Back up important files, restore WinSxS ownership to TrustedInstaller, reset its permissions, and then reset the Windows Update folders while all three relevant services are stopped.
1. Repair ownership and permissions
The 0x80070005 result is E_ACCESSDENIED; Microsoft associates it with Windows Update being unable to access required files, folders, or registry entries. The accompanying 0x8024200B only indicates that the update installer failed—it does not identify a more specific cause.^1^^2^
Because resetting WinSxS permissions already returned Access Denied, first restore its documented owner:
- Back up important personal files.
- Search for Command Prompt, right-click it, and select Run as administrator.
- Run these commands individually:
icacls "%windir%\WinSxS" /setowner "NT SERVICE\TrustedInstaller" /t /c /q
icacls "%windir%\WinSxS" /reset /t /c /q
icacls "%windir%\SoftwareDistribution" /reset /t /c /q
Some individual access-denied messages can be reported while /c continues processing. If the commands complete, restart Windows and try the update once. These are Microsoft’s documented ownership and permission repairs for this error.^1^
2. Reset all Windows Update components
If the update still fails, use the complete reset sequence below. You previously stopped BITS and Windows Update, but stopping Cryptographic Services as well may release the catroot2 folder. An access-denied result can also come from permissions or file-system filter drivers, so this is not proof that Cryptographic Services caused the earlier failure.
Run in an administrative Command Prompt:
net stop wuauserv
net stop bits
net stop cryptSvc
ren "%windir%\SoftwareDistribution" SoftwareDistribution.old
ren "%windir%\System32\catroot2" catroot2.old
net start cryptSvc
net start bits
net start wuauserv
Restart the PC, then open Settings → Update & Security → Windows Update → Check for updates. Windows will recreate both folders. This sequence is Microsoft’s documented Windows Update component reset.^1^
Do not manually take ownership of or delete the entire WinSxS folder.
3. Check non-Microsoft file-system filters
Uninstalling antivirus covers only part of the third-party interference check. Security, backup, encryption, and storage products can leave file-system filter drivers installed.
- In an administrative Command Prompt, run:
fltmc
- Identify any non-Microsoft filters. If one belongs to software that can safely be stopped, unload it temporarily:
fltmc unload <DriverName>
- Repeat for other non-Microsoft filters, restart, and retry the update.
Caution: unloading a filter can temporarily disable protection, backup, encryption, or storage functionality. Do not unload an unknown filter; instead, update or temporarily uninstall its associated application. Microsoft includes this check in its 0x80070005 procedure.^1^
Applicability and escalation
KB5126657 applies to Windows 10 22H2 under Windows 10 ESU, and to Windows 10 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021 for version 21H2. Its published known issue concerns USB Audio Class 1.0 devices, not installation error 0x80070005.^3^
Run winver and verify that the installed Windows edition/version is eligible for this update. If it is not enrolled in or licensed for the applicable servicing channel, permission repairs will not establish update eligibility.
If the ownership command still returns Access Denied, or installation still fails after the reset and filter-driver check, generate a fresh log:
Get-WindowsUpdateLog
Also retain C:\Windows\Logs\CBS\CBS.log, then contact Microsoft Support. The official procedure recommends escalation after the permission, component-reset, system-repair, and third-party-filter checks fail.^1^
References
- Troubleshoot Windows Update error 0x80070005
- Windows Update error codes by component
- October 13, 2026—KB5126657 (OS Builds 19045.7807 and 19044.7807 ...