Jump to content

Run Command syntax


j-gray
 Share

Recommended Posts

This should be simple, but I'm having no luck. Task runs successfully but nothing happens on the clients.

At the command line, this works perfectly:  "C:\Program Files\CCleaner\uninst.exe"/S

I have the task set as follows:

Command line to run:  uninst.exe /S

Working directory:  C:\Program Files\CCleaner

I also tried the following:

Command line to run: "C:\Program Files\CCleaner\uninst.exe"/S

Either version runs successfully but does nothing.

Does the 'working directory' require quotes due to space in the path? I don't believe anything is being logged...

Link to comment
Share on other sites

Using the first option (command line to run and working directory both populated), I see the following in a batch file that is left in C:\Windows\Temp:

uninst.exe /S
del C:\Windows\TEMP\ra-run-command-92b883c9-c357-4610-9ecb-62cfa0e9f907.bat

The second line is obviously failing as the batch file is still in the directory. I'm assuming based on the command that it's not referencing the working directory?

Link to comment
Share on other sites

  • ESET Staff
14 minutes ago, j-gray said:

Using the first option (command line to run and working directory both populated), I see the following in a batch file that is left in C:\Windows\Temp:

uninst.exe /S
del C:\Windows\TEMP\ra-run-command-92b883c9-c357-4610-9ecb-62cfa0e9f907.bat

The second line is obviously failing as the batch file is still in the directory. I'm assuming based on the command that it's not referencing the working directory?

If I recall correctly, working directory is probably set by "parent" process, i.e. it is set before script is started, and therefore it is not visible in script content directly.

Regarding removal of script, in case path is correct, could you verify that script is not running? In case it is blocked on execution of first line, it might explain why delete operation was not called...

Also note, that most common issue with run command taks is that scripts are executed with AGENT's security context, i.e. as LOCAL SYSTEM, which might have limited access to specific resources, including user desktop, and therefore extra care has to be made when accessing network shared, protected disks or even executing applications that might require access to desktop environment, or environment of standard user.

Edited by MartinK
Link to comment
Share on other sites

12 minutes ago, MartinK said:

If I recall correctly, working directory is probably set by "parent" process, i.e. it is set before script is started, and therefore it is not visible in script content directly.

Regarding removal of script, in case path is correct, could you verify that script is not running? In case it is blocked on execution of first line, it might explain why delete operation was not called...

Regarding working directory, I put quotes around it and it failed. This is counterintuitive, as at a command prompt, it will fail without quotes due to the space in the path.

Link to comment
Share on other sites

31 minutes ago, MartinK said:

Also note, that most common issue with run command taks is that scripts are executed with AGENT's security context, i.e. as LOCAL SYSTEM, which might have limited access to specific resources, including user desktop, and therefore extra care has to be made when accessing network shared, protected disks or even executing applications that might require access to desktop environment, or environment of standard user.

I'm going to guess that it's a permissions issue. On my test system, the task runs successfully and uninstall is successful using the command below:

Command line to run: "C:\Program Files\CCleaner\uninst.exe"/S

On any other system (all are Win10), while the task runs successfully, the uninstall does not start and the ra-run-command batch file remains in C:\Windows\Temp.

Any suggestions on how to get this simple task to run?

 

Link to comment
Share on other sites

41 minutes ago, Marcos said:

Does it actually do something if you run the command via "psexec -s" in the system account?

Yes, this method works.

Link to comment
Share on other sites

I also tried the task by going to client details, then 'Installed Applications'. I selected CCleaner from the list of applications, then clicked the 'Uninstall' button.

That gave the following error:  "SoftwareUninstallation: No applications matching name 'CCleaner' were found"

Despite the application being installed and being selectable as an application, it does not run.

I also tried the software uninstall client task, but CCleaner does not appear in the list of applications to select.

Pretty frustrating...

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...