I have a SQL Server 2014 Agent Job (Type: "Operating system (CmdExec)", Run as: "SQL Server Agent Service Account", Owner: sa) that executes the following command:
powershell -ExecutionPolicy Bypass -Command "$objServiceManager = New-Object -ComObject 'Microsoft.Update.ServiceManager'; $objService = $objServiceManager.AddService2('7971f918-a847-4430-9279-4a52d1efe18d',2,''); $objService.PSTypeNames.Add('PSWindowsUpdate.WUServiceManager');"
The service account that SQL Server Agent is running under has sysadmin privileges to the instance, but does NOT have Admin access to the server.
If I RDP into the server as the Agent's service account, I can execute the command successfully from a command prompt:
But, if I execute the SQL Server Agent Job, it fails with an "Access Denied" error:
Exception calling "AddService2" with "3" argument(s): "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))" At line:1 char:79 + $objServiceManager = New-Object -ComObject 'Microsoft.Update.ServiceManager'; $o ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) , MethodInvocationException + FullyQualifiedErrorId : ComMethodTargetInvocation You cannot call a method on a null-valued expression. At line:1 char:170 + ... efe18d',2,''); $objService.PSTypeNames.Add('PSWindowsUpdate.WUServiceManager'); + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) , RuntimeException + FullyQualifiedErrorId : InvokeMethodOnNull
I have found that if I set the "Run as" for the job to a proxy account that has sysadmin privileges on the instance AND Admin access to the server, it succeeds, but that's not really relevant to my question.
EDIT: I'm executing everything as CmdExec, and not Powershell, because I need to execute an unsigned Powershell script (not included in my code, since it's not causing a problem). I get the same error if I change the Type to Powershell.
My question: Why does the same command fail as a job, but succeed from the console when both executed from the same user account on the same server?