Install error - 0x800700aa

Check the installed Microsoft Defender for Endpoint sensor version first, because KB5005292 applies only when the installed MsSense.exe version is older than the offered version 10.8839.26080.2008.

1. Compare the installed and offered versions

Open Command Prompt as administrator and run:

sc qc sense
sc query sense

In the sc qc sense output, find BINARY_PATH_NAME. Its path contains the installed sensor version, for example:

...\Platform\Versions\10.8845.26090.1015-0\MsSense.exe

Microsoft periodically reuses KB5005292 for newer EDR sensor releases. Windows 10/11 devices must already have sensor version 10.8798.25857.1000 or later, and the update applies only when the installed version is earlier than the package version.^1^

• Installed version is 10.8839.26080.2008 or newer: Do not try to force-install the Catalog package. The device already has that release or a later one. Retry Windows Update after its detection metadata refreshes; KB5005292 can appear at different times across update channels.
• Installed version is older: Continue with the diagnostics below.
• The Sense service does not exist: KB5005292 cannot apply unless the device is onboarded to Microsoft Defender for Endpoint and has its EDR sensor installed.^1^

The Catalog currently lists the referenced KB5005292 package.^2^

2. If the installed sensor is older

Error 0x800700AA maps to Windows error 170, ERROR_BUSY: “The requested resource is in use.” This identifies the immediate failure state but not which process or resource caused it.^3^

1. Restart Windows to release any pending file or service locks.
2. Open Settings → Windows Update → Check for updates.
3. Retry KB5005292.
4. Afterward, rerun sc qc sense and verify that the version in BINARY_PATH_NAME has advanced to the offered version or later. KB5005292 itself does not normally require a restart after successful installation.^1^

Do not treat guidance for 0x800705AA as applicable here. That is a different error code associated with insufficient system resources; your error is 0x800700AA.^4^

3. If it continues to fail

Generate the readable Windows Update log from an elevated PowerShell window:

Get-WindowsUpdateLog
Copy-Item "$env:windir\Logs\CBS\CBS.log" "$env:USERPROFILE\Desktop\CBS.log"
Get-Service Sense | Format-List Name,Status,StartType
sc.exe qc sense | Out-File "$env:USERPROFILE\Desktop\SenseConfig.txt"

Review:

• The generated WindowsUpdate.log on the desktop for 0x800700AA, KB5005292, and nearby failure entries.
• C:\Windows\Logs\CBS\CBS.log for the installation failure and the resource or file reported immediately before it.

WindowsUpdate.log records Windows Update activity, while CBS.log covers package installation by the servicing stack.^5^

Also open:

Event Viewer → Applications and Services Logs → Microsoft → Windows → SENSE → Operational

Check events at the time of the failed installation. In particular, service startup failures should be evaluated using their accompanying failure code and adjacent events.^6^

If the sensor is older and repeated installation attempts still fail, provide Microsoft or the organization’s Defender administrator with:

• Installed sensor version
• WindowsUpdate.log
• CBS.log
• Exported SENSE/Operational events
• Exact Windows edition and version
• Whether updates are delivered through Windows Update, Intune, Configuration Manager, or WSUS

References

1. Microsoft Defender for Endpoint update for EDR Sensor | Microsoft Support
2. Microsoft Update Catalog
3. System Error Codes (0-499)
4. Troubleshoot Windows Update error code 0x8007000e or 0x800705aa
5. Windows Update log files
6. Review events and errors using Event Viewer