Windows Updates: 0x80070005 (E_ACCESSDENIED)

[mmartinello]

This issue respects the following points:

• [ ] This is a bug, not a question or a setup/configuration issue.
• [X] This issue is not already reported on Github (I've searched it).
• [X] I use the latest release of the Monitoring Plugins (https://github.com/Linuxfabrik/monitoring-plugins/releases).
• [X] I agree to follow Monitoring Plugins's Code of Conduct.

Which variant of the Monitoring Plugins do you use?

• [ ] .rpm/.deb package from repo.linuxfabrik.ch
• [ ] Compiled for Linux (.tar/.zip from download.linuxfabrik.ch)
• [X] Compiled for Windows (from download.linuxfabrik.ch)
• [ ] Source Code from GitHub

Bug description

Disclaimer: this is not a bug, but I think that this could be documented to avoid missunderstandings.

I am running the Windows Icinga Agent on Windows Server 2019, which runs as Network Service:

The Windows Updates updates.exeplugin is getting me an Access denied error:

Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
At line:4 char:5

+     $Pending = $SearchIndex.Search('IsInstalled=0');

+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : OperationStopped: (:) [], UnauthorizedAccessException

    + FullyQualifiedErrorId : System.UnauthorizedAccessException

I think this could be due the fact that Network Service cannot access to the Microsoft.Update.Session PowerShell object.

Is it correct to run Icinga with Network Service or it's better to run it as a local or domain user?

Steps to reproduce - Plugin call

..\uupdates.exe

Steps to reproduce - Data

No response

Environment

Windows Server 2019

Plugin Version

updates.exe: v2023051201 by Linuxfabrik GmbH, Zurich/Switzerland

Python version

No response

List of Python modules

No response

Additional Information

No response

[0x446]

According to Icinga's documentation it runs under the network user by default. Check the setting descriptions under icinga.com/docs/icinga-2/latest/doc/06-distributed-monitoring/#agent-setup-on-windows-configuration-wizard That being said, I would recommend you to run it under the local system account as a lot of Linuxfabric's plugins need additional permissions to perform certain lookups.

[mmartinello]

Thank you @0x446!

[markuslf]

Thank you @0x446!