Windows Update error 0x80070020 maps to the Win32 error ERROR_SHARING_VIOLATION — "the process cannot access the file because it is being used by another process." In plain terms, an update needs to write a file that something else is holding open. The usual culprits are third-party antivirus scanning update files mid-install, or the Windows Update / BITS services still gripping file handles from a previous failed attempt.
Because it's a locking problem rather than a corruption problem, the fix is to (1) remove whatever is holding the lock and (2) reset the update components so Windows rebuilds a clean cache. This guide starts with the quickest, safest checks — the built-in troubleshooter and antivirus — then moves to resetting the update stack and repairing system files, and finally to installing the update manually if a single KB keeps failing. Every command below comes from Microsoft's own documentation.
Before you start
What you will learn
- How to diagnose and fix Windows Update error 0x80070020 on Windows 10 and 11 by clearing the process that is locking update files and repairing the update stack.
- This error leaves a device stuck on old, potentially insecure builds because updates fail to download or install — a real risk for both home users and managed fleets.
Requirements
- You need to sign in with a local administrator account so you can open an elevated Command Prompt, stop Windows services, and change antivirus settings.
- A Windows 10 or Windows 11 device that fails to install updates with error 0x80070020, with an internet connection for re-downloading updates.
- Local Administrator on the affected Windows 10 or 11 device
Good to know
- About 20 minutes, most of which is waiting for SFC/DISM scans and the update to re-download.
- Commands and menu paths are taken from Microsoft's own support and Learn documentation and apply to supported Windows 10 and Windows 11 releases.
Quick answer
Error 0x80070020 is a sharing violation: a file Windows Update needs is locked by another process, usually antivirus or a stuck update service. Run the Windows Update troubleshooter, temporarily disable third-party antivirus, then reset the update components by stopping the BITS, Windows Update, and Cryptographic services and renaming the SoftwareDistribution and catroot2 folders. Repair system files with SFC and DISM, and if one specific update keeps failing, install it manually from the Microsoft Update Catalog.
Settings > System > Troubleshoot > Other troubleshooters > Windows Update (Windows 11)net stop bits & net stop wuauserv & net stop cryptsvcStep-by-step tutorial
6 stepsRun the built-in Windows Update troubleshooter
Let Windows automatically detect and reset broken update components before you touch anything manually.
Settings > System > Troubleshoot > Other troubleshooters > Windows UpdateStart with Microsoft's own automated fix:
- Windows 11: go to Settings > System > Troubleshoot > Other troubleshooters, find Windows Update, and select Run. On newer builds you can also launch it from the Get Help app.
- Windows 10: go to Settings > Update & Security > Troubleshoot > Additional troubleshooters, select Windows Update, then Run the troubleshooter.
Let it finish, apply any fix it offers, then restart the device and try the update again.
The troubleshooter often clears transient service locks on its own, which is why it's the recommended first step — but it rarely resolves an antivirus-caused sharing violation, so don't stop here if the error persists.
Temporarily disable third-party antivirus and retry
Rule out (and remove) the most common cause of 0x80070020: security software locking update files during a real-time scan.
Settings > Windows Update > Check for updatesIf you have a third-party security product (Malwarebytes, Kaspersky, Bitdefender, Norton, ESET, and similar), right-click its system-tray icon and choose the option to disable protection (or turn off) for a short period. Then go to Settings > Windows Update > Check for updates and retry.
If the update now succeeds, the antivirus was the cause. Instead of leaving protection off, re-enable it and add exclusions for these two folders so future scans don't lock update files:
C:\Windows\SoftwareDistributionC:\Windows\System32\catroot2
Microsoft Defender does not normally cause this error. Re-enable any disabled protection immediately after testing.
Reset the Windows Update components
Release file handles held by the update services and force Windows to rebuild a clean update cache.
Open Command Prompt as administrator (Start > type *cmd* > right-click > Run as administrator) and run these commands, pressing Enter after each. They stop the update services, clear the BITS queue, rename the cache folders so Windows recreates them, and restart the services.
After the services restart, go to Settings > Windows Update and check for updates again.
net stop bits
net stop wuauserv
net stop cryptsvc
Del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"
Ren %Systemroot%\SoftwareDistribution SoftwareDistribution.bak
Ren %Systemroot%\System32\catroot2 catroot2.bak
net start bits
net start wuauserv
net start cryptsvcMicrosoft's documented "quick" reset is simply net stop wuauserv, rd /s /q %systemroot%\SoftwareDistribution, net start wuauserv. Renaming to .bak instead of deleting is reversible — once updates work, you can delete the .bak folders. If a folder won't rename with "access denied," make sure cryptsvc is stopped or reboot and retry.
Repair system files with SFC and DISM
Fix corrupted system files or a damaged component store that can keep updates from applying even after a cache reset.
In the same elevated Command Prompt, run the System File Checker, then the DISM component-store repair. Let each finish before running the next — DISM can take several minutes and needs an internet connection.
