Running VBS Script works manually but not via Fixlet

Hello! We are trying to run a vbs script that disconnects all .PST files from users on a machine, with no luck.

prefetch be4841106a17f426ea733ea220eed26692f085e1 sha1:be4841106a17f426ea733ea220eed26692f085e1 size:303 http://bigfixserver:52311/Uploads/be4841106a17f426ea733ea220eed26692f085e1/RemovePST.vbs.tmp sha256:9a82905b058d9a28ed103f8c601c04e18996c6b9696f9322a650e5ff1f8a7110
extract be4841106a17f426ea733ea220eed26692f085e1
delete C:\RemovePST.vbs
copy __Download\RemovePST.vbs C:\RemovePST.vbs
waithidden cmd /c cscript C:\RemovePST.vbs
delete C:\RemovePST.vbs

If, however, we run the script manually by double clicking on it, it works just fine (removes linked PST from outlook). We tried it with wow64 redirection but also no luck. Seems like a rights issue? Not sure if anyone else has run into this.

These are the contents of the VBS for reference:

On Error Resume Next
Dim objOutlook 'As Outlook.Application
Dim Stores 'As Outlook.Stores
Dim objFolder 'As Outlook.Folder
Dim i 'As Integer

Set objOutlook = CreateObject(“Outlook.Application”)
Set Stores = objOutlook.Session.Stores

For i = Stores.Count to 0 step -1

If Stores(i).ExchangeStoreType = 3 Then
Set objFolder = Stores(i).GetRootFolder
objOutlook.Session.RemoveStore objFolder
Else
End If

Next

Thank you!

I would try just using create file to create the file and run it:

// Disable wow64 redirection on x64 OSes
action uses wow64 redirection {not x64 of operating system}

delete __createfile

// CREATEFILE
createfile until END_OF_FILE
On Error Resume Next
Dim objOutlook 'As Outlook.Application
Dim Stores 'As Outlook.Stores
Dim objFolder 'As Outlook.Folder
Dim i 'As Integer

Set objOutlook = CreateObject(“Outlook.Application”)
Set Stores = objOutlook.Session.Stores

For i = Stores.Count to 0 step -1

If Stores(i).ExchangeStoreType = 3 Then
Set objFolder = Stores(i).GetRootFolder
objOutlook.Session.RemoveStore objFolder
Else
End If
END_OF_FILE

delete RemovePST.vbs
move __createfile RemovePST.vbs

waithidden “C:\Windows\System32\cscript.exe” RemovePST.vbs
delete RemovePST.vbs

1 Like

Additionally, we’ve tried running it as the current user but also to avail.

@cjwolford thanks for the input. I’ve tried it by referencing the full path but again it doesn’t work.

I can tell that it finds and executes the script just fine using cmd /k.

wait cmd /k C:\Windows\System32\cscript.exe __Download\RemovePST.vbs

Also tried the new script (via Fixlet Debugger) - didn’t work. I should add that I tried an equivalent powershell script but it too didn’t work, which further leads me to believe it’s some kind of access issue.

// Disable wow64 redirection on x64 OSes
action uses wow64 redirection {not x64 of operating system}

delete __createfile

// CREATEFILE
createfile until END_OF_FILE
$Outlook = New-Object -ComObject Outlook.Application
$Namespace = $Outlook.getNamespace(“MAPI”)

$all_psts = $Namespace.Stores | Where-Object {{($.ExchangeStoreType -eq ‘3’) -and ($.FilePath -like ‘*.pst’) -and ($_.IsDataFileStore -eq $true)}

ForEach ($pst in $all_psts){{
$Outlook.Session.RemoveStore($pst.GetRootFolder())
}
END_OF_FILE

// create temp folder if it doesn’t exist
if {not exists folder “c:\temp”}
folder create "c:\temp"
endif

delete "c:\temp\RemovePST.ps1"
move __createfile “c:\temp\RemovePST.ps1”

override wait
completion=job
hidden=true
runas=currentuser
wait { pathname of file ((it as string) of value “Path” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell” of native registry) } -ExecutionPolicy Bypass -File "c:\temp\RemovePST.ps1"
delete “c:\temp\RemovePST.ps1”

// remove temp folder if it is empty
if {exists folder “c:\temp” whose (not exists files of it and not exists folders of it)}
folder delete "c:\temp"
endif

Unfortunately it still doesn’t work. It runs like the the others but the PSTs do not get unlinked/disconnected. Have you tried it on your own (with your own PSTs) by any chance? This is very weird…

Yes, on a test VDI I have a PST Mounted, and after running that action script it is unmounted.

withpst

Here’s the logs of the action. I’m using Outlook 2016.

