Allow Get-LSUpdate -Model to run without local system / WMI / COM calls (catalog-only mode)

[shahzadsaddique]

Hi,

First of all, thank you for maintaining LSUClient , it’s a very useful module and widely adopted.

We’re currently using Get-LSUpdate -Model <model> in an automation context and wanted to ask whether it would be possible to support a catalog-only / no local system access mode.

Context

Even when -Model is explicitly specified, the module appears to perform several local system checks early in execution (hardware inventory, docking detection, storage, etc.). These involve WMI/COM/system providers and require elevated or local-machine permissions.

This makes it impossible to run Get-LSUpdate in sandboxed or cloud-native environments (for example, Azure Functions or other restricted automation runtimes), even when we are only interested in:

• querying updates for a specific model, and

• reading metadata (not installing anything).

We tested combinations such as:

• Model

• NoTestInstalled

• filtering results (e.g. Where-Object { $_.Installer.Unattended })

…but the local calls still occur before results are returned.

Feature request

Would it be feasible to add a switch or execution path such as:

• -CatalogOnly

• -NoLocalSystemChecks

or similar

…that skips all local hardware/system interrogation and relies purely on Lenovo’s update catalog when -Model is provided?

Why this could be valuable

• Enables cloud-native automation and reporting scenarios

• Makes LSUClient usable in restricted environments

• Benefits organizations that want update awareness without running on endpoints

• Backwards-compatible if implemented as an opt-in switch

If this isn’t feasible due to architectural constraints, that’s completely understandable — we’d mainly like to know whether this is technically possible or intentionally out of scope.

Thanks again for your work, and happy to provide additional details or testing if helpful.

Best regards,
Shahzad

[jantari]

Get-LSUpdate -Model ABC -All -NoTestApplicable -NoTestInstalled -NoTestSeverityOverride

https://jantari.github.io/LSUClient-docs/docs/cmdlets/get-lsupdate/

Please let me know if you're still experiencing issues with the above command.

But also, none of the hardware queries made by LSUClient require elevated privileges. A standard used account can run them, the only thing that can require elevated privileges is Lenovos' external detection routines which are just standalone executables. That being said using the above command still has the benefit of skipping a lot of work so the results are much faster.

[shahzadsaddique]

Hi @jantari, thanks for the suggestion.

I tried running:

Get-LSUpdate -Model 21K7 -All -NoTestApplicable -NoTestInstalled -NoTestSeverityOverride
This works fine on a regular Windows machine, but in Azure Functions (Windows / App Service) it still fails with:

Exception calling "Get" with "0" argument(s): Access is denied (0x80070005)
The function is triggered correctly, but the error appears to come from a restricted .Get() call (likely WMI/COM/CIM) that’s blocked by the Azure App Service sandbox, not by missing elevation. Even as a standard user, those APIs aren’t accessible in Functions.

Just wanted to share this in case others try running LSUClient inside Azure Functions.

Thanks again for the great module!

[jantari]

Okay I understand better now. Can you please run:

Get-LSUpdate -Model 21K7 -All -NoTestApplicable -NoTestInstalled -NoTestSeverityOverride -Verbose -Debug *>&1

the extra verbose output will help me understand at which point in the code exactly the error is thrown.

[shahzadsaddique]

@jantari tried extra params and got the same exception. Below is the code + Exception

try {
    Import-Module LSUClient -ErrorAction Stop
    $updates = Get-LSUpdate -Model $model -All -NoTestApplicable -NoTestInstalled -NoTestSeverityOverride -Verbose -Debug *>&1
} catch {
    Write-Host "EXCEPTION: $($_.Exception.Message)"
    if ($_.Exception.InnerException) { Write-Host "INNER: $($_.Exception.InnerException.Message)" }
    Write-Host ($_.Exception | Format-List * -Force | Out-String)
    Write-Host "SCRIPT STACK: $($_.ScriptStackTrace)"
    Write-Error "FAILED: $($_.Exception.Message)"
    if ($_.Exception.InnerException) { Write-Error "INNER: $($_.Exception.InnerException.Message)" }
    throw
}

