permissions to run PowerShell Package

[AndyGilly]

Morning

we have looked to create our first schedule job that runs a in-house built PowerShell package.

when the job runs i get an error that the account it is running under has insufficient privileges as below. Is this anything anyone has seen before?

Replace a process-level token. (SeAssignPrimaryTokenPrivilege)
Adjust memory quotas for a process. (SeIncreaseQuotaPrivilege)
Act as part of the operating system. (SeTcbPrivilege)

 

i have had a read online and i assume the privileges are need on the SIS server but i haven't been able to resolve quite yet

[Steve Giller]

Hi @AndyGilly

You should find details about this on the ITOM Quick Start Guide.

[Ricky]

Hi @AndyGilly

You will need to assign these user rights the account that is used as the ITOM Admin account  for the Job / Scheduled Job, or if you have configured your SIS to use a service account, then this account must have these rights assigned.

Regards,

Ricky

[AndyGilly]

thanks @Steve Giller & @Ricky, appreciated

[AndyGilly]

Hi @Ricky, @Steve Giller

we have managed to get the appropriate permissions applied, the job in question is now stuck at the processing output stage when run

are you able to help with the best way to troubleshoot this type of issue??

thanks

Andy

 

 

[Ricky]

Hi Andy, apologies as I have only just been notified about this post.  The first place to look will be the SIS log file EspSisService.log  located in the folder: C:\ProgramData\Hornbill\Site Integration Server\log

The following is an extract showing a job being processed by the SIS, if you can post yours we should be able to work out where the issue is.

