Command failed (Relevance substitution failed)

Content Authoring
1

Hi,

i am trying to run a Powershell script to run locally on BES clients, and i am failing in the “appendfile” stage, where the appendfile operation is “appendfile $NodeArr = @{}”.

the script i am trying to run is this:

//============================================================================
//PowerShell Script…
//
//1. Save old ExecutionPolicy value
parameter “PolicyExisted”=“{exists value “ExecutionPolicy” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell” of (if exists x64 registry then x64 registry else registry)}”
parameter “oldExecutionPolicy”=“{if (parameter “PolicyExisted” as boolean) then (value “ExecutionPolicy” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell” of (if exists x64 registry then x64 registry else registry) as string) else “”}”
//2. set to ExecutionPolicy=Unrestricted and Pull PowerShell exe from registry… if 64bit then pull PowerShell x64
if {x64 of operating system}
regset64 “[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]” “ExecutionPolicy”=“Unrestricted”
parameter “PowerShellexe”=“{value “Path” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell” of x64 registry}”
else
//we need to determine what the current execution policy is so we can put it back when we’re done.
regset “[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]” “ExecutionPolicy”=“Unrestricted”
parameter “PowerShellexe”=“{value “Path” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell” of registry}”
endif
//3. Create PowerShell script and save to a ps1 file
delete __appendfile
delete DesktopFileCount.ps1
//PS script goes here

appendfile function New-UserDesktop()
appendfile {
appendfile param ()
appendfile
appendfile $NodeArr = @{}
appendfile $DES = new-object PSObject
appendfile
appendfile $des | add-member -type NoteProperty -Name UserName -Value “”
appendfile $des | add-member -type NoteProperty -Name FileCount -Value “”
appendfile
appendfile return $des
appendfile }
appendfile
appendfile $path = “$env:HOMEDRIVE\users”
appendfile
appendfile $dirs = Get-ChildItem -Path $path -Exclude “administrator”,“public”,“syszim”,“~” | ? {$.Mode.IndexOf(“d”) -ne -1}
appendfile
appendfile $DESArr = @()
appendfile
appendfile foreach ($dir in $dirs)
appendfile {
appendfile $des = New-UserDesktop
appendfile $des.UserName = $dir.Name
appendfile $desktop_files = Get-ChildItem -Path “$dir\desktop” -Exclude “*.lnk” -Recurse | ? {$.Mode.IndexOf(“d”) -eq -1}
appendfile $des.FileCount = $desktop_files.count
appendfile
appendfile $DESArr += $des
appendfile
appendfile }
appendfile
appendfile $result = [string]@()
appendfile foreach ($des in $DESArr)
appendfile {
appendfile [string]$res = $des.UserName + " " + $des.FileCount; $result += $res
appendfile }
appendfile
appendfile $result | Out-File $path\desktop_file_count.txt

//PS script end
move __appendfile DesktopFileCount.ps1
//4. Execute PowerShell with ps1 script file
action uses wow64 redirection false
waithidden “{parameter “PowerShellexe”}” -file “{pathname of client folder of current site}\DesktopFileCount.ps1”
action uses wow64 redirection {x64 of operating system}
//5. Restore ExecutionPolicy back
if {x64 of operating system}
if {parameter “PolicyExisted” as boolean}
regset64 “[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]” “ExecutionPolicy”=“{parameter “oldExecutionPolicy”}”
else
regdelete64 “[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]” “ExecutionPolicy”
endif
else
if {parameter “PolicyExisted” as boolean}
regset “[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]” “ExecutionPolicy”=“{parameter “oldExecutionPolicy”}”
else
regdelete “[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]” “ExecutionPolicy”
endif
endif
//============================================================================

and the error i get (from the client log) is this:

At 22:42:59 +0800 - actionsite (http://:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded regset “[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]” “ExecutionPolicy”=“Unrestricted” (action:112494)
Command succeeded parameter “PowerShellexe”=“C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” (action:112494)
Command succeeded delete No ‘C:\Program Files\BigFix Enterprise\BES Client__BESData\actionsite__appendfile’ exists to delete, no failure reported (action:112494)
Command succeeded delete No ‘C:\Program Files\BigFix Enterprise\BES Client__BESData\actionsite\DesktopFileCount.ps1’ exists to delete, no failure reported (action:112494)
Command succeeded appendfile function New-UserDesktop() (action:112494)
Command succeeded (file created) appendfile function New-UserDesktop() (action:112494)
Command succeeded appendfile function New-UserDesktop() (action:112494)
Command succeeded appendfile { (action:112494)
Command succeeded appendfile param () (action:112494)
Command succeeded appendfile (action:112494)
Command failed (Relevance substitution failed) appendfile $NodeArr = @{} (action:112494)
At 22:42:59 +0800 -
ActionLogMessage: (action:112494) ending action

any idea how i can get this script working?

Thanks, Shlomi

2

First of all, you don’t need to use powershell to do this. You can gather this information using relevance directly. It would only work well in an analysis or a task since it could be slow depending on the number of files, but it would work.

Secondly, there is no need to record the oldExecutionPolicy, change the ExecutionPolicy, and then Set it back again. This is a bad idea and prone to issues, plus all you have to do is call powershell using:

 -ExecutionPolicy Bypass

This will allow the Powershell to execute without changing the current ExecutionPolicy.

The answer to the question you are asking is that the brackets { } tell actionscript to do relevance substitution. If you don’t want relevance substitution, like in this case, then you must escape the brackets.

To escape the brackets, do the following:

{{}

or:

{}}

One or both of the above methods should work.

See these related posts:

1 Like