Exception calling "Get" with "0" argument(s): "Access is denied. (0x80070005 (E_ACCESSDENIED))" Stack: at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input) at System.Management.Automation.Runspaces.Pipeline.Invoke() at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke) at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDoWork(Runspace rsToUse, Boolean isSync) at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection1 input, PSDataCollection1 output, PSInvocationSettings settings) at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection1 input, PSDataCollection1 output, PSInvocationSettings settings) at System.Management.Automation.PowerShell.CoreInvoke[TOutput](IEnumerable input, PSDataCollection1 output, PSInvocationSettings settings) at System.Management.Automation.PowerShell.Invoke[T](IEnumerable input, IList1 output, PSInvocationSettings settings) at System.Management.Automation.PowerShell.Invoke[T]() at Microsoft.Azure.Functions.PowerShellWorker.PowerShell.PowerShellExtensions.InvokeAndClearCommands[T](PowerShell pwsh) at Microsoft.Azure.Functions.PowerShellWorker.PowerShell.PowerShellManager.ExecuteUserCode(Boolean addPipelineOutput, IDictionary outputBindings) at Microsoft.Azure.Functions.PowerShellWorker.PowerShell.PowerShellManager.InvokeFunction(AzFunctionInfo functionInfo, Hashtable triggerMetadata, TraceContext traceContext, RetryContext retryContext, IList1 inputData, FunctionInvocationPerformanceStopwatch stopwatch, OpenTelemetryInvocationContext otelContext) at Microsoft.Azure.Functions.PowerShellWorker.RequestProcessor.InvokeFunction(AzFunctionInfo functionInfo, PowerShellManager psManager, FunctionInvocationPerformanceStopwatch stopwatch, InvocationRequest invocationRequest) at Microsoft.Azure.Functions.PowerShellWorker.RequestProcessor.ProcessInvocationRequestImpl(StreamingMessage request, AzFunctionInfo functionInfo, PowerShellManager psManager, FunctionInvocationPerformanceStopwatch stopwatch)`

[jantari]

So it has to be one of these two commands, could you run these separately in your/an Azure function environment and test which one - or maybe both - error? I can set up some tests myself eventually but having you test it will be much faster. Thanks.

# Test 1
(New-Object -TypeName 'System.Management.ManagementObjectSearcher' -ArgumentList "SELECT Version FROM Win32_OperatingSystem").Get()

# Test 2
[System.Management.ManagementObjectSearcher]::new('SELECT AddressWidth FROM Win32_Processor').Get()

[ubellavance]

So it has to be one of these two commands, could you run these separately in your/an Azure function environment and test which one - or maybe both - error? I can set up some tests myself eventually but having you test it will be much faster. Thanks.

Most likely both because the cheapest/free Azure functions run under Linux (https://learn.microsoft.com/en-us/azure/azure-functions/flex-consumption-plan). Would it be possible to have the script accept a CPU arch and Operating version as an argument, to be used with -All -NoTestApplicable -NoTestInstalled -NoTestSeverityOverride?

[ubellavance]

It could look something like this: Get-LSUpdate -Model 21K7 -All -NoTestApplicable -NoTestInstalled -NoTestSeverityOverride -CPUArch x64 -OSVersion Windows11

[jantari]

That feature already exists: Get-LSUpdate -MachineCharacteristicsOverride. You would use it as follows:

Get-LSUpdate -MachineCharacteristicsOverride @{'_OS' = '11'; '_WindowsBuildVersion' = '26100'; '_CPUAddressWidth' = 64}

This doesn't bypass the very first WMI query:

(New-Object -TypeName 'System.Management.ManagementObjectSearcher' -ArgumentList "SELECT Version FROM Win32_OperatingSystem").Get()

which is there to ensure folks don't run this module on Windows 7, 8 or 8.1. But I don't think that matters because this is run directly when importing the module, before Get-LSUpdate, and I too import and use the module on Linux when generating the documentation site ( https://github.com/jantari/LSUClient-docs/blob/745680eb5e8567c2c00b7c083d756d23afc5c61b/.github/workflows/gh-pages.yml#L31 ) and attempting to use these WMI classes under Linux is not a fatal/terminating error. It continues running.

