KB: Windows Update Standalone Installer (WUSA) returns 0x5 ERROR_ACCESS_DENIED when deploying .msu files through WinRM and Windows Remote Shell
Here’s a new Knowledge Base article we published. This one talks about an issue where Windows Update Standalone Installer (WUSA) returns 0x5 ERROR_ACCESS_DENIED when deploying Windows Update .msu files through Windows Remote Management.
=====
Symptoms
Windows Update Standalone Installer (WUSA) returns 0x5 ERROR_ACCESS_DENIED when deploying Windows Update .msu files through Windows Remote Management 2.0 and Windows Remote Shell. You may also see the following in the Application Event log:
Source: Microsoft-Windows-WUSAEvent ID: 3Level: ErrorDescription: Windows update could not be installed because of error 2147942405 "Access is denied."
Cause
Installing an update using WUSA or the WUA APIs on a remote machine is not supported.
Workaround
To work around this issue, use the following method:
Extract the .msu file through Windows Remote Shell with WUSA using the following command:
winrs.exe -r:<computername> wusa.exe <update> /extract:<destination>
When complete, install the .cab package with dism.exe or Package Manager. To use dism.exe, use the command below:
winrs.exe -r:<computername> dism.exe /online /add-package /PackagePath:<Path_To_Package>\KBnnnnnnn.cab
More Information
The Windows Update Standalone Installer uses the Windows Update Agent API to install update packages. Update packages have an .msu file name extension. The .msu file name extension is associated with the Windows Update Standalone Installer.
The security restrictions on remote use of the WUA APIs are documented here: https://msdn.microsoft.com/en-us/library/windows/desktop/aa387288(v=vs.85).aspx
=====
For the most current version of this article please see the following:
J.C. Hornbeck | Knowledge Engineer | Management and Security Division
Get the latest System Center news on Facebook and Twitter :
App-V Team blog: https://blogs.technet.com/appv/
ConfigMgr Support Team blog: https://blogs.technet.com/configurationmgr/< /a>
DPM Team blog: https://blogs.technet.com/dpm/
MED-V Team blog: https://blogs.technet.com/medv/
Orchestrator Support Team blog: https://blogs.technet.com/b/orchestrator/
Operations Manager Team blog: https://blogs.technet.com/momteam/
SCVMM Team blog: https://blogs.technet.com/scvmm
Server App-V Team blog: https://blogs.technet.com/b/serverappv
Service Manager Team blog: https://blogs.technet.com/b/servicemanager
System Center Essentials Team blog: https://blogs.technet.com/b/systemcen teressentials
WSUS Support Team blog: https://blogs.technet.com/sus/
The Forefront Server Protection blog: https://blogs.technet.com/b/fss/
The Forefront Endpoint Security blog : https://blogs.technet.com/b/clientsecurity/< /a>
The Forefront Identity Manager blog : https://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: https://blogs.technet.com/b/isablog/
The Forefront UAG blog: https://blogs.technet.com/b/edgeaccessblog/< /a>