-
Titre
A file named “temp_script.ps1” is noticed in client inventory logs. -
Description
When the inventory logs are reviewed, a line shows the execution of a PowerShell script“C:\ProgramData\Quest\kace\user\temp_script.ps1”in the “KAgent.log” log file, it states what it is doing before every call to the temp_script.ps1 file:
Getting information for execution:[2020-12-09.03:45:07][KInventory:KLaunchClient::Launch] KLaunchClient::Launch()
[2020-12-09.03:45:07][KInventory:KLaunchClient::DumpSt] Launch State: Command="C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe" Arguments="-NonInteractive -file "C:\ProgramData\Quest\KACE\user\temp_script.ps1"" WorkingDir="" Timeout=3600000 ShouldDetach=0 ShowWindow=0 Redirect_stdout=1 Redirect_stderr=1 Desktop=winsta0\default Using Wait_Override=0
[2020-12-09.03:45:07][KInventory:KLaunchUtils::DoesTok] DoesTokenHaveLSAPriviledges returning: 1
Getting the IPv4 and IPv6 information:[2020-12-09.03:45:21][KInventory:CCaptureInventory::Ex] KInventory Now gathering NetIPv6Interface information...
[2020-12-09.03:45:21][KInventory:KLaunchClient::Launch] KLaunchClient::Launch()
[2020-12-09.03:45:21][KInventory:KLaunchClient::DumpSt] Launch State: Command="C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe" Arguments="-NonInteractive -file "C:\ProgramData\Quest\KACE\user\temp_script.ps1"" WorkingDir="" Timeout=3600000 ShouldDetach=0 ShowWindow=0 Redirect_stdout=1 Redirect_stderr=1 Desktop=winsta0\default Using Wait_Override=0
[2020-12-09.03:45:21][KInventory:KLaunchUtils::DoesTok] DoesTokenHaveLSAPriviledges returning: 1
Getting EDGE information:[2020-12-09.03:45:25][KInventory:CCaptureInventory::Ex] KInventory Now gathering EdgeVersion information...
[2020-12-09.03:45:25][KInventory:KLaunchClient::Launch] KLaunchClient::Launch()
[2020-12-09.03:45:25][KInventory:KLaunchClient::DumpSt] Launch State: Command="C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe" Arguments="-NonInteractive -file "C:\ProgramData\Quest\KACE\user\temp_script.ps1"" WorkingDir="" Timeout=3600000 ShouldDetach=0 ShowWindow=0 Redirect_stdout=1 Redirect_stderr=1 Desktop=winsta0\default Using Wait_Override=0
[2020-12-09.03:45:25][KInventory:KLaunchUtils::DoesTok] DoesTokenHaveLSAPriviledges returning: 1
Getting the MDM Device information:[2020-12-09.03:45:26][KInventory:CCaptureInventory::Ex] KInventory Now gathering MDMDeviceID information...
[2020-12-09.03:45:26][KInventory:KLaunchClient::Launch] KLaunchClient::Launch()
[2020-12-09.03:45:26][KInventory:KLaunchClient::DumpSt] Launch State: Command="C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe" Arguments="-NonInteractive -file "C:\ProgramData\Quest\KACE\user\temp_script.ps1"" WorkingDir="" Timeout=3600000 ShouldDetach=0 ShowWindow=0 Redirect_stdout=1 Redirect_stderr=1 Desktop=winsta0\default Using Wait_Override=0
[2020-12-09.03:45:26][KInventory:KLaunchUtils::DoesTok] DoesTokenHaveLSAPriviledges returning: 1
That is why the file appears 4 times while the inventory is working. -
Cause
The appliance gathers information from the client devices and uses a PowerShell script for that purpose. -
Résolution
This behavior is by design, there is no impact on devices as this is a safe and valid script used by the KACE Agent to obtain information.