imageHere’s a new Knowledge Base article we published. This one talks about an issue where Windows Update Standalone Installer (WUSA) returns 0x5 ERROR_ACCESS_DENIED when deploying Windows Update .msu files through Windows Remote Management.

=====

Symptoms

Windows Update Standalone Installer (WUSA) returns 0x5 ERROR_ACCESS_DENIED when deploying Windows Update .msu files through Windows Remote Management 2.0 and Windows Remote Shell. You may also see the following in the Application Event log:
Source: Microsoft-Windows-WUSA
Event ID: 3
Level: Error
Description: Windows update could not be installed because of error 2147942405 "Access is denied."

Cause

Installing an update using WUSA or the WUA APIs on a remote machine is not supported.

Workaround

To work around this issue, use the following method:

Extract the .msu file through Windows Remote Shell with WUSA using the following command:

winrs.exe -r:<computername> wusa.exe <update> /extract:<destination>

When complete, install the .cab package with dism.exe or Package Manager. To use dism.exe, use the command below:

winrs.exe -r:<computername> dism.exe /online /add-package /PackagePath:<Path_To_Package>\KBnnnnnnn.cab

More Information

The Windows Update Standalone Installer uses the Windows Update Agent API to install update packages. Update packages have an .msu file name extension. The .msu file name extension is associated with the Windows Update Standalone Installer.

The security restrictions on remote use of the WUA APIs are documented here: http://msdn.microsoft.com/en-us/library/windows/desktop/aa387288(v=vs.85).aspx

=====

For the most current version of this article please see the following:

2773898 - Windows Update Standalone Installer (WUSA) returns 0x5 ERROR_ACCESS_DENIED when deploying .msu files through WinRM and Windows Remote Shell

J.C. Hornbeck | Knowledge Engineer | Management and Security Division

Get the latest System Center news on Facebook and Twitter:

clip_image001 clip_image002

App-V Team blog: http://blogs.technet.com/appv/
ConfigMgr Support Team blog: http://blogs.technet.com/configurationmgr/< /a>
DPM Team blog:
http://blogs.technet.com/dpm/
MED-V Team blog: http://blogs.technet.com/medv/
Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
Operations Manager Team blog: http://blogs.technet.com/momteam/
SCVMM Team blog: http://blogs.technet.com/scvmm
Server App-V Team blog: http://blogs.technet.com/b/serverappv
Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center Essentials Team blog: http://blogs.technet.com/b/systemcen teressentials
WSUS Support Team blog: http://blogs.technet.com/sus/

The Forefront Server Protection blog: http://blogs.technet.com/b/fss/
The Forefront Endpoint Security blog : http://blogs.technet.com/b/clientsecurity/< /a>
The Forefront Identity Manager blog :
http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/< /a>