Exit Code -1073741502 After Task Deployment

Content Authoring
1

Hello Folks,

Anyone familiar with this exit code of -1073741502. I am seeing this exit code fire for a number of endpoints in my environment. My action script entails starting services, and making a few registry changes. The ActionScript completed successfully on most systems. However, there are a handful of systems where I get back this weird exit code. Any ideas?

2

@dj0321, need more information. What OS was targeted (i.e. Windows, Mac, *NIX)? What command was executed via Action Script that returned this exit code? Have you checked with the OS and software vendors about this specific exit code?

3

Sorry. I thought I added that. It’s Windows 10 targets. I am using the waithidden command followed by a command to change a setting in the registry. @cmcannady

4 
At 10:49:05 -0500 - actionsite 
   Command succeeded (Exit Code=-1073741502) waithidden cmd /c sc config "Tenable Nessus Agent" start=auto (action:3484441)
   Command started - waithidden cmd /C sc stop "Tenable Nessus Agent" (action:3484441)
At 10:49:06 -0500 - actionsite 
   Command succeeded (Exit Code=-1073741502) waithidden cmd /C sc stop "Tenable Nessus Agent" (action:3484441)
   Wow64 redirection disabled. action uses wow64 redirection false (action:3484441)
   Command succeeded delete No 'C:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\opsite370\__createfile' exists to delete, no failure reported (action:3484441)
   Command succeeded delete No 'C:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\opsite370\wizardedit.reg' exists to delete, no failure reported (action:3484441)
   Command succeeded createfile until  (action:3484441)
   Command succeeded move __createfile wizardedit.reg (action:3484441)
   Command started - waithidden regedit /s "wizardedit.reg" (action:3484441)
At 10:49:07 -0500 - actionsite 
   Command succeeded (Exit Code=-1073741502) waithidden regedit /s "wizardedit.reg" (action:3484441)
At 10:49:08 -0500 - actionsite 
   Command started - waithidden cmd /C sc start "Tenable Nessus Agent" (action:3484441)
   Command succeeded (Exit Code=-1073741502) waithidden cmd /C sc start "Tenable Nessus Agent" (action:3484441)
At 10:49:09 -0500 - actionsite 
   Command succeeded runhidden cmd /c "C:\Program Files\Tenable\Nessus Agent\nessuscli.exe" agent link --key=9b54f68175b888dd31e3e334a4d5ca0 --host=XXX  --port=8834
5

So it appears that one of the commands from the wizardedit.reg is causing this error. Can you confirm that this REG file executes as expected when run locally by a local Admin? Have you tried enabling BESClient Debug Logging at 10000 and rerunning this fixlet/task to collect additional debug details?

6

All of the ‘wait’ statements completed with a non-zero exit code, usually a failure…can you post the ActionScript you are using (and use the code tag - the "</>" symbol above the editor window) ?

I’d suggest putting this all in one batch file for logging, and can help you do that if you post the actionscript

1 Like
7

@dj0321, I agree with @JasonWalker. Either an inline BAT script via createfile until or pre-developed PowerShell downloaded via prefetch.

8 
runhidden cmd /c "C:\Program Files\Tenable\Nessus Agent\nessuscli.exe" agent unlink --force

waithidden cmd /c sc config "Tenable Nessus Agent" start=auto

waithidden cmd /C sc stop "Tenable Nessus Agent"


action uses wow64 redirection false

delete __createfile
delete wizardedit.reg

createfile until @end_create_reg_file
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Tenable]
"TAG"=-
@end_create_reg_file

move __createfile wizardedit.reg
waithidden regedit /s "wizardedit.reg"

waithidden cmd /C sc start "Tenable Nessus Agent"

runhidden cmd /c "C:\Program Files\Tenable\Nessus Agent\nessuscli.exe" agent link --key=24a3e7e9be518f9e5ab00e28262faa2c98febdf7d448ff --host=team --port=8834

@JasonWalker

9

Nothing obvious jumps out at me as to why the:

is returning a non-zero exit code. If you want to use the action script shown in your prior post, I’d recommend enabling BESClient Debug logging from the BES Support site at 10000 log level and then re-run this fixlet/task.

You can then review the besclientdebug.log under the BESClient path. This should provide us with additional details as to the failure source.

