Server-Update (W2008R2) ran without problems.
Win8-Machine ran fine.

All Win7-Machines (x86 and x64) did this in system-update.log:

DEBUG;;;creating path: C:\Program Files (x86)\Novell\ZENworks\cache\zmd\ZenCache\f4ff2b46-6bfc-415c-b0ba-69238029549f\setup.exe
DEBUG;;;An error occured during command execution...details should have already been logged

Excerpt from setup.exe.log:

MSI (s) (28:A8) [21:04:08:423]: Note: 1: 1729
MSI (s) (28:A8) [21:04:08:423]: Transforming table Error.
MSI (s) (28:A8) [21:04:08:438]: Transforming table Error.
MSI (s) (28:A8) [21:04:08:438]: Produkt: Novell ZENworks Endpoint Security Agent -- Konfiguration fehlgeschlagen.
MSI (s) (28:A8) [21:04:08:438]: Das Produkt wurde durch Windows Installer neu konfiguriert. Produktname: Novell ZENworks Endpoint Security Agent. Produktversion: Produktsprache: 1031. Hersteller: Novell. Erfolg- bzw. Fehlerstatus der neuen Konfiguration: 1603.
MSI (s) (28:A8) [21:04:08:438]: Attempting to delete file C:\Windows\Installer\1154d.mst
MSI (s) (28:A8) [21:04:08:438]: Unable to delete the file. LastError = 32
MSI (s) (28:A8) [21:04:08:454]: Deferring clean up of packages/files, if any exist
MSI (s) (28:A8) [21:04:08:454]: Attempting to delete file C:\Windows\Installer\1154d.mst
MSI (s) (28:A8) [21:04:08:454]: MainEngineThread is returning 1603
MSI (s) (28:34) [21:04:08:454]: No System Restore sequence number for this installation.

Tried it with agent selfdefense enabled and disabled!

After installing this setup.exe (which is ZES what we have neither licensed nor activated) manually and reassigning the update all was fine (except for the "another instance of vnc is already running"-message).

How do we get this out without the manual part?