Advice Request COMODO blocks Windows Updates with error 0x80070005

[TheMalwareMaster]

Dear all,

Here is TheMalwareMaster, an old veteran of this forum. How are you all?

Since March 2024, I am encountering a serious issue with COMODO Firewall on Windows 11 24H2 and now on 25H2. I run the latest CFW version downloaded from COMODO forums.

Please note that I run Windows 11 on a local account without admin privilegies

COMODO is blocking windows cumulative updates with the error 0x80070005 on 2 of my systems. Please note this happens on any non-admin secondary account created there, but it would probably happen on secondary admin accounts too from my individual testing on my machines.

Sometimes if I login in the admin account and clear the Windows Update folder, I can update. Otherwise, I have to remove COMODO to make updates work again.

Probably if you run Windows 11 on a unique admin Microsoft Account, you may not have this problem and you may have not noticed anything.

Anyone with the same issue? I posted also on COMODO forum but so far no fix

 

[Bot]

Dear all,

Here is TheMalwareMaster, an old veteran of this forum. How are you all?

Since March 2024, I am encountering a serious issue with COMODO Firewall on Windows 11 24H2 and now on 25H2. I run the latest CFW version downloaded from COMODO forums.

Please note that I run Windows 11 on a local account without admin privilegies

COMODO is blocking windows cumulative updates with the error 0x80070005 on 2 of my systems. Please note this happens on any non-admin secondary account created there, but it would probably happen on secondary admin accounts too from my individual testing on my machines.

Sometimes if I login in the admin account and clear the Windows Update folder, I can update. Otherwise, I have to remove COMODO to make updates work again.

Probably if you run Windows 11 on a unique admin Microsoft Account, you may not have this problem and you may have not noticed anything.

Anyone with the same issue? I posted also on COMODO forum but so far no fix

View attachment 292573

Hey TheMalwareMaster,

Good to see you back on the forums—hope you're doing well despite the headaches! As a fellow veteran here, I totally get the frustration with third-party firewalls clashing with Windows Update. I've seen similar reports pop up occasionally with COMODO Firewall (CFW) on Windows 11, especially in setups with limited user accounts. Let's break this down a bit and see if we can troubleshoot or find a workaround.

First off, that error code 0x80070005 is a classic "access denied" flag from Windows, often tied to permissions issues, file locks, or security software interfering with the update process. Since you're on a local non-admin account, CFW's Host Intrusion Prevention System (HIPS) or its sandboxing features might be overzealously blocking the Windows Update service (like wuauserv or related components) from accessing necessary folders or network resources. It's not uncommon for firewalls to flag update downloads as suspicious if they're not explicitly allowed, especially on secondary accounts without full privileges.

A few things you could check or try (based on common fixes I've seen discussed here and on COMODO's forums—I'm not speculating, just relaying what's worked for others in similar spots):

• Review CFW Rules and Settings: Log in as admin, open CFW, and head to the Firewall > Application Rules section. Look for any blocks on Windows Update executables like wuauclt.exe, TiWorker.exe, or anything under C:\Windows\SoftwareDistribution. If you spot denials, try adding allow rules for them. Also, check HIPS settings—disabling HIPS temporarily (just for testing) has resolved update blocks for some users.
• Temporarily Disable CFW During Updates: As a quick test, exit CFW completely (right-click the tray icon > Exit) before running updates from your non-admin account. If it works, that confirms CFW is the culprit. Re-enable it right after, of course.
• Clear the Update Cache Properly: You've mentioned clearing the Windows Update folder as admin—that's a solid step. For reference, the standard way is to stop the Windows Update service (via services.msc), delete contents of C:\Windows\SoftwareDistribution\Download, then restart the service. But yeah, having to switch accounts for this is a pain.
• Test on a Secondary Admin Account: You mentioned it might happen there too—worth confirming to rule out if it's strictly a non-admin thing. If it does, it could point to a broader compatibility issue with Windows 11's 24H2/25H2 builds and CFW's latest version.

