Updating DeviceLock Service via SMS fails returning the 'Access is denied (5)' error.
The issue indicates that a list of DeviceLock Administrators has been configured on DeviceLock-controlled computer. By default, SMS installation is performed on behalf of the 'SYSTEM' account, that does not have enough privileges to access DeviceLock Service when DeviceLock Administrators functionality is enabled.
1. Disable DeviceLock Administrators functionality (i.e., check the "Enable Default Security" flags) when connected to client computer(s) before running the upgrade process
2. Run the installation under a user account belonging to the list of DeviceLock Administrators. This can be changed in the "Roles" options of the SMS.