At 15:22:15 -0500 - mailboxsite (http://bigfixserver:52311/cgi-bin/bfgather.exe/mailboxsite11329668)
Relevant - Unmount PST Files from Outlook (fixlet:96461)
At 15:22:16 -0500 -
ActionLogMessage: (action:96461) Action signature verified for Execution
ActionLogMessage: (action:96461) starting action
At 15:22:16 -0500 - actionsite (http://bigfixserver:52311/cgi-bin/bfgather.exe/actionsite)
Wow64 redirection disabled. action uses wow64 redirection {not x64 of operating system} (action:96461)
Command succeeded delete No ‘C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData\CustomSite_Administrative_Resources__createfile’ exists to delete, no failure reported (action:96461)
Command succeeded createfile until (action:96461)
Command succeeded folder create “c:\temp” (action:96461)
Command succeeded delete No ‘c:\temp\RemovePST.ps1’ exists to delete, no failure reported (action:96461)
Command succeeded move __createfile “c:\temp\RemovePST.ps1” (action:96461)
Command succeeded override wait (action:96461)
Command succeeded override completion=job (action:96461)
Command succeeded override hidden=true (action:96461)
Command succeeded override runas=currentuser (action:96461)
Command started - wait C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File “c:\temp\RemovePST.ps1” (action:96461)
At 15:22:21 -0500 -
Report posted successfully
At 15:22:21 -0500 - actionsite (http://bigfixserver:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (Exit Code=0) wait C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File “c:\temp\RemovePST.ps1” (action:96461)
At 15:22:22 -0500 - actionsite (http://bigfixserver:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded delete “c:\temp\RemovePST.ps1” (action:96461)
Command succeeded folder delete “c:\temp” (action:96461)
At 15:22:22 -0500 -
ActionLogMessage: (action:96461) ending action

withoutpst

I also got it to work using the vbscript and it unmounted the PST.

At 16:15:40 -0500 -
ActionLogMessage: (action:96505) Action signature verified for Execution
ActionLogMessage: (action:96505) starting action
At 16:15:41 -0500 - actionsite (http://bigfixserver:52311/cgi-bin/bfgather.exe/actionsite)
Wow64 redirection disabled. action uses wow64 redirection {not x64 of operating system} (action:96505)
Command succeeded delete No ‘C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData\actionsite__createfile’ exists to delete, no failure reported (action:96505)
Command succeeded createfile until (action:96505)
Command succeeded folder create “c:\temp” (action:96505)
Command succeeded delete No ‘c:\temp\RemovePST.vbs’ exists to delete, no failure reported (action:96505)
Command succeeded move __createfile “c:\temp\RemovePST.vbs” (action:96505)
Command succeeded override wait (action:96505)
Command succeeded override completion=job (action:96505)
Command succeeded override hidden=true (action:96505)
Command succeeded override runas=currentuser (action:96505)
Command started - wait “C:\WINDOWS\system32\cscript.exe” “c:\temp\RemovePST.vbs” (action:96505)
At 16:15:45 -0500 -
Report posted successfully
At 16:15:45 -0500 - actionsite (http://bigfixserver:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (Exit Code=0) wait “C:\WINDOWS\system32\cscript.exe” “c:\temp\RemovePST.vbs” (action:96505)
At 16:15:46 -0500 - actionsite (http://bigfixserver:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded delete “c:\temp\RemovePST.vbs” (action:96505)
Command succeeded folder delete “c:\temp” (action:96505)
At 16:15:46 -0500 -
ActionLogMessage: (action:96505) ending action

Could you try it with the current user as a local admin? or verify UAC settings maybe?

I can’t believe how many rabbit holes I went down working with this, but it was fun.

So far it seems to work on the 2 machines I tested it on, Outlook 2013 and Outlook 2016, Admin and Non-Admin user.

I noticed that even though it unmounted the PST file it was still locked by outlook, so I added a step to close outlook as well.

Getting the relevance for if a PST file was mounted was also a fun task, it’s really messy but seems to work.

I put it on bigfix.me if you want to take a look:
https://bigfix.me/fixlet/details/26642

3 Likes

@cjwolford thanks very much - what I was missing was this:

waithidden “{pathname of system folder & “\icacls.exe”}” “c:\temp\RemovePST.ps1” /grant Everyone:F

It was a rights issue as I suspected, I just didn’t realize the agent wouldn’t be able to access it since it created the file itself. Only tested it once and it works but I’ll confirm. Thanks again!