2021-01-26 12:18:17Z [INFO]:[GENERAL]:[4452] Executing package job: 2073
2021-01-26 12:18:17Z [INFO]:[GENERAL]:[4452] Executer filename: C:\Program Files\Hornbill\Site Integration Server\exec\win\x64\EspSisExec.exe
2021-01-26 12:18:17Z [INFO]:[GENERAL]:[4452] Package filename: C:\ProgramData\Hornbill\Site Integration Server\packages\37fe560b5772fe22073a78dca8dec234bcb34ae2.pkg
2021-01-26 12:18:17Z [INFO]:[GENERAL]:[4452] Target: W2K12R2-DC01
2021-01-26 12:18:17Z [INFO]:[GENERAL]:[4452] Protocol: 1
2021-01-26 12:18:17Z [INFO]:[GENERAL]:[4452] Package: BooleanPSParam
2021-01-26 12:18:17Z [INFO]:[GENERAL]:[4452] Operation: Demo Powershell
2021-01-26 12:18:17Z [INFO]:[GENERAL]:[4452] Callback context: zEmgs7Gp31vYr23mB4kYjIXvYis_uEMG51ke4_KbXAx8MWKJORKBIh9faqQ8-6QZ9gAStYQpeveDemPQAVNc43aDJVxmZ54Q3iFyyx_-eGg2B4kYd8aN9UwdIKxCyLmUgroE4Dl2qS--Mas8fiwjNWiK216nZ0Vgml1syioI0qY6kC-xBeP5KqDD_TwJxCsdG7E0x44ij97ltLQZ_Vtqwgyf96c_i2hAUP4h64oTVEv4OXGj93-4FM1NmABnwazyMeL4w6NVtbBCFe0J8QE7RIHjohf7gECEZ3yD5gD9qKRRaZxMpWtwyFkDFPQZOqUiLfuHWMQHe0xwdYrgwIsDR4GmPbwHjK0dbzSXt2arP-veAnD5QzNvEwHT808S15PHP6jSULvdGywGePC8bchuk26RyiyMQCU11dw8WWd2Q91ZMwO3MHF5eZmiCiPFSA5fV_eynbE3zVS4xW8neMjBpcj6UrO8hhHlnx6UdIoLO4_8qAFG
2021-01-26 12:18:17Z [INFO]:[GENERAL]:[4452] Timeout: 60
2021-01-26 12:18:17Z [INFO]:[GENERAL]:[4452] Encoded parameters: okpfR9fnZEwMovC0_-G_42TYE2Mo5b75u0qQUTTgsa6mx5GSj7HFkit8--pAYT5phA0eaL4rLSF7-3SCmrveB88s8xKb5-G-lMfX7ymR-ygH50E5HY2v9bygyA-LIlOxyAIid43gRBk-81GLXCuCY3qyIoiMXfHCWuJvP9n2zmHnVA-8IlLvO53I_FJsykBKJYlM7_1Rt944Py3RmwFfMax8YWgw4zF6TrTG2QVh3e85AaAGyoww-yjxDmbPSxzjmavAr2c3WESNzZLNUx6fmPmq4XDXjrtIEtoKNcabyWciQmT31mAwcFcBPp_4Y4JgfpYpryE9no91PZmgUnzPK54kJ93yt3BOB_vH9E3N8yYy2PweSzZSuUQSGuAxJYq-3WDcH7ScVPX5QmLosR58ylpohabfrd_qNIyndMeTDPreq2PdUwU-JDYDeDniRiYwSiAOeE__Iwz6Bqzd_vSwPaNMhVKWaDv4U7OfaZ8uXOj9XJD6ggd-
2021-01-26 12:18:17Z [INFO]:[GENERAL]:[4452] Encoded credentials: RMFrQFMVdXvfl5MRvBNLUrH8QwNHF3CeioK1TGCfUO-TsWEwS2TMFuHY3OOAs3M7Mgq8vdFJC19IEKGpWoIEkcw2JDIsnFwU9TT61iUm-Ro
2021-01-26 12:18:17Z [INFO]:[GENERAL]:[4452] Impersonating Administrator@hornbill.qa against W2K12R2-DC01.
2021-01-26 12:18:18Z [INFO]:[GENERAL]:[4452] Running command line: "C:\Windows\TEMP\Hornbill\SIS Package Processor\4edc654c-3770-480c-b0fe-9a9780aec6e6\EspSisExec.exe" -target "W2K12R2-DC01" -mode package -packageFilename "C:\Windows\TEMP\Hornbill\SIS Package Processor\4edc654c-3770-480c-b0fe-9a9780aec6e6\37fe560b5772fe22073a78dca8dec234bcb34ae2.pkg" -xmlResultFilename "C:\Windows\TEMP\Hornbill\SIS Package Processor\4edc654c-3770-480c-b0fe-9a9780aec6e6\Result.xml" -operation "Demo Powershell" -callbackContext "zEmgs7Gp31vYr23mB4kYjIXvYis_uEMG51ke4_KbXAx8MWKJORKBIh9faqQ8-6QZ9gAStYQpeveDemPQAVNc43aDJVxmZ54Q3iFyyx_-eGg2B4kYd8aN9UwdIKxCyLmUgroE4Dl2qS--Mas8fiwjNWiK216nZ0Vgml1syioI0qY6kC-xBeP5KqDD_TwJxCsdG7E0x44ij97ltLQZ_Vtqwgyf96c_i2hAUP4h64oTVEv4OXGj93-4FM1NmABnwazyMeL4w6NVtbBCFe0J8QE7RIHjohf7gECEZ3yD5gD9qKRRaZxMpWtwyFkDFPQZOqUiLfuHWMQHe0xwdYrgwIsDR4GmPbwHjK0dbzSXt2arP-veAnD5QzNvEwHT808S15PHP6jSULvdGywGePC8bchuk26RyiyMQCU11dw8WWd2Q91ZMwO3MHF5eZmiCiPFSA5fV_eynbE3zVS4xW8neMjBpcj6UrO8hhHlnx6UdIoLO4_8qAFG" -timeout 60 -encodedParameters "okpfR9fnZEwMovC0_-G_42TYE2Mo5b75u0qQUTTgsa6mx5GSj7HFkit8--pAYT5phA0eaL4rLSF7-3SCmrveB88s8xKb5-G-lMfX7ymR-ygH50E5HY2v9bygyA-LIlOxyAIid43gRBk-81GLXCuCY3qyIoiMXfHCWuJvP9n2zmHnVA-8IlLvO53I_FJsykBKJYlM7_1Rt944Py3RmwFfMax8YWgw4zF6TrTG2QVh3e85AaAGyoww-yjxDmbPSxzjmavAr2c3WESNzZLNUx6fmPmq4XDXjrtIEtoKNcabyWciQmT31mAwcFcBPp_4Y4JgfpYpryE9no91PZmgUnzPK54kJ93yt3BOB_vH9E3N8yYy2PweSzZSuUQSGuAxJYq-3WDcH7ScVPX5QmLosR58ylpohabfrd_qNIyndMeTDPreq2PdUwU-JDYDeDniRiYwSiAOeE__Iwz6Bqzd_vSwPaNMhVKWaDv4U7OfaZ8uXOj9XJD6ggd-" -encodedCredentials "RMFrQFMVdXvfl5MRvBNLUrH8QwNHF3CeioK1TGCfUO-TsWEwS2TMFuHY3OOAs3M7Mgq8vdFJC19IEKGpWoIEkcw2JDIsnFwU9TT61iUm-Ro" -logLinePrefix "P"
2021-01-26 12:18:23Z [INFO]:[GENERAL]:[4452] XML Result document: <?xml version="1.0" encoding="utf-8"?> | <result> | 	<process> | 		<success>Yes</success> | 		<exit_code>0</exit_code> | 		<result>Success</result> | 	</process> | 	<processing> | 		<output> | 			#&lt; CLIXML | {{SISJobOutputParameterStart:ParamA}}test{{SISJobOutputParameterEnd}} | {{SISJobOutputParameterStart:ParamB}}10{{SISJobOutputParameterEnd}} | {{SISJobOutputParameterStart:ParamC}}True{{SISJobOutputParameterEnd}} | &lt;Objs Version=&quot;1.1.0.1&quot; xmlns=&quot;http://schemas.microsoft.com/powershell/2004/04&quot;&gt;&lt;Obj S=&quot;progress&quot; RefId=&quot;0&quot;&gt;&lt;TN RefId=&quot;0&quot;&gt;&lt;T&gt;System.Management.Automation.PSCustomObject&lt;/T&gt;&lt;T&gt;System.Object&lt;/T&gt;&lt;/TN&gt;&lt;MS&gt;&lt;I64 N=&quot;SourceId&quot;&gt;1&lt;/I64&gt;&lt;PR N=&quot;Record&quot;&gt;&lt;AV&gt;Preparing modules for first use.&lt;/AV&gt;&lt;AI&gt;0&lt;/AI&gt;&lt;Nil /&gt;&lt;PI&gt;-1&lt;/PI&gt;&lt;PC&gt;-1&lt;/PC&gt;&lt;T&gt;Completed&lt;/T&gt;&lt;SR&gt;-1&lt;/SR&gt;&lt;SD&gt; &lt;/SD&gt;&lt;/PR&gt;&lt;/MS&gt;&lt;/Obj&gt;&lt;/Objs&gt; | 		</output> | 	</processing> | 	<logging> | 		<processing> | 			2021-01-26 12:18:18Z [DEBUG]:[GENERAL]:[5620] Log filename: C:\Windows\TEMP\Hornbill\SIS Package Processor\4edc654c-3770-480c-b0fe-9a9780aec6e6\Processing.log | 2021-01-26 12:18:18Z [DEBUG]:[GENERAL]:[5620] Local computer name: W2K12R2-DC01 | 2021-01-26 12:18:18Z [NOTICE]:[GENERAL]:[5620] Package filename: C:\Windows\TEMP\Hornbill\SIS Package Processor\4edc654c-3770-480c-b0fe-9a9780aec6e6\37fe560b5772fe22073a78dca8dec234bcb34ae2.pkg | 2021-01-26 12:18:18Z [NOTICE]:[GENERAL]:[5620] Operation: Demo Powershell | 2021-01-26 12:18:18Z [DEBUG]:[GENERAL]:[5620] XML result filename: C:\Windows\TEMP\Hornbill\SIS Package Processor\4edc654c-3770-480c-b0fe-9a9780aec6e6\Result.xml | 2021-01-26 12:18:18Z [DEBUG]:[GENERAL]:[5620] Timeout: 60 | 2021-01-26 12:18:18Z [DEBUG]:[GENERAL]:[5620] Encoded parameters: okpfR9fnZEwMovC0_-G_42TYE2Mo5b75u0qQUTTgsa6mx5GSj7HFkit8--pAYT5phA0eaL4rLSF7-3SCmrveB88s8xKb5-G-lMfX7ymR-ygH50E5HY2v9bygyA-LIlOxyAIid43gRBk-81GLXCuCY3qyIoiMXfHCWuJvP9n2zmHnVA-8IlLvO53I_FJsykBKJYlM7_1Rt944Py3RmwFfMax8YWgw4zF6TrTG2QVh3e85AaAGyoww-yjxDmbPSxzjmavAr2c3WESNzZLNUx6fmPmq4XDXjrtIEtoKNcabyWciQmT31mAwcFcBPp_4Y4JgfpYpryE9no91PZmgUnzPK54kJ93yt3BOB_vH9E3N8yYy2PweSzZSuUQSGuAxJYq-3WDcH7ScVPX5QmLosR58ylpohabfrd_qNIyndMeTDPreq2PdUwU-JDYDeDniRiYwSiAOeE__Iwz6Bqzd_vSwPaNMhVKWaDv4U7OfaZ8uXOj9XJD6ggd- | 