Icinga Knowledge Base - IWKB000006

Short Message

The user you are running this command as does not have permission to access the Windows Update ComObject “Microsoft.Update.Session”.

Example Exception

[UNKNOWN]: Icinga Permission Error was thrown: WindowsUpdate

The user you are running this command as does not have permission to access the Windows Update ComObject “Microsoft.Update.Session”.

Reason

This issue is caused by calling Invoke-IcingaCheckUpdates over PowerShell Remote execution, with for example check_by_powershell. The Windows COM Object is rejecting every access to these information over remote connections, making it impossible to execute the plugin.

Solution

To resolve this issue without running the entire Icinga Agent service as NT AUTHORITY\SYSTEM, you can use the Windows Update Offload feature.

By enabling Windows Update Offload, a dedicated background scheduled task running as SYSTEM fetches pending Windows updates periodically and caches the results securely. The check plugin then reads from this cache without requiring elevated permissions or direct COM object access during check execution:

Enable-IcingaWindowsUpdateOffload;

An alternative solution is to use JEA