Not able to execute *.bat files unless prefixed with cmd.exe /c

1

Hi, I’m running BigFix 11.0.4 on Windows. I have 9 Windows machines that can’t run .bat files referenced in ILMT Initiate Software Scan fixlet. The 2 places where .bat files are referenced are

waithidden cmd.exe "{parameter "homefolder" as string}\checkBZIP2Status.bat" "{parameter "bzip2folder" as string}" "{parameter "homefolder" as string}"
...
runhidden "{parameter "homefolder" as string}\runcit_sw.bat" > "{parameter "logfilepath" as string}" 2>&1

The action just goes Failed when it gets to these .bat file calls. I discovered that if I prefix the call with cmd /c

eg.

waithidden cmd.exe /c ""{parameter "homefolder" as string}\checkBZIP2Status.bat" "{parameter "bzip2folder" as string}" "{parameter "homefolder" as string}""
...
runhidden cmd.exe /c ""{parameter "homefolder" as string}\runcit_sw.bat" > "{parameter "logfilepath" as string}" 2>&1"

Then it runs successfully. I thought this was a .bat to cmd.exe association issue, but the following is reported for each association query

C:\Users\s5490264>assoc .bat
.bat=batfile

C:\Users\s5490264>assoc batfile
batfile=Windows Batch File

C:\Users\s5490264>ftype batfile
batfile="%1" %*

C:\Users\s5490264>ftype cmdfile
cmdfile="%1" %*

Not sure what else to check that might explain why the association is not working??

Thanks in advance for any suggestions/feedback.

Regards … Leslie

2

I'd try to retrieve the Client log from one of those machines where it's failing.
My first thought would have been that those 9 machines specifically have some broken PATH variable that doesn't put \windows\system32\cmd.exe before some other instance of cmd.exe, but just adding the '/c' parameter shouldn't fix that.

What OS are those 9 Windows machines? Do you have others of the same OS that are working with the fixlet?

3

The 9 Windows machines are a mix of Win2016, Win2019 and Win2022.

Yes I have many other Windows servers of the above types that are working fine.

Thanks

4

Ok I'd still check the client log, which will give more detail than the Console's action status. I'd especially want to see how that 'logfilepath' parameter resolved, and check the log file for any error messages.

5

The client log shows

At 00:00:51 -0500 - actionsite (http://wvdbsp00404.bns.bns:52311/cgi-bin/bfgather.exe/actionsite)
Command failed (Thread execution failed (2)) waithidden "C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT\checkBZIP2Status.bat" "C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT" "C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT" (action:1198192)
At 00:00:51 -0500 -
ActionLogMessage: (action:1198192) ending action

So the only additional info is

Thread execution failed (2)

which I believe is

C:\Users\s5490264>net helpmsg 2

The system cannot find the file specified.

as for

runhidden "{parameter "homefolder" as string}\runcit_sw.bat" > "{parameter "logfilepath" as string}" 2>&1

it never got a chance to run, as it stopped first on

Command failed (Thread execution failed (2)) waithidden "C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT\checkBZIP2Status.bat" "C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT" "C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT" (action:1198192)

If I fix just the first occurrence and not the 2nd, the result is

Command failed (Process creation failed) runhidden ""C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT\runcit_sw.bat" > "C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT\1612995438_citlog.log" 2>&1" (action:1200106)

C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT\1612995438_citlog.log

was never created. So looks like it never started to run runcit_sw.bat.

What’s interesting is that in the first case, there error is

Command failed (Thread execution failed (2))

and in the 2nd case its

Command failed (Process creation failed)

What’s the difference between waithidden and runhidden ?

6

Ok, good info.

The log differs slightly from what you had earlier - which is good, I was really confused.

Command failed (Thread execution failed (2)) waithidden "C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT\checkBZIP2Status.bat" "C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT" "C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT" (action:1198192)

In your first post you said this had a 'cmd.exe' at the front, so I thought the only difference was whether the /c parameter was included. I see how that's not the case. So this puts your File Association theory back into play - specifically whether it's possible the file association is broken but only for the Local system account

I'm typing on a phone now but I should be able to check for how to test this later today. It may give you something useful as well, to test the file association listings specifically as the LocalSystem account - either through a BigFix action or with psexec.

Another thing to check, besides the batch file association, is whether the batch file itself is actually being created successfully.

This is all default ILMT content, right ? I don't use ILMT much myself, but I can see some recommendations I can make to the team that works with that content as well .

7

C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT\checkBZIP2Status.bat

C:\Program Files (x86)\BigFix Enterprise\BES Client\LMT\CIT\runcit_sw.bat

both exist.

Yes, this is all default ILMT content.

Thanks

8

Try sending this ActionScript as a Custom Action to one of the computers that is failing - this should check whether the LocalSystem account has the same file associations in place for bat and cmd files:

delete __createfile
createfile until EOF_FILE_MARKER
ECHO ON
echo USERNAME: %USERNAME%
assoc .bat
assoc batfile
ftype batfile
ftype cmdfile
EOF_FILE_MARKER

delete get_associations.cmd
move __createfile get_associations.cmd

action uses wow64 redirection false

waithidden "{pathname of native system folder}\cmd.exe" /c "get_associations.cmd > c:\output.txt 2>&1"

After running it, check the c:\output.txt file and see whether any of the associations are missing...

9

This is what in the output.txt file

=============

C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData\actionsite>ECHO ON

C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData\actionsite>echo USERNAME: WVAPPI04971$
USERNAME: WVAPPI04971$

C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData\actionsite>assoc .bat
.bat=batfile

C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData\actionsite>assoc batfile
batfile=Windows Batch File

C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData\actionsite>ftype batfile
batfile="%1" %*

C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData\actionsite>ftype cmdfile
cmdfile="%1" %*

=============

Looks ok to me?

10

What I’m wondering though, where is the setting that says .bat files will be launched with cmd.exe ???

The above output looks correct (ie. just like it does on Windows machines that don’t have the problem).

11

I'm afraid you've got me. I don't know in what ways the association between cmd.exe and the .bat extension could get broken. I'm afraid you shouldn't wait on me for an answer on this one.

12

Thats fine. Thank you for your efforts Jason.

I will try opening an incident in my company see if they can help.