Vssadmin resize remotely with Bigfix

Content Authoring
1

Hello everyone,

I try to set up the shadowstorage on some computers remotely using the Big-fix fixlet but I dont find any solution to make it work.

The commands are the following:
vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10%
vssadmin resize shadowstorage /for=D: /on=D: /maxsize=10%

I’ve tried with cmd.exe / PowerShell.exe or with appendfiles… no result.

Did some one have a solution ? :smiley:

2

Hi there, what’s happening is that actionscript uses percent encoding to escape special characters, so your percent sign is getting “eaten”. :slight_smile:

Try this in a task/fixlet (not the QnA Fixlet Debugger) and it should work. Note how I replace the percent sign with %25. In the link I provided, you will want to look at the symbol column, then the hex column.

waithidden vssadmin resize shadowstorage /for=C: /on=C: /maxsize={"10" & "%25"}
waithidden vssadmin resize shadowstorage /for=D: /on=D: /maxsize={"10" & "%25"}
3

Hello Sean,

This is not working in my test. I’ve tested this in 2 computers.
One time like you:
waithidden vssadmin resize shadowstorage /for=C: /on=C: /maxsize={“10” & “%25”}
And on other time like this
waithidden CMD.EXE /C vssadmin resize shadowstorage /for=C: /on=C: /maxsize={“10” & “%25”}
Earlyer I’ve tried waithidden CMD.EXE /C vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10%%
and when I see the command on the client the % was there but no result too

I think there is a right problem or Something, because when I launch a CMD as administrator and i put this 2 commands in, it’s working perfectly, but remotely with bigfix, no result.

Is it a way to use a user like “Network Service” or Something like this ?

4

Sorry to hear that. I did verify this on one of my lab devices by checking System Restore settings before and after the test, so I do know the actionscript code is correct.

As far as it being a rights issue, BigFix jobs run under the System account by default. So this should be sufficient to make these calls to vssadmin.

If you want to test if this is the issue, you need to open a command prompt as the System user on the device then run the vssadmin commands. If it fails, then yes the System user for some reason can’t run vssadmin on your box. If it succeeds, the System user is not the issue. Please test this out.

You do have some options for running as a different user if you need to. There is the override function where you can specify the user, but I think you may have to be running the latest version of the BigFix client.

You can also use something like psexec, but that definitely can introduce more complexity so I wouldn’t recommend it unless we verify the System account is really not able to execute vssadmin commands.

5

I was running a CMD.exe with the system account, I’ve tested this with psexec -i -s cmd.exe.
I’ve verified the user with typing “whoami” in the console, result : nt authority\system
I then run the vssadmin resize command, all worked perfectly localy.
So the problem must be Somewhere else.
I’ve tested with psexec and it’s working remotely, but in Big fix I have a lot of Baseline and I wanted to insert this fixlet to modify those shadowstorage.

I will do some research tomorrow to see if I forgot Something to test.

Thanks for reply :wink:

6

testing:

wait cmd.exe /C ping 1.1.1.1 > c:\pingtest.txt
wait cmd.exe /C vssadmin list shadowstorage >c:\shadowtest1.txt
wait cmd.exe /C vssadmin resize shadowstorage /for=c: /on=c: /maxsize=10% >c:\shadowtest2.txt

Note - the % character should be fine in raw ActionScript without hex encoding. In a relevance string you would need the hex substitution of %25.

Pingtest worked just fine.

Found this message in c:\shadowtest1.txt and c:\shadowtest2.txt:

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Error: A Volume Shadow Copy Service component encountered an unexpected error.
Check the Application event log for more information.

Application Log shows 2 errors for each - most informative is:

Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered. This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider. The error returned from CoCreateInstance on class with CLSID {0b5a2c52-3eb9-470a-96e2-6c6d4570e40f} and Name Coordinator is [0x80040154, Class not registered
].

Seems like VSSadmin is really unhappy to run from BigFix agent context.

