0x80070005 – Access is denied

Recently, we have noticed failed installations that return error code 0x80070005. Among the affected applications: Microsoft Visual C++ 2015-2019, Image Reziser and others.

At first sight, it would seem that the setup doesn’t have the necessary permissions to complete the installation. However, the setup was running either as Administrator, or as the System account. So, clearly, that’s not the issue.

In our case, it seem that the issue was caused by the antivirus software. According to the software’s log (we use McAfee Endpoint Security), “<user> ran VC_redist.x86.exe, which tried to access HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE{49697869-BE8E-427D-81A0-C334D1D14950}, violating the rule “Registering of programs to autorun”, and was blocked. For information about how to respond to this event, see KB85494.”

We’ve identified two workarounds for this issue:

  1. Removing the antivirus software and installing the faulty setup. However, this is a bit radical and will make the machine vulnerable.
  2. Updating the antivirus software. In our case, it seems that the correct policies were not enforced locally, due to a fault in the communication between the McAfee ePO Agent and the back end. Checking further revealed that the last agent-to-server communication on the PC happened months ago. Updating the agent and rebooting the PC solved the issue.