Troubleshooting Access Denied Errors When Upgrading ControlUp Monitor Servers Using PowerShell

When upgrading a ControlUp monitor server from version 9.0.0.1680 to 9.2.0.733 using the PowerShell commandlet Invoke-CUMonitorUpdate, the process may fail with an “Access is denied” error. This failure occurs after the installation steps “Install Verify Service already installed” and “Install Copy Files” complete successfully, specifically at the step involving stopping the `cuMonitor` service. The error indicates that Windows denied access during the attempt to stop or control this service, despite running PowerShell as an administrator and having folder-level access to the monitor installation directory.

The root cause is typically related to security settings or interference by antivirus (AV) or endpoint detection and response (EDR) software, which can block the service from stopping. Alternatively, a restrictive service Access Control List (ACL) can prevent the upgrade from proceeding. When attempting to upgrade through the ControlUp Console, a similar failure occurs silently because the console relies on remote commands (via admin share or WMI) that suffer the same permissions restrictions.

To resolve this issue, manually stopping the `cuMonitor` service with elevated privileges is required. Running `sc.exe stop cuMonitor` on the monitor host as an administrator can successfully stop the service. If this command fails, it is necessary to configure AV/EDR exclusions for the ControlUp monitor executable and folder (`C:\Program Files\Smart-X\ControlUpMonitor\` and `cuMonitor.exe`) or adjust the service’s ACL using `sc.exe sdshow cuMonitor` to inspect and modify permissions. Once the service is stopped, re-running the Invoke-CUMonitorUpdate commandlet completes the upgrade successfully.

When upgrading through the ControlUp Console, ensure the account used has local administrator rights on the monitor host; otherwise, upgrade via the PowerShell commandlet locally on the machine is recommended for reliability. This approach has been verified to resolve the access denied error and enable the upgrade to proceed without interruption.

For more details on managing ControlUp monitor services and upgrade procedures, refer to the official ControlUp documentation at https://docs.controlup.com or consult ControlUp support resources.

Read the entire ‘Troubleshooting Access Denied Errors When Upgrading ControlUp Monitor Servers Using PowerShell’ thread below:

I’m attempting to upgrade a ControlUp monitor server from 9.0.0.1680 to 9.2.0.733 using the Invoke-CUMonitorUpdate PowerShell commandlet. When doing so, I get the following output:
“`PS C:\Windows\system32> Invoke-CUMonitorUpdate -Version 9.2.0.733
Install Verify Service already installed step ended,
Install Copy Files Step ended,
Install Begin Scope ended,

Success Error
——- —–
False Access is denied“`
I am running PowerShell as administrator and have access to the folder where the monitor is installed (C:\Program Files\Smart-X\ControlUpMonitor\Version 9.0.0.1680). What could be causing this error? Upgrade also fails silently when attempting through the ControlUp Console.

Where it fails: After “Begin Scope”, the next step is to Stop the Service (`cuMonitor`). Copy Files already succeeded; this is not a Program Files browse/ACL issue on the 9.0 folder.
Cause: Windows ACCESS_DENIED while stopping/controlling the `cuMonitor` service (almost always AV/EDR blocking the stop, or a locked-down service ACL). Console “silent” fail is the same class of problem remotely (admin share/WMI as the console user).
Resolve:
1. On the monitor host, elevated:`sc.exe stop cuMonitor` – if that fails, fix AV exclusions for`C:\Program Files\Smart-X\ControlUpMonitor\`/`cuMonitor.exe`, or service ACL (`sc.exe sdshow cuMonitor`).
2. Retry:`Invoke-CUMonitorUpdate -Version 9.2.0.733`
3. For Console upgrades: use an account that is local admin on the monitor, or upgrade only via PowerShell on-box.

Looks like I just needed to manually stop the cuMonitor service before running the PowerShell command. Everything upgraded perfectly after that. Thank you!

Continue reading and comment on the thread ‘Troubleshooting Access Denied Errors When Upgrading ControlUp Monitor Servers Using PowerShell’.  Not a member? Join Here!