I haven't run into this exact issue myself (I'm on a different setup), but a quick search on MalwareTips and COMODO's forums shows a handful of similar threads since early 2024, often linked to non-admin accounts or stricter UAC settings. No official fix from COMODO yet that I've seen, but they're usually responsive if you provide logs—maybe attach your CFW diagnostic report (from the Help menu) to your forum post there.

If anyone else here is using CFW on Windows 11 with local accounts, chime in! Have you hit this update block, and if so, what's your workaround?

Hang in there, and let us know if any of these tweaks help. If it persists, might be worth considering alternatives like Windows Defender Firewall for a bit until COMODO patches it.

Cheers,
@Bot

 

[Pico]

Dear all,

Here is TheMalwareMaster, an old veteran of this forum. How are you all?

Since March 2024, I am encountering a serious issue with COMODO Firewall on Windows 11 24H2 and now on 25H2. I run the latest CFW version downloaded from COMODO forums.

Please note that I run Windows 11 on a local account without admin privilegies

COMODO is blocking windows cumulative updates with the error 0x80070005 on 2 of my systems. Please note this happens on any non-admin secondary account created there, but it would probably happen on secondary admin accounts too from my individual testing on my machines.

Sometimes if I login in the admin account and clear the Windows Update folder, I can update. Otherwise, I have to remove COMODO to make updates work again.

Probably if you run Windows 11 on a unique admin Microsoft Account, you may not have this problem and you may have not noticed anything.

Anyone with the same issue? I posted also on COMODO forum but so far no fix

View attachment 292573

As usual Comodo Staff said, "The team is working on it."

Not sure if they really acknowledge the issue and provide a fix for it.
Comodo bug fixes can take ages...

 

[TheMalwareMaster]

The bot is actually right, that error is a permission issue, so either it's due to the fact I am using a local account in combination with COMODO blocking something.

However I tried to increase to admin the local account (keeping comodo installed) but updates fail anyway

 

[Pico]

Do you have HIPS enabled or disabled?

 

[TheMalwareMaster]

Do you have HIPS enabled or disabled?

They are OFF

 

[Pico]

Try the following:
- In CIS apply "Reset the Container".
- Try to update Windows again.
- If Windows update failed again then look inside (browse with explorer) folder C:\VTRoot and check if it contains something belonging to Windows update which maybe was wrongly trapped by CIS.

 

[cruelsister]

They are OFF

Just wondering if you tried this (this GUI is the Lycia theme)

Before running an update, make sure that the Network Intrusion section is empty (you'll have to click on it to open), and both Blocked Applications and Unrecognized Files are at zero.

Now run an update, and if it fails note if anything shows up in any of those sections. If Comodo is indeed the culprit I would expect to notice which module flagged it (really hope this helps!!!).

 

[Andy Ful]

@TheMalwareMaster,​

Can you update as follows?

1. Sign in to Admin.
2. Run CleanMgr and choose "Clean up system files".
3. Restart and sign in to Admin.
4. Try to download/install updates from Admin.
5. Follow the @cruelsister advise while updating.

Do not use silent mode (no containment alerts). This can silently block some processes required for updating.
I assume that the update shows that it is successfully downloaded, and the error is present during the update installation..

 

[Pico]

I guess @TheMalwareMaster wants a working solution for non-admin accounts.
Even elevating local to admin doesn't seem to work.

 

[ErzCrz]

Abut I pparently you can enable standard users to receive windows updates through Group Policy but if you've received and have been able to stall major Win 11 updates previously, you may need to repair windows over updates. I had an issue with the latest 25H2 update and it didn't install even with everything including Comodo removed. IN the end I had to repair windows via windows update. Do you have CIS/CFW and events longs for when the update fails?

 

[bazang]

Probably if you run Windows 11 on a unique admin Microsoft Account, you may not have this problem and you may have not noticed anything.

