MSU Update Access Denied

4/26/2018 5649 Contributors

You receive the error, "Access Denied" or "0x5" or "ERROR_ACCESS_DENIED" when deploying an MSU, a Windows update file. Often there is an HRESULT error of -2147942405 or ?-2147024891, but could include other HRESULT errors.

?In certain cases, Windows Update Standalone Installer (WUSA) cannot install updates through remote management (e.g. WinRM, remote shell). In other cases, the error represents something wrong with the target machine's Windows Update process. In still other cases, the error can occur when antivirus software prevents the installation of the update or there is an authentication issue.

For HRESULT -2147942405:
Extract the .msu file using the following command:

expand -F:* "<updatefile.msu>" <destination>

For example:

expand -F:* "windows10.0-kb4038801-x64_4dd412107b61dc1c1eb6b9fb4ae0b366cea65687.msu" "C:\Temp\KB4038801"

NOTE: in some cases, the destination directory must exist prior to extraction.

Once extracted, the cab file can be installed with DISM:

DISM.exe /Online /Add-Package /PackagePath:<Path_To_Package>\

If Window Update might be the cause:
If the target machine's Windows Update is suspect, open an elevated PowerShell prompt on the target and run the following (or run remotely) in order: 

Stop-Service wuauserv
cd $env:systemroot
Rename-Item SoftwareDistribution SoftwareDistribution.old
Start-Service wuauserv