Access denied while running Windows Update using Powershell's Invoke-Command

Question

I've been trying to setup a Powershell module that would remotely call Windows/Microsoft update on a server using Invoke-Command, then process the updates, and send everything back to the calling server so it can send an email report.

My issue comes when I try and call the downloader: Powershell seems to be requesting Elevated rights on the remote computer.

Here is a snippet of what I'm trying to run and fail:

Invoke-Command -ComputerName $Server -Credential $Credentials -ScriptBlock {
    $UpdateSession = New-Object -ComObject "Microsoft.Update.Session"
    Write-Progress -Activity "Updating" -Status "Checking for new updates"
    $Criteria = "IsInstalled=0 and Type='Software'"
    $Updates = $UpdateSession.CreateUpdateSearcher().Search($Criteria).updates
    $Downloader = $UpdateSession.CreateUpdateDownloader()
    $Downloader.Updates = $Updates
}

I know the issue isn't with remoting, as the first 4 commands work fine. The $Credentials variable points to pre-defined credentials, which are Local Admin on the remote server.

When the script gets to the 5th line, $Downloader = $UpdateSession.CreateUpdateDownloader(), I get this error from Powershell:

Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
    + CategoryInfo          : OperationStopped: (:) [], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException
    + PSComputerName        : SERVER.sidlee.inc

What could be causing this exactly ?

Thanks in advance for the help!

If I remember correctly, most of the Windows Update and Microsoft Installer methods require local and interactive sessions. One work around is then setting up a Task Scheduler task to run right away. — BenH, Sep 28 '17 at 18:59
If so, that would suck very much, because that's basically what I originally did. I had a massive script that was running everything (triggering Windows update, generating reports, sending them by email via another server, etc.), but I wanted to have everything running from a single server, via a Powershell module instead. — Alex Pilon, Sep 28 '17 at 20:18
Does this answer your question? [Powershell Remote: Microsoft.Update.Session, Access Denied: 0x80070005](https://stackoverflow.com/questions/7078958/powershell-remote-microsoft-update-session-access-denied-0x80070005) — argonym, Feb 03 '20 at 20:08

user1972814 · Answer 1 · 2018-02-14T00:58:45.643

As i just hit the same wall, and Google isn't of much help either, here is what i could dig up.

For the record, i am pretty much doing the same thing (using custom PS code to check remote systems for Windows Updates) but using WinRM over Python instead of Invoke-Command and also got stuck on Microsoft.Update.Searcher.Search() throwing a E_ACCESSDENIED error.

The UnauthorizedAccessException is indeed not related to Powershell but the underlying API.

I suspect Microsoft started cutting off impersonation in remote session in some recent update (Powershell v5?) as this was (and still is) working just fine on older Windows versions (e.g. Server 2012 with Powershell v3 or 2012 R2 with v4)

To get around this you will need to authenticate (on the remote server) prior to executing your stuff with a PSCredential object.

So Remote Auth -> Local Auth -> Run stuff for example using Start-Process -Credential ...

e.g.

$pass = ConvertTo-SecureString "PA$$W0RD" -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential "User", $pass
Start-Process -Credential $creds powershell -ArgumentList "-Command & { ... whatever you want to do ... }"

Keep in mind that this poses a security risk as your password will be parsed in clear text, so don't do this over an unencrypted channel!

No need to start a nested PowerShell. Check [this answer](https://stackoverflow.com/a/60046097) for a more seamless solution. — argonym, Apr 26 '22 at 10:47

Access denied while running Windows Update using Powershell's Invoke-Command

1 Answers1