Executing a powershell script failure through BigFix

Content Authoring
1

I am have an issue executing a ps1 script on our 2012 endpoints. The script (written by BigFix actionscript) runs on the local machine without issue. I have pulled out all the stops I know of, including wow64 redirect (thinking 64 bit Powershell was required) and push-location thinking it was the system working directory. Here is the BigFix action:

action uses wow64 redirection true
delete __appendfile
dos del /q /f C:\Windows\Temp\script.ps1
appendfile push-location -path "C:\Windows\Temp"
appendfile $Server = hostname
appendfile $Target = New-WBBackupTarget -Volume (Get-Wbvolume -allvolumes | Where-Object {{$_.Volumelabel -eq "Backup"})
appendfile $VirtualMachines = Get-WBVirtualMachine
appendfile $DailyVMWB = New-WBPolicy
appendfile $schedule = [datetime]"02:30:00"
appendfile Set-WBPerformanceConfiguration -OverallPerformanceSetting AlwaysIncremental
appendfile Set-WBSchedule -Policy $DailyVMWB -Schedule $schedule
appendfile Add-WBBackupTarget -Policy $DailyVMWB -Target $Target -Force
appendfile Add-WBVirtualMachine -Policy $DailyVMWB -VirtualMachine $VirtualMachines
appendfile Set-WBVssBackupOptions -Policy $DailyVMWB -VssFullBackup
appendfile Set-WBPolicy -Policy $DailyVMWB -AllowDeleteOldBackups -Force
appendfile Start-WBBackup -Policy $DailyVMWB -AllowDeleteOldBackups -Force
copy __appendfile "C:\Windows\Temp\script.ps1"
waithidden {pathname of file ((it as string) of value "Path" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" of native registry)} -ExecutionPolicy Bypass -File "C:\Windows\Temp\script.ps1"
dos del /q /f C:\Windows\Temp\script.ps1

If I stop the delete, I can execute the script at C:\Windows\Temp\script.ps1 using cmd with C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File “C:\Windows\Temp\script.ps1”

or execute it directly from x64 Powershell. x32 Powershell results in missing cmdlet errors.

The action in BigFix, of course reads successful because I have not defined success relevance yet, but all commands execute without issue.

I will try executing as system on the local machine with psexec, but does anything standout?

2

Ran "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File “C:\Windows\Temp\script.ps1"” on the local machines cmd prompt as System via psexec, executed without issue.

3

This will cause the agent to run the action in an x32 Powershell Prompt which, as you’ve said, results in missing cmdlet errors.

I’d recommend changing that to false so that you launch the script in an x64 Powershell Prompt.

Also, if you are using Powershell 5 you can use transcript logging to get the full output from PowerShell:

4

Did you use the -s option on PSEXEC? That will use the local system account (which mimics where the client will run an action)

https://technet.microsoft.com/en-us/sysinternals/pxexec.aspx

5

Yes, I used the switches for PSEXEC. The changing redirect to false worked. Apparently I was confused with the redirect syntax/meaning. Thanks for the help!