10

The Registry Wizard generated that for me and I took it and added it to my action script. It works fine on other machines, but then I have machines firing back this exit code. Makes no sense. I will enable the debug logging. If anyone has another way I should write my action, please let me know. @cmcannady @JasonWalker

11

Another option would be to ditch the Registry Wizard option and leverage the registry commands that are built into the Action Script language. So remove:

and instead utilize:

regset64 “[HKEY_LOCAL_MACHINE\SOFTWARE\Tenable]” “TAG”=“-”

12

Are we sure that it’s the registry command that’s making the whole action fail out with this exit code? @cmcannady

13

Without the besclientdebug.log to analyze, I don’t know for sure.

14 
Mon, 16 Nov 2020 17:47:12 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = cmd /c "C:\Program Files\Tenable\Nessus Agent\nessuscli.exe" agent unlink --force
Mon, 16 Nov 2020 17:47:12 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() exiting
Mon, 16 Nov 2020 17:47:12 -0500 DebugMessage Command succeeded runhidden cmd /c "C:\Program Files\Tenable\Nessus Agent\nessuscli.exe" agent unlink --force (action:3485126)
Mon, 16 Nov 2020 17:47:12 -0500 DebugMessage bumping active action line
Mon, 16 Nov 2020 17:47:12 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = cmd /c sc config "Tenable Nessus Agent" start=auto
Mon, 16 Nov 2020 17:47:12 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() exiting
Mon, 16 Nov 2020 17:47:12 -0500 DebugMessage Command started - waithidden cmd /c sc config "Tenable Nessus Agent" start=auto (action:3485126)
Mon, 16 Nov 2020 17:47:13 -0500 DebugMessage ReportManager - Attempting to post report
Mon, 16 Nov 2020 17:47:14 -0500 DebugMessage DoUploadFile: None authentication used.
Mon, 16 Nov 2020 17:47:14 -0500 DebugMessage Report posted successfully
Mon, 16 Nov 2020 17:47:14 -0500 DebugMessage ReportManager - report sent successfully.
Mon, 16 Nov 2020 17:47:14 -0500 DebugMessage GetExitCodeThread returned zero
Mon, 16 Nov 2020 17:47:14 -0500 DebugMessage checkpoint 1
Mon, 16 Nov 2020 17:47:14 -0500 DebugMessage Command succeeded (Exit Code=-1073741502) waithidden cmd /c sc config "Tenable Nessus Agent" start=auto (action:3485126)
Mon, 16 Nov 2020 17:47:14 -0500 DebugMessage bumping active action line
Mon, 16 Nov 2020 17:47:14 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = cmd /C sc stop "Tenable Nessus Agent"
Mon, 16 Nov 2020 17:47:14 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() exiting
Mon, 16 Nov 2020 17:47:14 -0500 DebugMessage Command started - waithidden cmd /C sc stop "Tenable Nessus Agent" (action:3485126)
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage GetExitCodeThread returned zero
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage checkpoint 1
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage Command succeeded (Exit Code=-1073741502) waithidden cmd /C sc stop "Tenable Nessus Agent" (action:3485126)
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage bumping active action line
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = false
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() exiting
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage Wow64 redirection disabled. action uses wow64 redirection false (action:3485126)
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage bumping active action line
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = __createfile
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() exiting
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage Command succeeded delete No 'C:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\opsite370\__createfile' exists to delete, no failure reported (action:3485126)
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage bumping active action line
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = wizardedit.reg
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() exiting
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage Command succeeded delete wizardedit.reg (action:3485126)
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage bumping active action line
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = Windows Registry Editor Version 5.00
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() exiting
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = 
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = [HKEY_LOCAL_MACHINE\SOFTWARE\Tenable]
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() exiting
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = "TAG"=-
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() exiting
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = 
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage Command succeeded createfile until  (action:3485126)
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage bumping active action line
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = __createfile wizardedit.reg
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() exiting
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage Command succeeded move __createfile wizardedit.reg (action:3485126)
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage bumping active action line
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = regedit /s "wizardedit.reg"
Mon, 16 Nov 2020 17:47:15 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() exiting
Mon, 16 Nov 2020 17:47:15 -0500 DebugMessage Command started - waithidden regedit /s "wizardedit.reg" (action:3485126)
Mon, 16 Nov 2020 17:47:16 -0500 DebugMessage GetExitCodeThread returned zero
Mon, 16 Nov 2020 17:47:16 -0500 DebugMessage checkpoint 1
Mon, 16 Nov 2020 17:47:16 -0500 DebugMessage Command succeeded (Exit Code=-1073741502) waithidden regedit /s "wizardedit.reg" (action:3485126)
Mon, 16 Nov 2020 17:47:17 -0500 DebugMessage bumping active action line
Mon, 16 Nov 2020 17:47:17 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = cmd /C sc start "Tenable Nessus Agent"
Mon, 16 Nov 2020 17:47:17 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() exiting
Mon, 16 Nov 2020 17:47:17 -0500 DebugMessage Command started - waithidden cmd /C sc start "Tenable Nessus Agent" (action:3485126)
Mon, 16 Nov 2020 17:47:17 -0500 DebugMessage GetExitCodeThread returned zero
Mon, 16 Nov 2020 17:47:17 -0500 DebugMessage checkpoint 1
Mon, 16 Nov 2020 17:47:17 -0500 DebugMessage Command succeeded (Exit Code=-1073741502) waithidden cmd /C sc start "Tenable Nessus Agent" (action:3485126)
Mon, 16 Nov 2020 17:47:18 -0500 DebugMessage bumping active action line
Mon, 16 Nov 2020 17:47:18 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() entering, input = cmd /c "C:\Program Files\Tenable\Nessus Agent\nessuscli.exe" agent link --key=9b54f68175b888dd31e3e3341e5da97ab1682d0 --host=test --port=8834 
Mon, 16 Nov 2020 17:47:18 -0500 VerboseMessage RelevanceSubstitution::SubstituteStrings() exiting
Mon, 16 Nov 2020 17:47:18 -0500 DebugMessage Command succeeded runhidden cmd /c "C:\Program Files\Tenable\Nessus Agent\nessuscli.exe" agent link --key=9b54f68175b888dd31e3e3341e5da97ab1682d0 --host=test --port=8834  (action:3485126)
Mon, 16 Nov 2020 17:47:18 -0500 DebugMessage bumping active action line
Mon, 16 Nov 2020 17:47:18 -0500 ActionDebugMessage (action 3485126 ) DoWork: Action completed.
Mon, 16 Nov 2020 17:47:18 -0500 DebugMessage ActionLogMessage: (action:3485126) ending action