2021-01-26 12:18:18Z [DEBUG]:[GENERAL]:[5620] Encoded credentials: RMFrQFMVdXvfl5MRvBNLUrH8QwNHF3CeioK1TGCfUO-TsWEwS2TMFuHY3OOAs3M7Mgq8vdFJC19IEKGpWoIEkcw2JDIsnFwU9TT61iUm-Ro | 2021-01-26 12:18:18Z [DEBUG]:[GENERAL]:[5620] Callback context: zEmgs7Gp31vYr23mB4kYjIXvYis_uEMG51ke4_KbXAx8MWKJORKBIh9faqQ8-6QZ9gAStYQpeveDemPQAVNc43aDJVxmZ54Q3iFyyx_-eGg2B4kYd8aN9UwdIKxCyLmUgroE4Dl2qS--Mas8fiwjNWiK216nZ0Vgml1syioI0qY6kC-xBeP5KqDD_TwJxCsdG7E0x44ij97ltLQZ_Vtqwgyf96c_i2hAUP4h64oTVEv4OXGj93-4FM1NmABnwazyMeL4w6NVtbBCFe0J8QE7RIHjohf7gECEZ3yD5gD9qKRRaZxMpWtwyFkDFPQZOqUiLfuHWMQHe0xwdYrgwIsDR4GmPbwHjK0dbzSXt2arP-veAnD5QzNvEwHT808S15PHP6jSULvdGywGePC8bchuk26RyiyMQCU11dw8WWd2Q91ZMwO3MHF5eZmiCiPFSA5fV_eynbE3zVS4xW8neMjBpcj6UrO8hhHlnx6UdIoLO4_8qAFG | 2021-01-26 12:18:18Z [DEBUG]:[GENERAL]:[5620] Log line prefix: P | 2021-01-26 12:18:18Z [ERROR]:[GENERAL]:[5620] Failed to post callback command &apos;log&apos; to http://0.0.0.0:11117/_exec_callback/log/fXPLYTZHy-tWyOJOgrW1TO3o4ckMSaAnZLuZ5HbxH0q9I9gG4SanVGwvr90P9KOgGMpewaNYi09VeBVO7CLUTf2s_z4JDQbvkAYu2isSwbVqDCIFRwX-flqgUbkitPlLjyo_X8-DU9ZkX1avwkzvDnuz5070poI7FCN-WymtMWie8UPGfnL65BGb0qj-wd1WY753UMfvPhe0drIrF4Z5_ZASUGvgeyeaX78Vy38i8VVN8xVZ. No response was available. | 2021-01-26 12:18:18Z [DEBUG]:[GENERAL]:[5620] Package processing started as HORNBILL\Administrator. PID: 3128 | 2021-01-26 12:18:18Z [NOTICE]:[GENERAL]:[5620] Analysing input parameters | 2021-01-26 12:18:18Z [NOTICE]:[GENERAL]:[5620] Parameter: Name: ParamA Value: test | 2021-01-26 12:18:18Z [NOTICE]:[GENERAL]:[5620] Parameter: Name: ParamB Value: 10 | 2021-01-26 12:18:18Z [NOTICE]:[GENERAL]:[5620] Parameter: Name: ParamC Value: true | 2021-01-26 12:18:18Z [NOTICE]:[GENERAL]:[5620] Target platform: win64 | 2021-01-26 12:18:18Z [NOTICE]:[GENERAL]:[5620] Command Type: ps1 | 2021-01-26 12:18:18Z [NOTICE]:[GENERAL]:[5620] Timeout: 60 | 2021-01-26 12:18:18Z [DEBUG]:[GENERAL]:[5620] Using the native variant of PowerShell | 2021-01-26 12:18:18Z [NOTICE]:[GENERAL]:[5620] Using executable C:\Windows\system32/WindowsPowerShell\v1.0\PowerShell.exe | 2021-01-26 12:18:18Z [NOTICE]:[GENERAL]:[5620] Parameter ParamC is Boolean - modifying value for PowerShell | 2021-01-26 12:18:18Z [NOTICE]:[GENERAL]:[5620] Plain text arguments: .\&quot;DemoPowershell.ps1&quot;  -ParamA test -ParamB 10 -ParamC true | 2021-01-26 12:18:18Z [NOTICE]:[GENERAL]:[5620] Base64 arguments: LgBcACIARABlAG0AbwBQAG8AdwBlAHIAcwBoAGUAbABsAC4AcABzADEAIgAgACAALQBQAGEAcgBhAG0AQQAgAHQAZQBzAHQAIAAtAFAAYQByAGEAbQBCACAAMQAwACAALQBQAGEAcgBhAG0AQwAgAHQAcgB1AGUA | 2021-01-26 12:18:18Z [DEBUG]:[GENERAL]:[5620] Console Output: C:\Users\ADMINI~1.WIN\AppData\Local\Temp\Hornbill\SIS Package Processor\3d69f3ae-6187-406c-8d70-d55a1571678d\Output/Output.txt | 2021-01-26 12:18:19Z [NOTICE]:[GENERAL]:[5620] Processing result: Exit Success | 		</processing> | 	</logging> | </result> | 
2021-01-26 12:18:23Z [INFO]:[GENERAL]:[4452] Result: Success
2021-01-26 12:18:23Z [INFO]:[GENERAL]:[4452] Setting job 2073 status to processingOutput
2021-01-26 12:18:23Z [INFO]:[GENERAL]:[4452] Setting job 2073 status to succeeded