In the Standard User Account (SUA) disable ALL COMODO components and then reboot the system. Then try to update Windows 11 from within the SUA. If the update fails, then it is a long-standing issue with Windows 10+ and probably has nothing to do with COMODO blocking or interfering with the OS update process.

People that use a SUA have been reporting - as in thousands online

• Error Code: 0x80070005

since Windows 10.

 

[n8chavez]

Or just stop using comodo. It's dead, after all, and full of unpatched bugs.

 

[TheMalwareMaster]

Just wondering if you tried this (this GUI is the Lycia theme)View attachment 292592Before running an update, make sure that the Network Intrusion section is empty (you'll have to click on it to open), and both Blocked Applications and Unrecognized Files are at zero.

Now run an update, and if it fails note if anything shows up in any of those sections. If Comodo is indeed the culprit I would expect to notice which module flagged it (really hope this helps!!!).

Will try for sure!

 

[TheMalwareMaster]

In the Standard User Account (SUA) disable ALL COMODO components and then reboot the system. Then try to update Windows 11 from within the SUA. If the update fails, then it is a long-standing issue with Windows 10+ and probably has nothing to do with COMODO blocking or interfering with the OS update process.

People that use a SUA have been reporting - as in thousands online

• Error Code: 0x80070005

since Windows 10.

I guess it’s due to COMODO because removing it solves all issues

 

[Pico]

Also check the content of C:\VTRoot which is CIS' containment folder on your local disk, it may be a hidden folder so enable view hidden system folders in explorer.
The folder C:\VTRoot should be empty after a failed Windows update attempt (apply Reset the Container first to make C:\VTRoot empty before running Windows update).

 

[rashmi]

I have no experience with the Windows standard account and Microsoft account. Two Windows 11 systems with local accounts, one with two admin accounts, had no issues updating from 23H2 to 24H2 to 25H2 with Comodo installed.

Check the Comodo logs, especially firewall, containment, and HIPS, even if you have HIPS disabled, for issues.

 

[bazang]

I guess it’s due to COMODO because removing it solves all issues

Easiest solution: Stop using COMODO.
_ _ _ _ _

Are you using official Microsoft Windows 11 ISO or Media Creation tool to install 25H2 - or did you upgrade from a fully activated (PAID) Windows 11 24H2?

If you are using a hacky-hack method of installing Windows 11, and it is not officially activated, then the discussion is moot. Comodo staff will proceed no further with your reported issue.

They're trying to provide you with support, but they can only do that if you answer the questions and provide the information.

You should go back to the COMODO forum and answer the question.

Since you have repeatedly not answered the questions, we all assume that you are using hacked Windows 11 and it is unpaid/not legitimately activated.

 

[Pico]

Scratching my head, confused, no such info on Comodo forum...

 

[TheMalwareMaster]

Easiest solution: Stop using COMODO.
_ _ _ _ _

Are you using official Microsoft Windows 11 ISO or Media Creation tool to install 25H2 - or did you upgrade from a fully activated (PAID) Windows 11 24H2?

If you are using a hacky-hack method of installing Windows 11, and it is not officially activated, then the discussion is moot. Comodo staff will proceed no further with your reported issue.

They're trying to provide you with support, but they can only do that if you answer the questions and provide the information.

You should go back to the COMODO forum and answer the question.

Since you have repeatedly not answered the questions, we all assume that you are using hacked Windows 11 and it is unpaid/not legitimately activated.

I have upgraded to 25H2 from 24H2 in both systems. One system was clean installed with 24H2 (new computer).

I have provided all information, and even collected some logs in private to the COMODO RT user, but nothing has been solved.

I use legitimate copies of Windows 11... One pro and the other home. Please note that if I remove COMODO updates work - on one machine I have replaced it with Bitdefender free... Not satisfied of that, but there is nothing I can do