Azure local SBE update permission issues

Question

Azure local SBE update permission issues

MB 90

When running the latest SBE on one of our clusters we're getting an error on one of the nodes "Type 'SBECopyLocalPerNode' of Role 'SBE' raised an exception". Seems like the SBE folder on one of the nodes the permissions are messed up and the files are not accessible. Would be good if the update process would at least identify the node, but managed to find the culprit. rebooting it didn't help. This update is supposed to happen automatically via CAU when initiated. Screenshot 2026-07-26 at 7.53.05 PM

≈

Update task

Copy hardware update files to servers

Result

Error

Start time

7/26/2026, 4:42 PM

End time

7/26/2026, 5:26 PM

Description

Create local cache of SBE hardware update files on each server.

Error details

Type 'SBECopyLocalPerNode' of Role 'SBE' raised an exception:

The file 'C:\CloudContent\Microsoft_Reserved\Update\SBECache\5.0.2607.1002\Software\repository\EGS\QuickAssist\Crypto\Provider\x64\CPMProv.sys' cannot

be read: Access to the path 'C:

\CloudContent\Microsoft_Reserved\Update\SBECache\5.0.2607.1002\Software\repository\EGS\QuickAssist\Crypto\Provider\x64\CPMProv.sys' is denied.

at Get-FileHash<Process>, C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psm1: line 129

at Test-SBEContentIntegrityInternal, C:\NugetStore\Microsoft.AzureStack.Role.SBE.10.2607.1003.2041\content\Helpers\SBEMetadata-Internal.psm1: line 524

at SBECopyLocalPerNode, C:\NugetStore\Microsoft.AzureStack.Role.SBE.10.2607.1003.2041\content\Classes\SBE\SBE.psm1: line 628

at <ScriptBlock>,

C:\Agents\Microsoft.AzureStack.Solution.ECEAgent.Service.10.2607.0.1327\content\pkg\Microsoft.AzureStack.Solution.Deploy.EnterpriseCloudEngine.Agent.Host\InvokeInterfaceInternal.psm1: line 165

at Invoke-EceInterfaceInternal,

C:\Agents\Microsoft.AzureStack.Solution.ECEAgent.Service.10.2607.0.1327\content\pkg\Microsoft.AzureStack.Solution.Deploy.EnterpriseCloudEngine.Agent.Host\InvokeInterfaceInternal.psm1: line 160

at <ScriptBlock>, <No file>: line 48

0 comments

1 answer

Your answer

Answer 1

Welcome to Microsoft Q&A,

Hello @MB , I hope you are doing well.

Based on the error, the update is failing while the SBECopyLocalPerNode step is creating the local SBE cache. The immediate cause is a file-system permissions issue on the affected node:

Access to the path ...\SBECache\...\CPMProv.sys is denied.

Since the failure occurs during Get-FileHash / Test-SBEContentIntegrityInternal, the update process cannot read the file to validate the local SBE content.

I recommend:

Confirm the affected node and verify whether the file is accessible locally.
Check the NTFS permissions and ownership of the C:\CloudContent\Microsoft_Reserved\Update\SBECache directory and the affected file.
Compare the permissions with the same path on a healthy node.
Check whether security software or endpoint protection is blocking access to CPMProv.sys.
Review the SBE/CAU logs around the failure time for additional details.

Because this is a Microsoft Reserved update path and the SBE update is normally orchestrated automatically through CAU, I would avoid manually changing permissions or deleting the cache until you have confirmed the expected permissions for the SBE update process. An incorrect ACL change could potentially affect subsequent updates.

The key point is that the failure appears to be node-specific local file access, rather than a general SBE package or CAU failure. The fact that rebooting did not resolve it further supports investigating the file ACL/ownership and any security software that may be denying access.

If my answer helped you, please consider marking it as accepted. This helps others in the community find similar solutions.