Update-Help access denied on Domain Controller

under both enterprise and domain admin on a DC I can’t run update-help with out an access denied on two text files in modules for AD and GP. Trusted Installer is only context with full control and I can’t wrestle back permissions under any other context (i.e. Administrators) in order to run update-help

I opened a Premier Support case with MS but going in circles. Does anyone know how PowerShell leverages Trusted Installer to update help? I can repro this all over DCs

You won’t be able to change the permissions unless you take ownership of the file. However, I’m not convinced it’s a permissions problem. I just checked my test DC and only Trusted Installer has Full Control and my files update just fine.

Please can you post the full error message that you get when you run Update-Help.

Yeah tried the change ownership route (to Local Machine Administrators) but same issue.

Here’s the output:

PS C:> whoami
dev
PS C:> Update-Help
Update-Help : Failed to update Help for the module(s) ‘ActiveDirectory, GroupPolicy’ with UI culture(s) {e
Access to the path
'C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\en-US\about_ActiveDirectory_Identity.h
is denied.
At line:1 char:1

  • Update-Help
  •   + CategoryInfo          : InvalidOperation: (:) [Update-Help], Exception
      + FullyQualifiedErrorId : UnknownErrorId,Microsoft.PowerShell.Commands.UpdateHelpCommand
    
    

Update-Help : Failed to update Help for the module(s) ‘Microsoft.MonitoringAgent.PowerShell’ with UI cultu
{en-US} : Unable to retrieve the HelpInfo XML file for UI culture en-US. Make sure the HelpInfoUri propert
module manifest is valid or check your network connection and then try the command again.
At line:1 char:1

  • Update-Help
  •   + CategoryInfo          : ResourceUnavailable: (:) [Update-Help], Exception
      + FullyQualifiedErrorId : UnableToRetrieveHelpInfoXml,Microsoft.PowerShell.Commands.UpdateHelpCommand

A few more questions:

What OS are you running on the DCs?
What version of PowerShell?
Is everything patched and up-to-date?

Are you running from an elevated prompt? Right-click ‘Run As Administrator’.

Try the command:

Update-Help -UICulture en-US -Force –Verbose

The second problem (for the MonitoringAgent) relates to it being unable to download the help file. You can check the URI in the HelpInfo.xml file in the module’s directory. Try copying and pasting it into a web browser.

Responses:

Windows Server 2012 R2

Name Value


PSVersion 4.0
WSManStackVersion 3.0
SerializationVersion 1.1.0.1
CLRVersion 4.0.30319.34014
BuildVersion 6.3.9600.17400
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0}
PSRemotingProtocolVersion 2.2

DC patched monthly

yep; Administrator

result: Update-Help -UICulture en-US -Force –Verbose

no errors (yellow verbose showing URI resolving) until end of update, then:

Update-Help : Failed to update Help for the module(s) ‘ActiveDirectory, GroupPolicy’ with UI culture(s) {en-US} :
Access to the path
‘C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\en-US\about_ActiveDirectory_Identity.help.txt’
is denied.
At line:1 char:1

  • Update-Help -UICulture en-US -Force –Verbose
  •   + CategoryInfo          : InvalidOperation: (:) [Update-Help], Exception
      + FullyQualifiedErrorId : UnknownErrorId,Microsoft.PowerShell.Commands.UpdateHelpCommand
    
    

Update-Help : Failed to update Help for the module(s) ‘Microsoft.MonitoringAgent.PowerShell’ with UI culture(s)
{en-US} : Unable to retrieve the HelpInfo XML file for UI culture en-US. Make sure the HelpInfoUri property in the
module manifest is valid or check your network connection and then try the command again.
At line:1 char:1

  • Update-Help -UICulture en-US -Force –Verbose
  •   + CategoryInfo          : ResourceUnavailable: (:) [Update-Help], Exception
      + FullyQualifiedErrorId : UnableToRetrieveHelpInfoXml,Microsoft.PowerShell.Commands.UpdateHelpCommand
    
    
    

re: MonitoringAgent issue, there is no Module folder by that name (or Microsoft.MonitoringAgent.PowerShell) in C:\Windows\System32\WindowsPowerShell\v1.0\Modules

SOLVED: MS Engineer noticed that during an Update-Help to a new Parent Module Folder that each Module gets a non-unique .xml file that was missing for (2) of my module folders for a few domain controllers.

Module Folder
ActiveDirectory: ActiveDirectory_43c15630-959c-49e4-a977-758c5cc93408_HelpInfo.xml
GroupPolicy: GroupPolicy_03e49e3a-be77-4422-9d97-8fe355c2284c_HelpInfo.xml

Once we copied these from a working server, the access denied error went away.

The PS error seems to be a bit of a red herring.