7

Thanks for reply Brolly33,

I’ve seen the first error for the first message “shadowtest1.txt” but not the second one.
So, It’s not possible to use Bigfix to do this…
I will do it manually then and If I need to do It remotely, I will use psexec.

Thanks for your help Sean and Brolly33.

Robin

8

Might be possible still, but not unless you can clear the application error. I strongly suspect the security/user context is the issue. If you are on BigFix 9.5.5 or higher, you might try out the new feature to run this as the local administrator?
https://developer.bigfix.com/action-script/reference/execution/override.html

9

Hello Brolly33,

I’ve tested the runas feature,
I have a localadmin called “Admnistrateur” who is activated.
When I execute the fixlet, he ask me for the Password of this user. Then the fixlet started

override wait
completion=job
hidden=true
runas=localuser
user=administrateur
password=required
wait CMD.EXE /C vssadmin resize shadowstorage /for=C: /on=C: /maxsize=15% >>"D:\vssadmin\VssLog.txt"
wait CMD.EXE /C whoami >>"D:\vssadmin\VssLogI.txt"

I think the runas don’t work and is still using the System user…

In the VssLog.txt , I got this :
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
© Copyright 2001-2005 Microsoft Corp.

Error: A Volume Shadow Copy Service component encountered an unexpected error.
Check the Application event log for more information.

And the VssLogI.txt, the log is empty,

My agent version is : Client version 9.5.5.196

On my LOG file that I found on “C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData__Global\Logs” I see the following lines :
At 09:55:21 +0200 - actionsite (http:/SRV-ADRESS:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded parameter (action:10132)
Command succeeded (evaluated true) continue if (action:10132)
Command succeeded parameter (action:10132)
Command succeeded override (action:10132)
Command succeeded override (action:10132)
Command succeeded override (action:10132)
Command succeeded override (action:10132)
Command succeeded override (action:10132)
Command started - wait (action:10132)
Command succeeded (Exit Code=1) wait (action:10132)
Command started - wait (action:10132)
Command succeeded (Exit Code=2) wait (action:10132)

Do you have any Idea what I do false ?

Thanks

10

Guys, I tested this again and verified BigFix has no problem running vssadmin just like any other built in exe. Thanks to brolly’s work my actionscript is now even more straightforward:

waithidden cmd.exe /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10%>C:\Temp\vssadmin.log

I had a lab configured to 1% System Restore, ran the fixlet, verified it was now set to 10%, and the vssadmin.log file contents below confirm it ran fine:

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2005 Microsoft Corp.

Successfully resized the shadow copy storage association

There’s really no reason using the default System account via BigFix would be unable to run vssadmin. If you have been testing all this time on the same device, I suggest trying on multiple different devices to see if any of them work.

11

Hello Sean,

Btw it’s not working on my laptop and in my actual lab test.
I will try this on a FRESH install. Because I only need to add this in a Baseline for installation of new Computers.
I give you a Feedback when I’m done.

Thanks again,

Robin

12

Still the same…
.
waithidden cmd.exe /c mkdir "c:\Temp"
waithidden cmd.exe /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10%>C:\Temp\vssadmin.log

in my Logfile :
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
© Copyright 2001-2005 Microsoft Corp.

Error: A Volume Shadow Copy Service component encountered an unexpected error.
Check the Application event log for more information.

In my eventlog :
Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered. This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider. The error returned from CoCreateInstance on class with CLSID {0b5a2c52-3eb9-470a-96e2-6c6d4570e40f} and Name Coordinator is [0x80040154, Class not registered
].

I copy a similiar message because mine is in German or French so not very helpfull for you :smiley:

Maybe I need Something on my BigFix server(like a component or a service) ? I don’t undestand why it’s working in your Computer and not mine. And why it’s working localy and not remotely with bigfix

Did you tried it on a Windows 32Bits system ??

I’ve tried in a Windows 7 32Bits and it has worked. Now I must find why it’s not working on a 64Bits

I see on the following post : Deployment runs in 32 or 64 under SYSTEM?
that Bigfix run CMD.exe using 32 Bits. I think that’s the case. I will try some tricks and reply after this.