When both complete, restart the device and try the update again.
sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealthIf SFC can't fix everything, run DISM first and then SFC again — DISM repairs the component store that SFC draws its known-good files from.
Perform a clean boot and retry the update
Eliminate any remaining background app or service that is locking update files, beyond antivirus.
System Configuration (msconfig) > Services > Hide all Microsoft services > Disable allOpen System Configuration (Start > type *msconfig* > Enter). On the Services tab, check Hide all Microsoft services, then Disable all. On the Startup tab, open Task Manager and disable startup items. Click OK and restart.
In this minimal environment, go to Settings > Windows Update and install the update. Afterwards, reopen msconfig, return to Normal startup, and restart to re-enable your apps.
msconfigAlways revert to Normal startup once the update succeeds so your security and productivity apps load again.
Install the failing update manually from the Microsoft Update Catalog
Bypass the automatic pipeline when a single KB repeatedly fails with 0x80070020.
Settings > Windows Update > Update history (to find the KB number)Note the KB number of the failing update (shown in Settings > Windows Update > Update history). Go to the Microsoft Update Catalog at https://catalog.update.microsoft.com, search for that KB, and download the package that matches your Windows version and architecture (x64/ARM64). Run the downloaded .msu installer and reboot when prompted.
Only download updates from catalog.update.microsoft.com — it is Microsoft's official distribution point. Match the update to your exact edition and CPU architecture.
How to Confirm Error 0x80070020 Is Fixed
To confirm the fix, go to Settings > Windows Update and select Check for updates. The update that previously failed should now download and install without error 0x80070020. Open Update history and verify the update (or KB number) is listed under Successfully installed, with no new failed entries. If you added antivirus exclusions for the SoftwareDistribution and catroot2 folders, keep them in place so the sharing violation doesn't recur. Once updates work reliably, you can delete the SoftwareDistribution.bak and catroot2.bak folders you created during the reset.
- The update installs and appears as "Successfully installed" in Update history; the device is fully up to date and the 0x80070020 error no longer appears.
- If 0x80070020 still appears after all steps, the file is being locked by something persistent (aggressive endpoint protection, disk corruption) or the component store is still damaged — collect logs and consider an in-place repair install of Windows.
- Maps to ERROR_SHARING_VIOLATION — a file is in use by another process.
- What a resolved update should read after the fix.
Troubleshooting
"Access denied" when renaming the catroot2 folder
Cause: The Cryptographic service (cryptsvc) still has a handle open on catroot2, or another process is using it.
Make sure you ran net stop cryptsvc (and net stop bits/net stop wuauserv) before renaming. If it still fails, reboot, reopen the elevated prompt, stop the services again, and rename before anything reconnects — or rename from Safe Mode.
The troubleshooter says it fixed the problem but 0x80070020 comes back
Cause: A third-party antivirus is re-locking update files on the next scan, so the sharing violation returns.
Temporarily disable the antivirus and retry; if that works, add exclusions for C:\Windows\SoftwareDistribution and C:\Windows\System32\catroot2, or update/replace the security product.
Only one specific update (KB) fails, everything else installs
Cause: That package is hitting a locked or in-use file during its own install, independent of the general update cache.
Download that KB directly from the Microsoft Update Catalog and install the standalone .msu, which bypasses the automatic pipeline.
A service won't stop ('The service cannot be stopped')
Cause: A dependent task or another process is keeping the service busy.
Retry after a reboot, or end the wuauserv/BITS host from Task Manager's Services tab, then run the reset commands. As a last resort, perform the reset from Safe Mode.
Updates still fail after resetting the cache
Cause: The component store (WinSxS) is corrupted, so even a clean cache can't apply the update.
Run DISM /Online /Cleanup-Image /RestoreHealth, then sfc /scannow, restart, and try again. If it still fails, run an in-place repair (upgrade) install keeping apps and files.
Frequently asked questions
What does Windows Update error 0x80070020 mean?
0x80070020 is the Win32 error ERROR_SHARING_VIOLATION: "the process cannot access the file because it is being used by another process." Windows Update is trying to write a file that another program — usually antivirus or a stuck update service — has locked.
Is it safe to rename or delete the SoftwareDistribution folder?
Yes. SoftwareDistribution is a cache that Windows automatically rebuilds. Renaming it to SoftwareDistribution.bak (after stopping the update services) only clears the local download cache and update history — it doesn't affect installed updates.
Why does my antivirus cause error 0x80070020?
Real-time protection scans files as they're written. If it opens an update file at the same moment Windows Update needs to modify it, the file is briefly locked and the update fails with a sharing violation. Excluding the update folders usually stops this.
Do I need to restart after resetting Windows Update components?
A restart isn't strictly required because the commands restart the services for you, but rebooting before you re-check for updates clears any lingering file handles and gives the most reliable result.
Does this fix apply to both Windows 10 and Windows 11?
Yes. The commands to reset the update components are identical on both; only the path to the built-in troubleshooter differs (Settings > System > Troubleshoot on Windows 11, Settings > Update & Security > Troubleshoot on Windows 10).
