0x80070020 is ERROR_SHARING_VIOLATION: a file Windows Update needs is open in another process, so the update cannot get exclusive access to it. It appears at the install stage, and its most common author is real-time antivirus scanning the very files being replaced, with a second installer running at the same time a close second.
net stop wuauserv, net stop cryptSvc, net stop bits, net stop msiserver. Rename C:\Windows\SoftwareDistribution to SoftwareDistribution.old and C:\Windows\System32\catroot2 to catroot2.old, then restart the four services with net start. This rebuilds the download cache and the update database from scratch.DISM /Online /Cleanup-Image /RestoreHealth, then sfc /scannow. Restart afterwards; a repaired store often lets the same update sail through on the next attempt.If the violation persists on a clean boot, use a clean-boot configuration (msconfig → Hide all Microsoft services → Disable all) to eliminate every third-party contender at once, then update. Whatever service’s return makes the error come back is the locker. Corruption beneath it all is the last possibility, addressed by the DISM step and, finally, a repair install.
Why would antivirus block a Microsoft update? Not deliberately. The scanner opens files to inspect them at the moment the installer needs exclusive access to replace them, and the timing collision produces the violation. It is a race, which is why the same update often succeeds on a second attempt.
Is it safe to update with antivirus disabled? For the duration of one update attempt, with Windows Security (which is integrated and does not cause this clash) still running, yes. Re-enable the third-party product immediately afterwards.