@cmcannady

15

@dj0321, can you try updating your Action Script and try using:

regset64 “[HKEY_LOCAL_MACHINE\SOFTWARE\Tenable]” “TAG”=“-”

@AlanM, any idea why executing a regedit command as shown above would throw this specific exit code?

16

all of the waithidden commands terminated with non-zero codes though.
I think it could be something more deeply broken in Windows, like a bad PATH value or broken library, but running it all in one batch may be helpful to get some error messages. I’ll post back a recommended action to try when I get back to my computer in a few minutes.

1 Like
17

@cmcannady - I tried that command and still comes back with that exit code.

18

Understood. Let me know. @JasonWalker

19

Give this a try…

delete __createfile
createfile until END_OF_FILE_MARKER
"C:\Program Files\Tenable\Nessus Agent\nessuscli.exe" agent unlink --force

sc.exe config "Tenable Nessus Agent" start=auto

// I replace 'sc stop' with 'net stop' because 'net stop' waits for the service to actually stop, while 'sc stop' returns immediately

net stop "Tenable Nessus Agent"

reg.exe DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Tenable /v TAG /F

net start "Tenable Nessus Agent"

"C:\Program Files\Tenable\Nessus Agent\nessuscli.exe" agent link --key=24a3e7e9be518f9e5ab00e28262faa2c98febdf7d448ff --host=team --port=8834

END_OF_FILE_MARKER

delete reset-nessus.cmd
move __createfile reset-nessus.cmd

action uses wow64 redirection false
waithidden cmd.exe /c ""reset-nessus.cmd" > c:\reset-nessus.log 2>&1"

When this batch runs, it should create a c:\reset-nessus.log file containing both the command output and any error messages. You should be able to check that log and see if there were any error messages presented.

1 Like
20

Same exit code came back. I also do NOT see the log file. I guess all the commands errored out, hence why the file was not created. @JasonWalker