Thanks

13

Cool !

That was the Problem.
I’ve created a Batch file with the following commands :

@echo off
set "SystemPath=%SystemRoot%\System32"
if not "%ProgramFiles(x86)%"=="" (
    if exist %SystemRoot%\Sysnative\* set "SystemPath=%SystemRoot%\Sysnative"
)
%SystemPath%\cmd.exe /C vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10%%
%SystemPath%\cmd.exe /C vssadmin resize shadowstorage /for=D: /on=D: /maxsize=10%%

This launch the command with a 64Bits cmd and it’s working perfectly.

I will find a solution to do Something more clean.

Thanks for help,

Robin

2 Likes
14 
waithidden cmd.exe /C mkdir "c:\VSSlog"

if {x64 of operating system}

//Version 64 Bits
delete __appendfile
appendfile @echo off
appendfile set "SystemPath=%SystemRoot%\System32"
appendfile if not "%ProgramFiles(x86)%"=="" (
appendfile if exist %SystemRoot%\Sysnative\* set "SystemPath=%SystemRoot%\Sysnative"
appendfile )
appendfile %SystemPath%\cmd.exe /C vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10%%
appendfile %SystemPath%\cmd.exe /C vssadmin resize shadowstorage /for=D: /on=D: /maxsize=10%%
delete VSS.bat
move __appendfile VSS.bat
run VSS.bat as administrator>>"c:\VSSlog\log.txt"

 else

//Version 32 Bits
waithidden cmd.exe /C vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10%>>"c:\VSSlog\log.txt"
waithidden cmd.exe /C vssadmin resize shadowstorage /for=D: /on=D: /maxsize=10%>>"c:\VSSlog\log.txt"

 endif
1 Like
15

I have a last question :
When you think it’s finish, you thing about Something else to do lol

I’m not good with Analyses, do you think possible to create an Analyses who give you infos about the maxsize of letter C: and D: ?

I don’t even know where to begin with this.

Thanks,

Robin

16

One thing of note here is only the first “wait” in this list has the override. You would need to put the override on the second wait as well to have it run as a different user.

1 Like
17

All you really need, is to put somewhere in your actionscript before you run the wait commands,

action uses wow64 redirection false

Then it’ll execute the native versions of the executables rather than the wow64 versions.

1 Like
18

ahah thanks JasonWalker, It was simple like that :smiley:

waithidden cmd.exe /C mkdir "c:\VSSlog"

if {x64 of operating system}
//Version 64 Bits
action uses wow64 redirection false
waithidden cmd.exe /C vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10%>>"c:\VSSlog\log.txt"
waithidden cmd.exe /C vssadmin resize shadowstorage /for=D: /on=D: /maxsize=10%>>"c:\VSSlog\log.txt"
else
//Version 32 Bits
waithidden cmd.exe /C vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10%>>"c:\VSSlog\log.txt"
waithidden cmd.exe /C vssadmin resize shadowstorage /for=D: /on=D: /maxsize=10%>>"c:\VSSlog\log.txt"
endif

Work perfectly.

Thanks

19

I try to do an Analysis.
It’s working on 32Bits Computers but not on 64Bits, I think it’s the same Problem as the fixlet.

My Analysis is :
string values of selects "MaxSpace from Win32_shadowstorage" of WMI

For x64 what must I add to make this working ?
Is it possible to use the wow64 redirection or Something like that ?

Thanks

20

Actually, it should be as simple as

action uses wow64 redirection false
waithidden cmd.exe /C mkdir "c:\VSSlog"
waithidden cmd.exe /C vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10%>>"c:\VSSlog\log.txt"
waithidden cmd.exe /C vssadmin resize shadowstorage /for=D: /on=D: /maxsize=10%>>"c:\VSSlog\log.txt"

‘action uses wow64 redirection false’ has no effect on 32-bit hosts, so it’s safe to run it either way.

I’ve also seen it used as
action uses wow64 redirection {not x64 of operating system} but I’m not sure why/whether the architecture check is necessary.

1 Like