In order to really help troubleshoot, we need the exact actionscript you try each time. Ideally also the client log output for that actionscript as well.
Also, you would really need to run PSExec to run CMD as SYSTEM, then run the command
cmd.exe /c ""reset-nessus.cmd" > c:\reset-nessus.log 2>&1" within it to emulate what bigfix is doing. I know you said you used PSExec, but you have to use it that way specifically to fully emulate what you are doing. (just in general, get the command working in CMD, then try it again using
CMD /C "_THE_COMMAND_")
I have edited posts above to put things into code blocks so that forum software doesn’t mess with the formatting.
I just tested this on a machine of mine, and this doesn’t seem to work. SC doesn’t seem to take the friendly name of the service like this on my windows system. Are you sure your commands work when you try them manually?
C:\Windows\Temp>cmd /c "sc query "BES Client""
[SC] EnumQueryServicesStatus:OpenService FAILED 1060:
The specified service does not exist as an installed service.
C:\Windows\Temp>cmd /c "sc query "BESClient""
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
I got a similar result when using the
sc config option.
You might also need the following at the very top of the action:
action uses wow64 redirection false
ALSO it is very important to note that Exit codes don’t come from BigFix itself, it comes from whatever command you run with BigFix and BigFix just passes the error codes onto you as a helpful diagnostic and troubleshooting step.
I would strongly recommend getting just 1 thing to work at a time through bigfix action on a test machine. Like just this and only this:
sc.exe config "Tenable Nessus Agent" start=auto before moving onto the next thing.
It would also be helpful to know what specific versions of windows you are doing this on, so that we can better match what you are trying to do.
I’m pretty sure this should be
waithidden and not
runhidden, but also, I think it needs wrapped in quotes.
These are related: