JoannaJankowska asked a question.
Does anyone know on what basis powershell scripts running with the agent are detected?
Hi all,
The agent's running scripts are displayed as part of its package. However, when the script is not running, it is not detected even though it is on the computer.
Does the script add a value to the agent which confirms that the script has been used?
Kind regards
Hi Joanna,
as long as the PowerShell scripts are int he correct location and have a security certificate then they will get executed by the agent. The scripts are there to collect additional information for certain products required for licensing calculations.
Kind regards,
Jelle
Hi Jelle,
Thanks for answer. I know that if the scripts are not properly signed then they will not be detected because they will not even run. There will be information about this in the agent logs as far as I know.
However, what puzzles me is what causes the agent script to be added to the SLM. I amtalking about the case where the script is correctly named and signed.
Kind regards,
Joanna
Hi,
in addition (as long as this has not changed), the scripts have to be named scan*.ps1 to be executed.
Kind regards,
Axel
Hi Axel,
Thanks for answer. Yes, thats right.
However, I am interested in what a properly run script leaves behind, on a computer system.
Kind regards,
Joanna
Hi Joanna,
it depends on the script.
IF the script modifies anything on the computer, it will require a signature (formerly .snow-ps1).
If the script only reads data and, for example, uses "yield-registrykey", nothing on the computer will be modified.
Yield-RegistryKey only writes into a "virtual" registry, and the information will be visible in the Snow INventory Server Admin Console under the custom registrykeys.
In this case, any .ps1 with the name starting twith scan- will work.
I implemented this in several customer environments to read bitlocker encryption status, local administrators, monitor serial numbers etc.
Kind regards,
Axel
There were some recognitions missing for the new scripts coming with the new Windows agent 7.0.0 version. But this is fixed in the meantime and now they show as Axel writes in the Inventory Admin console and SLM web-interface.