I need to get the SCCM updates as described in this post.
But when running the Service Connection Tool in an Offline environment I got the following:
ERROR: Access is denied. Please run the tool locally as local administrator.

I tripled checked that I had access to the database and local administrator on the server. Until it dawned on me the next day.
You run the Service Connection Tool executable from the SCCM 1702 install media. My media happened to be an ISO which I mounted on the server (G:\).
I unzipped the ISO, and ran the command in the unzipped location. And it produced me the CAB file that I was after so I can get the SCCM updates from Microsoft.