KB5005292 install error - 0x800700aa

Check the installed Microsoft Defender for Endpoint EDR sensor version first, because KB5005292 is a recurring sensor update and applies only when the installed sensor is older than the package being offered.

1. Verify that KB5005292 applies

KB5005292 is reused for successive versions of the Defender for Endpoint EDR sensor (MsSense.exe). The device must be onboarded to Defender for Endpoint, and Windows 10/11 devices require sensor version 10.8798.25857.1000 or later before this package is offered. Microsoft currently describes the package as updating the sensor to 10.8838 or later.^1^

1. Open Command Prompt as administrator.
2. Run:

sc qc sense

3. Find BINARY_PATH_NAME. Its path should contain the installed version, for example:

...\Platform\Versions\10.8845.26090.1015-0\MsSense.exe

4. Compare that version with the version offered through your update channel:
   • If the installed version is the same or newer, the package is not applicable. Do not repeatedly force-install it. Allow the next update scan to reassess applicability.
   • If the installed version is older, continue below.
   • If the Sense service is absent, verify that the device is actually onboarded to Defender for Endpoint; KB5005292 does not apply to a device without the EDR sensor.

The Microsoft Update Catalog can lag behind the version described in the KB article, so compare versions rather than relying on the repeated KB number alone.^1^

2. If the sensor is outdated, clear a possible transient lock

Error 0x800700AA alone does not establish whether the failure is caused by applicability, a resource currently in use, or servicing corruption.

1. Perform a normal Windows restart.
2. After signing in, avoid starting additional security, backup, or management applications.
3. Run Settings → Windows Update → Check for updates again.

KB5005292 itself does not require a restart after a successful installation, but restarting before retrying can complete pending update operations.^2^

If it still fails, try a clean boot during a maintenance window:

1. Run msconfig.
2. Select Services.
3. Select Hide all Microsoft services, then Disable all.
4. Under Startup, select Open Task Manager and disable non-Microsoft startup items.
5. Restart and retry the update.
6. Restore normal startup afterward.

Do not disable Microsoft Defender services or protections manually. A clean boot excludes non-Microsoft background software that might interfere with installation.^3^

3. Repair Windows servicing only if the update remains applicable

From an elevated Command Prompt, run:

DISM /Online /Cleanup-Image /RestoreHealth

Restart Windows and retry the update. This is a general Windows servicing repair, not a KB5005292-specific fix for 0x800700AA.^2^

A manual package can also be obtained from the Microsoft Update Catalog, but select only the package matching the exact Windows version and architecture. Confirm those details with winver and Settings → System → About → System type before downloading.^1^

4. Identify the actual failure from logs

If installation still fails, inspect:

• %SystemRoot%\Logs\CBS\CBS.log — servicing-stack installation details.
• C:\Windows\Logs\WindowsUpdate
• A readable Windows Update log generated from elevated PowerShell:

Get-WindowsUpdateLog

Search around the failure timestamp for 5005292, 0x800700aa, MsSense.exe, not applicable, or sharing/lock errors. These logs distinguish an applicability decision from a locked resource or damaged servicing component.^4^

On a Windows 365 Business Cloud PC, elevated commands and changes to managed update deployment may require the Windows 365 or Microsoft 365 administrator. If the logs do not identify a correctable condition, have the administrator open a Microsoft support request and attach the relevant CBS and Windows Update logs.

References

1. Microsoft Defender for Endpoint update for EDR Sensor
2. Windows Update troubleshooting guidance
3. Troubleshoot Windows Update error code 0x8007000e or 0x800705aa
4. Windows Update log files