• Updates to this article
• November 2025
• Intro
• How to perform the workaround

Tags: Type ‘EvalCauRetryApplicability’ of Role ‘CAU’ raised an exception: CAU Run failed

Updates to this article

November 2025

---

Microsoft has published a fix if Defender is blocking installation. Follow this simple guide to work around it. I have tested this fix and can confirm that is has resolved multiple instances of the CAU error:
https://github.com/Azure/AzureLocal-Supportability/blob/main/TSG/Update/Solution-Update-CAU-Run-fails-due-to-Windows-Defender-blocking-WMI-commands.md

Intro

I have seen this issue many times lately and I wanted to share a workaround I got from Microsoft doing a support ticket.

The issue is regarding issues with the CAU (Cluster-Aware updating) part of the solution update. The package that is executed doing CAU run works and installs, but for some reason the return codes are now alligned with what the solution update expects and the entire CAU run then fails.

PLEASE USE AT YOUR OWN RISK 🙂

How to perform the workaround

# Get the lasted failed runtime of the solution update
Get-SolutionUpdate | Get-SolutionUpdateRun | sort TimeStarted
# get the GUID from the lastet failed runtime and insert in command below before executing
$xml = Get-ActionPlanInstance -ActionPlanInstanceId 
$xml.ProgressAsXml > C:\update.xml

Now go to the event log of the first node in the stack. Go to this path:
Event Viewer > Applications and Services Logs > Microsoft > Windows > ClusterAwareUpdating > Admin
examine what script is failing to complete. Now drain the node and run that script. I prefer to open the script and locate the .msi package that the script should install. The .msi file will be located on the cluster storage (e.g.: \localhost\C$\ClusterStorage\Infrastructure_1\Shares\SU1_Infrastructure_1\CloudMedia\Platform)
Reboot each node (while the nodes are drained, one at the time) after installing the failed patches.

Open the file C:\update.xml
Search for EvalCauRetryApplicability
Find the line where status is = failed
Change this to status = skipped

This will instruct the action plan to skip this step since it is already been installed.

Now run the following command to start a new runtime of the solution update, where it will use the modified .xml file to start from:

Invoke-ActionPlanInstance -ActionPLanPath C:\update.xml

You get a GUID in the PowerShell console. Take note of that GUID and use in the next command. This next command will start a monitoring task in the PowerShell console, so you are able to follow the update in near real-time:

Start-MonitoringActionplanInstanceToComplete -actionPlanInstanceID 

Hopefully the installation of the solution update will move beyond and complete. I can only state that it worked for the stacks I have been seeing this issue on.