How do I run PowerShell script as a Response Action (4351287)

This article guides you though the process of integrating PowerShell scripts in the powerful InTrust Real-Time Monitoring feature "Response Action"

With PowerShell rapidly becoming major tool for Windows administrators, it is very important to unite InTrust and PowerShell capabilities.

1. Open InTrust Manager, go down to "Real-Time Monitoring node | Rules", find and right-click the necessary rule and open Properties.
2. On the "Response Actions" tab, click Add and select "Execute command" from the list and click OK.
3. "Working Folder" field may be left blank (provided you have Powershell.exe added as an environmental variable. If not specify path to Powershell.exe file).
4. In the "Application" field type "Powershell.exe" (without quotes)
5. In the "Parameters" field add absolute path to the .PS1 file, including the file itself. For example, c:\myscript.ps1. You can add more Powershell.exe parameters delimited by white space.
6. On the General tab of the Execute Command Properties, select "Server" for "Execute response actions on" if the PowerShell sript is to be executed on the InTrust server, otherwise leave the setting as "Agent" if the Powershell script will be executed by the InTrust agent.

Other considerations:

If it appears that all settings are correct but the PowerShell script is not executing, even though the system execution policy is set to unrestricted, Windows may still block execution of the PS1 file. An Event ID 4100 may be (but not necessarily) recorded in the PowerShell event log found in Event Viewer with details similar to:

"File cannot be loaded. The file is not digitally signed. The script will not execute on the system"

To overcome this, include ExecutionPolicy parameter in the "Parameters" line to execute the script Unrestricted.

For example:

-ExecutionPolicy UnRestricted C:\myscript.ps1