Merge pull request #173 from Icinga:fix/update_windows_update_error_message

Fix: Fixes Windows Updates permission exception; Add KB

Author: LordHepipud

doc/10-Knowledge-Base.md

@@ -13,3 +13,4 @@ For this reason you will find a list of Icinga knowledge base entries below. Ent
 | [IWKB000003](knowledgebase/IWKB000003.md) | The Icinga Agent service `icinga2` cannot be started/modified/added because it is marked for deletion. |
 | [IWKB000004](knowledgebase/IWKB000004.md) | Use-Icinga : The 'Use-Icinga' command was found in the module 'icinga-powershell-framework', but the module could not be loaded. For more information, run 'Import-Module icinga-powershell-framework' |
 | [IWKB000005](knowledgebase/IWKB000005.md) | powershell.exe : Failed to start service 'Icinga PowerShell Service (icingapowershell)'. |
+| [IWKB000006](knowledgebase/IWKB000006.md) | The user you are running this command as does not have permission to access the Windows Update ComObject "Microsoft.Update.Session". |

doc/knowledgebase/IWKB000006.md

@@ -0,0 +1,22 @@
+# Icinga Knowledge Base - IWKB000006
+
+## Short Message
+
+The user you are running this command as does not have permission to access the Windows Update ComObject "Microsoft.Update.Session".
+
+## Example Exception
+
+[UNKNOWN]: Icinga Permission Error was thrown: WindowsUpdate
+
+The user you are running this command as does not have permission to access the Windows Update ComObject "Microsoft.Update.Session".
+
+## Reason
+
+This issue is caused by calling [Invoke-IcingaCheckUpdates](https://icinga.com/docs/windows/latest/plugins/doc/plugins/14-Invoke-IcingaCheckUpdates/) over PowerShell Remote execution, with for example [check_by_powershell](https://github.com/Icinga/check_by_powershell).
+The Windows COM Object is rejecting every access to these information over remote connections, making it impossible to execute the plugin.
+
+## Solution
+
+Right now there is no solution available for this problem. Microsoft is not allowing to grant permission to these objects over remote connections, which makes it impossible to use them. In addition there is no proper alternative for fetching pending Windows Updates and Hotfixes.
+
+A possible fix which is suggested online is to add a scheduled task, running the command after being triggered by our execution and afterwards fetching the result from the task. This solution requires more research, testing and development.

lib/icinga/exception/Icinga_IcingaExceptionEnums.psm1

@@ -15,7 +15,10 @@
         'Message' = 'The user you are running this command as does not have permission to access the requested Wmi-Object. To fix this, please add the user the Agent is running with to the "Remote Management Users" groups and grant access to the WMI branch for the Class/Namespace mentioned above and add the permission "Remote enable".';
         'IWKB'    = 'IWKB000001';
     }
-    WindowsUpdate      = 'The user you are running this command as does not have permission to access the Windows Update ComObject "Microsoft.Update.Session". In order to fetch currently installed and pending updates, please grant the user the required permissions for fetching this information.';
+    WindowsUpdate      = @{
+        'Message' = 'The user you are running this command as does not have permission to access the Windows Update ComObject "Microsoft.Update.Session".';
+        'IWKB'    = 'IWKB000006';
+    }
 };
 
 [hashtable]$Inputs = @{