Fix: winget 'Access Denied' (0x80070005) — 6 Fixes

You ran winget install and got "Access is denied" (HRESULT 0x80070005, or sometimes just "Access denied"). Here's why, and 6 fixes ranked from easiest to nuclear.

Why 0x80070005 happens

0x80070005 is a generic Windows "access denied" error. In winget context it usually means:

• The Terminal isn't running as Administrator
• The install location is read-only or protected
• Antivirus is intercepting the installer
• The Windows Installer service is locked down
• Group Policy is preventing per-user installs

90% of the time it's the first one.

Fix 1 — Run Terminal as Administrator (the answer 90% of the time)

Most Windows installers need admin to write to C:\Program Files and modify HKLM. Open Terminal as Admin:

• Press Win + X → click Terminal (Admin)
• Or: Win + S → "Terminal" → right-click → Run as administrator
• Or: in PowerShell: Start-Process pwsh -Verb RunAs

Confirm UAC, then retry:

winget install --id <Your.Package>

If you can't access admin (work machine, restricted account), see Fix 2.

Fix 2 — Install per-user (no admin needed)

Many modern installers support per-user install which writes to %LOCALAPPDATA%\Programs\<App> and doesn't need admin:

winget install --id Microsoft.VisualStudioCode --scope user
winget install --id Mozilla.Firefox --scope user
winget install --id Google.Chrome --scope user
winget install --id Discord.Discord --scope user

Not every app supports --scope user — if you get "No applicable installer found", the app requires admin. Move to Fix 3.

Fix 3 — Check what the installer actually needs

winget show --id <ID>

Look at the Installers section. If you see Scope: machine only — admin is required. If both machine and user exist, use --scope user.

Fix 4 — Disable antivirus interception (briefly)

Some antivirus tools intercept installer execution and report "access denied" instead of the real reason. Test by temporarily disabling AV:

• Windows Defender: Settings → Privacy & security → Windows Security → Virus & threat protection → temporarily disable real-time protection
• Third-party AV: vendor-specific; check the tray icon

Retry winget. If it works — AV was the problem; whitelist winget.exe and the publisher's installer URL.

Re-enable AV after the test.

Fix 5 — Reset Windows Installer permissions

If admin still fails, the Installer service may have corrupted permissions. Reset:

# Run in Admin PowerShell
sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

Then:

icacls "C:\Program Files\WindowsApps" /reset /T /C

(This re-applies default permissions to the WindowsApps folder. Takes a few minutes.)

Reboot, retry winget.

Fix 6 — Reset App Installer

The Microsoft.DesktopAppInstaller package (which provides winget.exe) might be broken:

Get-AppxPackage Microsoft.DesktopAppInstaller | Reset-AppxPackage

If still broken, fully reinstall:

Get-AppxPackage Microsoft.DesktopAppInstaller | Remove-AppxPackage

Then install from the Microsoft Store. See How to install winget on Windows 10.

Fix 7 — Check Group Policy

If your machine is domain-joined or has applied a restrictive GPO, admin install may be blocked at the policy level:

gpresult /h "$env:TEMP\gpo.html"
start "$env:TEMP\gpo.html"

Look for Computer Configuration → Administrative Templates → Windows Components → Windows Installer. If Disable Windows Installer is enabled, your IT department has blocked it. Talk to them.

Specific scenarios

"Access denied" on winget upgrade

The currently-installed version is locking files. Close the app first:

Get-Process -Name "<App>" -ErrorAction SilentlyContinue | Stop-Process -Force
winget upgrade --id <ID>

"Access denied" on winget uninstall

Same idea — close the running app:

Get-Process -Name "<App>" -ErrorAction SilentlyContinue | Stop-Process -Force
winget uninstall --id <ID>

"Access denied" writing to log

If you passed --log "C:\Windows\winget.log", winget can't write there. Pick a user-writable path:

winget install --id <ID> --log "$env:TEMP\winget.log"

Domain account / corporate machine

If you can't elevate at all:

1. Ask IT to push the app via SCCM or Intune
2. Or ask for a winget-import allowed-app list applied via DSC
3. Or install per-user where possible (--scope user)

Quick checklist

If you keep hitting 0x80070005:

1. Am I in a Terminal that's "Run as administrator"? (Title bar should say "Administrator: Terminal")
2. Did I close the app I'm trying to upgrade?
3. Is my antivirus interfering?
4. Does the app actually exist? (winget show --id <ID>)
5. Is this a corporate machine with restrictive policies?

90% of cases resolve at step 1 or 2.

What's next?

• All winget error codes explained → — full reference
• Installer hash does not match → — sibling error
• Another installation in progress → — MSI lock error
• Winget search not working → — search troubleshooting