I wish I could take credit for it, but the solution really came from this thread:

I don’t do a lot with runas=currentuser so it was a fun adventure figuring it out.

1 Like

I have followed all the steps that apply to my vbscript and I’m still not having any success with running my vbscript as a custom task.

@cjwolford I definitely followed your steps and running it manually makes the changes to the .txt file but when I incorporate bigfix via the fixlet debugger the result is Evaluation Failed - The system cannot find the file specified.

delete _createfile

//CREATEFILE
createfile until END_OF_FILE

'Instantiate shell object
set objshell = Wscript.CreateObject(“Wscript.Shell”)

'Instantiate file system object
Set objFSO = CreateObject(“Scripting.FileSystemObject”)

Set objFSO = CreateObject(“Scripting.FileSystemObject”)
Set objFile = objFSO.OpenTextFile(“C:\ProgramData\Avid\MediaCentralUX\config.txt”, ForReading)

strText = objFile.ReadAll
objFile.Close
strNewText = Replace(strText, “This not the End”, “Hello Friends”)

Set objFile = objFSO.OpenTextFile(“C:\ProgramData\Avid\MediaCentralUX\config.txt”, ForWriting)
objFile.WriteLine strNewText
objFile.Close
END_OF_FILE

delete TEST.vbs
move _createfile TEST.vbs

waithidden “C:\Windows\System32\cscript.exe” TEST.vbs
delete Test.vbs

Thanks for any assistance.

__createfile and not _createfile

hmmmm?
STATUS: Running action…
Command succeeded delete No ‘C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData__FixletDebugger_createfile’ exists to delete, no failure reported
Command succeeded createfile until
Command succeeded delete No ‘C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData__FixletDebugger\TEST.vbs’ exists to delete, no failure reported
Command failed (Move of ‘C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData__FixletDebugger_createfile’ to ‘C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData__FixletDebugger\TEST.vbs’ failed (2 - File error “class FileNotFoundError” on “C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData__FixletDebugger_createfile” : “Windows Error 0x2%: The system cannot find the file specified.”)) move _createfile TEST.vbs

— Result —
Evaluation failed!

When I go to the location listed the vbscript is there _createfile but it will not execute? I’m rather new to vbscripts and bigfix so my apologies.

The filename is ‘"__createfile"’, with two underscore characters. You need to include both underscores in your ‘move’ statement.

thank you so much @JasonWalker, the action now completes in the fixlet debugger but using:

delete __createfile

//CREATEFILE
createfile until END_OF_FILE

'Instantiate shell object
set objshell = Wscript.CreateObject(“Wscript.Shell”)

'Instantiate file system object
Set objFSO = CreateObject(“Scripting.FileSystemObject”)

Set objFSO = CreateObject(“Scripting.FileSystemObject”)
Set objFile = objFSO.OpenTextFile(“C:\ProgramData\Avid\MediaCentralUX\config.txt”, ForReading)

strText = objFile.ReadAll
objFile.Close
strNewText = Replace(strText, “”, “”)

Set objFile = objFSO.OpenTextFile(“C:\ProgramData\Avid\MediaCentralUX\config.txt”, ForWriting)
objFile.WriteLine strNewText
objFile.Close
END_OF_FILE

delete TEST.vbs

move __createfile TEST.vbs

waithidden cscript.exe TEST.vbs
delete TEST.vbs

doesn’t make the listed changes within the vbscript, again I appreciate all help.

Check that you aren’t using any "smart quotes" in the VBScript. They are appearing as “smart quotes” as you’ve posted them here, but I’m not sure whether that’s the forum reformatting your quotes, or if they are that way in your actual actionscript.

No smart quotes but the text inside the file still isn’t being replaced? Bigfix doesn’t like something? Again any assistance is greatly appreciated.

This is a case where you really need to test your VBScript before trying to deploy it with BigFix. The problem here isn’t BigFix or your action script, it’s that your VBScript does not work.

You haven’t defined the constants ForReading or ForWriting that your script is using with the OpenTextFile methods.

Either define the constants ForReading and ForWriting, or replace those with the literal integer values. There’s a reference at https://www.devguru.com/content/Technologies/vbscript/filesystemobject-opentextfile.html that you may check.

1 Like

Thanks All for the help… That was the trick…:slight_smile: