Prompt as administrator and run:

    sc qc sense
sc query sense

    In the sc qc sense output, find BINARY_PATH_NAME. Its path contains the installed sensor version, for example:

    ...\Platform\Versions\10.8845.26090.1015-0\MsSense.exe

    Microsoft periodically reuses KB5005292 for newer EDR sensor releases. Windows 10/11 devices must already have sensor version 10.8798.25857.1000 or later, and the update applies only when the installed version is earlier than the package version.^1^

    • Installed version is 10.8839.26080.2008 or newer: Do not try to force-install the Catalog package. The device already has that release or a later one. Retry Windows Update after its detection metadata refreshes; KB5005292 can appear at different times across update channels.
    • Installed version is older: Continue with the diagnostics below.
    • The Sense service does not exist: KB5005292 cannot apply unless the device is onboarded to Microsoft Defender for Endpoint and has its EDR sensor installed.^1^

    The Catalog currently lists the referenced KB5005292 package.^2^

    2. If the installed sensor is older

    Error 0x800700AA maps to Windows error 170, ERROR_BUSY: “The requested resource is in use.” This identifies the immediate failure state but not which process or resource caused it.^3^

    1. Restart Windows to release any pending file or service locks.
    2. Open Settings → Windows Update → Check for updates.
    3. Retry KB5005292.
    4. Afterward, rerun sc qc sense and verify that the version in BINARY_PATH_NAME has advanced to the offered version or later. KB5005292 itself does not normally require a restart after successful installation.^1^

    Do not treat guidance for 0x800705AA as applicable here. That is a different error code associated with insufficient system resources; your error is 0x800700AA.^4^

    3. If it continues to fail

    Generate the readable Windows Update log from an elevated PowerShell window:

    Get-WindowsUpdateLog
Copy-Item "$env:windir\Logs\CBS\CBS.log" "$env:USERPROFILE\Desktop\CBS.log"
Get-Service Sense | Format-List Name,Status,StartType
sc.exe qc sense | Out-File "$env:USERPROFILE\Desktop\SenseConfig.txt"

    Review:

    • The generated WindowsUpdate.log on the desktop for 0x800700AA, KB5005292, and nearby failure entries.
    • C:\Windows\Logs\CBS\CBS.log for the installation failure and the resource or file reported immediately before it.

    WindowsUpdate.log records Windows Update activity, while CBS.log covers package installation by the servicing stack.^5^

    Also open:

    Event Viewer → Applications and Services Logs → Microsoft → Windows → SENSE → Operational

    Check events at the time of the failed installation. In particular, service startup failures should be evaluated using their accompanying failure code and adjacent events.^6^

    If the sensor is older and repeated installation attempts still fail, provide Microsoft or the organization’s Defender administrator with:

    • Installed sensor version
    • WindowsUpdate.log
    • CBS.log
    • Exported SENSE/Operational events
    • Exact Windows edition and version
    • Whether updates are delivered through Windows Update, Intune, Configuration Manager, or WSUS

    References

    1. Microsoft Defender for Endpoint update for EDR Sensor | Microsoft Support
    2. Microsoft Update Catalog
    3. System Error Codes (0-499)
    4. Troubleshoot Windows Update error code 0x8007000e or 0x800705aa
    5. Windows Update log files
    6. Review events and errors using Event Viewer
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.