0x80070005

What it means

Something the operation needed was denied. During servicing, Microsoft's guidance is that file system or registry permissions were changed and the servicing stack no longer has the access it requires. The code never tells you which object was denied, so the log is the only way forward.

Real causes

• Permissions on a file or registry key were changed, often by a hardening baseline or a third-party tool.
• The account running the operation is not the one you think it is. Scheduled and deployment tasks usually run as SYSTEM.
• An endpoint protection product is blocking access to the object.

What to do

1. Go to %windir%\logs\CBS, open the newest CBS.log, and search for ", error". Match on the timestamp of the failure.
2. Scroll up from the error to find the file or registry key that was denied. That object is the actual problem.
3. Compare permissions on that object with a known good device, then correct them.
4. If a security baseline changed those permissions, fix the baseline rather than the single device, or it will come back.

Where to look

• %windir%\Logs\CBS\CBS.log

Checked against Microsoft documentation. Last reviewed 2026-08-20.

Decode another code