Regards,

Ricky

[AndyGilly]

thanks @Ricky i will have a look

[Ricky]

@AndyGilly  When executing a job from the Job Queue I have also noted that occasionally the job gets stuck with the "Processing Output" status, and can be resolved by a browser refresh.  It would be useful to see if this resolves the issue that you are experiencing.

 

[AndyGilly]

Morning @Ricky, apologies was on a course last week. here is what i think we have found. would appreciate your thoughts
 

It looks like there are a couple of issues…

1.

On the line that starts “2021-01-21 10:52:45Z [INFO]:[GENERAL]:[3336] XML Result document:.…..” it looks like it is giving an error that says…..

            “<error>It was not possible to start the process &apos;pwsh.exe&apos;. The system cannot find the file specified.</error>"

 

This is looking for a newer version of PowerShell than is on the machine.  Is there a pre-req for a particular version of PowerShell for this? 

2.

A little further down (ie a few lines) there is an error talking about the “SIS authorization key is invalid”

 

 

[AndyGilly]

Hi @Ricky

can you help with the above??

thanks

Andy

[Ricky]

Hi @AndyGilly, Apologies for the delay I am currently investigating, I haven't seen any documentation relating to version requirements, but will investigate further.

Can you try adding Set-StrictMode -Version latest to your script?

Regards,

Ricky

 

[Ricky]

@AndyGillyIs it possible that you have set the operation Command Type incorrectly to Powershell Core and not Windows PowerShell?

 

Regards,

Ricky

 

[AndyGilly]

thanks @Ricky, the package was certainly setup as above, i have changed to Windows Powershell. the error has moved on to the below. 

appreciate your thoughts??

[Ricky]

Hi @AndyGilly, currently investigating the issue, in the meantime could you send me the Debug Log output for the failed job, as I am unable to replicate the fault.

Regards, Ricky

 

[AndyGilly]

Hi @Ricky

have got around this by installing the most recent version of powershell on the SIS server

but now get an output parameter error, here is the debug

thanks
Andy
 

[Ricky]

@AndyGilly The logs show that package operation is still set to use PowerShell Core.  Can you check that after you saved the change that you Baseline the package and the Package and Install.  

Ricky

[Ricky]

@AndyGillyThe Command Type shown in the Log show as ps1c, used for PowerShell Core, this should be ps1 for  all other PowerShell versions

 

[AndyGilly]

apologies i missed the package rebuild step, that is now complete but still get the same error. new debug log below

[Ricky]

@AndyGillyThis is most likely related to the use of PowerShell 7 which is not fully tested with ITOM, am having a look now and will get back to you.  I would advise that you roll back to the previous version of PowerShell  as our library packages will not have been built for anything above version 5.

Regards,

Ricky

 

[Ricky]

@AndyGillyIgnore my last post this has nothing to do with PS 7.  From the the last log it looks like the process  has executed successfully using Windows PowerShell.   Can you clarify what you mean or are interpreting as a parameter error?

I can only assume you are getting something like this in the Job Monitor pane:

If so the issue is relating to one or more output parameters specified on  the Package Operation is set to mandatory and the script is not outputting the parameter or  the output is not using the correct format :

{{SISJobOutputParameterStart:<param-name>}}<value>{{SISJobOutputParameterEnd}}