Access Denied Running over SSH

[kcancook]

When running

Install-WindowsUpdate -MicrosoftUpdate

over SSH I get access denied even though it's an elevated shell with admin access.

Erorr is:
Install-WindowsUpdate : Access is denied (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

[Montigomo]

the same thing and it became after KB5065789 (win11)
here is the video - https://youtu.be/xy11NWbnqrA
Before this update KB5065789 everything was working fine.

[WestonThayer]

I can repro as well on Win 11 for just querying for updates. Get-WindowsUpdate -IgnoreReboot used to work when run from admin via SSH on Windows 10, but not on Windows 11. Not sure about the KB.

Try Invoke-WUJob -RunNow -Confirm:$false -Verbose -Script 'Import-Module PSWindowsUpdate; Install-WindowsUpdate -MicrosoftUpdate' to run it as a scheduled task under the ssh user. Getting logs is annoying though.

[derSchweiger]

I can verify this issue on Windows Server 2025, too. While executing the cmdlet Get-WUHistory I receive the following error message:

Get-WUHistory : Zugriff verweigert (Ausnahme von HRESULT: 0x80070005
(E_ACCESSDENIED))
In Zeile:1 Zeichen:1
+ Get-WUHistory
+ ~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-WUHistory], UnauthorizedA
   ccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,PSWindowsUpda
   te.GetWUHistory

This happens only if I'm connected via openSSH. It seems like that some previous Windows Update is responsible for this behaviour - any ideas how to fix this?

[WestonThayer]

Use Invoke-WUJob.

[derSchweiger]

At least in my case this won‘t help since I want to get all previous installed updates and not install new ones.

[WestonThayer]

Invoke-WUJob appears to just be a convenience wrapper for schtasks. You can change the script that runs

PSWindowsUpdate/PSWindowsUpdate/PSWindowsUpdate.xml

Line 2064 in db46f4e

<para type="description">Specify PowerShell script that you what to run. Default is {ipmo PSWindowsUpdate; Get-WindowsUpdate -AcceptAll -Install | Out-File $Env:TEMP\PSWindowsUpdate.log}</para>

You could probably also use schtasks directly. My understanding of what Invoke-WUJob does is:

1. schtasks /create to create a task that will run as the current user (or maybe system, I dunno) with the given script
2. schtasks /run to immediately trigger it

Caller is responsible for checking the log file to understand output.

Tis a silly workaround, if Windows wants to lock it down, dunno why they leave this gaping loophole. There may be some other techniques worth trying, like psexec https://stackoverflow.com/questions/59880794/starting-gui-programs-via-openssh-on-windows.

[derSchweiger]

@WestonThayer yeah, you're right.
You can use something like

Invoke-WUJob -TaskName "Check WU History" -RunNow -Script "Get-WUHistory -MaxDate ((Get-Date).AddDays(-100)) | Export-CSV C:\Temp\wuhistory.csv"

export the logs into a csv file on your system and check the generated file afterwards but this is kind of a hurry and more prone to errors.

From my perspective it would be great to get an idea, why Get-WUHistory won't work anymore in the first place. Maybe this is an error and we can fix it without the workaround mentioned above.

[WestonThayer]

Somebody else noticing the change to underlying APIs https://www.reddit.com/r/PowerShell/comments/1of2flt/recent_windows_11_24h2_cu_windows_update_api_no/

https://learn.microsoft.com/en-us/windows/win32/wua_sdk/using-wua-from-a-remote-computer is the closest thing I could find on docs from Microsoft. No explanation is given as to why certain APIs are unavailable to remote connections (FYI both ssh and WinRM/PS-Session start a "network login" session). That doc does suggest that update searching should be allowed from remote computers, so maybe Windows shipped a bug that they should fix 🤷🏻

The main workarounds are scheduled tasks and psexec.

[kdcollinson]

This issue has been around now for the past few CUs impacting W11 and Server 2025 (Not checked 2022).
This months CU (Released today) has also failed to resolve the issue.

Any API querying done remotely regardless if SSH or PSRemote fails with 0x80070005 (UnauthorizedAccessException).

[derSchweiger]

This issue only occurs on W2k25, W2k22 and older seems not to be affected (yet)

[robertstrom]

Both "workarounds" are pretty lame IMHO. What I was told by a previous MSFT manager of the PowerShell / OpenSSH programs / projects (whatever MSFT calls them) is that WinRM is not going to be developed anymore and that SSH is the way forward. That SSH is the remote management method that everything else but MSFT products uses and that MSFT is joining the rest of the technology ecosystem in adopting, and moving forward with SSH as the defacto recommended default (consider that SSH is now installed, but not enabled, on Server 2025). I was even told that the recommendation is to connect via RDP through an SSH tunnel.

If what I was told is correct, then we should absolutely have the ability to remotely mange things like updates via the command line via an SSH connection. Could you imagine not being able to remotely manage updates on a Linux server via SSH?

I'm pretty sure that I see no comments in here from anyone at MSFT. Sure would be nice if they chimed in here with regards to giving us the ability to manage updates using the command line via SSH.

[kdcollinson]

Both "workarounds" are pretty lame IMHO. What I was told by a previous MSFT manager of the PowerShell / OpenSSH programs / projects (whatever MSFT calls them) is that WinRM is not going to be developed anymore and that SSH is the way forward. That SSH is the remote management method that everything else but MSFT products uses and that MSFT is joining the rest of the technology ecosystem in adopting, and moving forward with SSH as the defacto recommended default (consider that SSH is now installed, but not enabled, on Server 2025). I was even told that the recommendation is to connect via RDP through an SSH tunnel.

If what I was told is correct, then we should absolutely have the ability to remotely mange things like updates via the command line via an SSH connection. Could you imagine not being able to remotely manage updates on a Linux server via SSH?

I'm pretty sure that I see no comments in here from anyone at MSFT. Sure would be nice if they chimed in here with regards to giving us the ability to manage updates using the command line via SSH.

Last time I checked WinRM underpinned SSH on Windows... That may have changed since 2025.