[shahzadsaddique]

@jantari, I ran both commands in Azure Functions; both failed. Please find details below.

Source code:

        Write-Host "--- WMI Diagnostic (LSUClient author tests) ---"
        try {
            $null = (New-Object -TypeName 'System.Management.ManagementObjectSearcher' -ArgumentList "SELECT Version FROM Win32_OperatingSystem").Get()
            Write-Host "WMI Test 1 OK: (New-Object ManagementObjectSearcher 'SELECT Version FROM Win32_OperatingSystem').Get()"
        } catch {
            Write-Host "WMI Test 1 FAILED: $($_.Exception.Message)"
            Write-Host "WMI Test 1 Stack: $($_.ScriptStackTrace)"
        }
        try {
            $null = [System.Management.ManagementObjectSearcher]::new('SELECT AddressWidth FROM Win32_Processor').Get()
            Write-Host "WMI Test 2 OK: [ManagementObjectSearcher]::new('SELECT AddressWidth FROM Win32_Processor').Get()"
        } catch {
            Write-Host "WMI Test 2 FAILED: $($_.Exception.Message)"
            Write-Host "WMI Test 2 Stack: $($_.ScriptStackTrace)"
        }
        Write-Host "--- End WMI Diagnostic ---"



    Import-Module LSUClient -ErrorAction Stop
    $updates = Get-LSUpdate -Model $model -All -NoTestApplicable -NoTestInstalled -NoTestSeverityOverride -Verbose -Debug *>&1

Error Logs

 --- WMI Diagnostic (LSUClient author tests) ---
WMI Test 1 FAILED: Exception calling "Get" with "0" argument(s): "Access is denied. (0x80070005 (E_ACCESSDENIED))"
WMI Test 1 Stack: at <ScriptBlock>, C:\home\site\wwwroot\LenovoUpdatesWeekly\run.ps1: line 81
WMI Test 2 FAILED: Exception calling "Get" with "0" argument(s): "Access is denied. (0x80070005 (E_ACCESSDENIED))"
INFORMATION: WMI Test 2 Stack: at <ScriptBlock>, C:\home\site\wwwroot\LenovoUpdatesWeekly\run.ps1: line 88
INFORMATION: --- End WMI Diagnostic ---


Exception calling "Get" with "0" argument(s): "Access is denied. (0x80070005 (E_ACCESSDENIED))" WasThrownFromThrowStatement : False TargetSite : Void CheckActionPreference(System.Management.Automation.Language.FunctionContext, System.Exception) Message : The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: Exception calling "Get" with "0" argument(s): "Access is denied. (0x80070005 (E_ACCESSDENIED))" Data : {[System.Management.Automation.Interpreter.InterpretedFrameInfo, System.Management.Automation.Interpreter.InterpretedFrameInfo[]]} InnerException : HelpLink : Source : System.Management.Automation HResult : -2146233087 StackTrace : at System.Management.Automation.ExceptionHandlingOps.CheckActionPreference(FunctionContext funcContext, Exception exception) at System.Management.Automation.Interpreter.ActionCallInstruction`2.Run(InterpretedFrame frame) at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame) at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)

If needed, I can provide the full stack traces for both test cases.

[jantari]

I can remove the use of "WMI Test 1", and all further WMI calls should be bypassed with the correct parameters, e.g.:

Get-LSUpdate -All -NoTestApplicable -NoTestInstalled -NoTestSeverityOverride -MachineCharacteristicsOverride @{'_OS' = '11'; '_WindowsBuildVersion' = '26100'; '_CPUAddressWidth' = 64, ...}

I will let you know when I have a new version to test

[shahzadsaddique]

Hi @jantari, Thanks for looking into this. Looking forward to testing the newer version.

[shahzadsaddique]

Hi @jantari, did you get a chance to look into this issue?

[jantari]

Hello, sorry for the delay. Please try the latest commit on the develop branch.

You should still run Get-LSUpdate with -All -NoTestApplicable -NoTestInstalled -NoTestSeverityOverride to get the results you want ("catalog-only" without taking the local machine state into account).