/build/static/layout/Breadcrumb_cap_w.png

KACE K1000 removes quotation marks which makes my CIR fail

Hi,

I'm looking to get a KACE K1000 report on the amount of computers that have a certain certificate. I've written a small PS script that suits my needs and runs perfectly fine on a computer:

Get-ChildItem -path cert:\CurrentUser\Root | where {$_.subject -like "*XXXXXXX*"}

To get the report, I made a Custom Inventory Rule that would run the script and return the text:

ShellCommandTextReturn(cmd /c "powershell.exe -command \"Get-ChildItem -path cert:\CurrentUser\Root | where {$_.subject -like \"*XXXXXXX*\"}\"")

However, although I've escaped what I've figured need to be escaped, I still get this error:

You must provide a value expression on the right-hand side of the '-like' opera
tor.
At line:1 char:69
+ Get-ChildItem -path cert:\CurrentUser\Root | where {$_.subject -like <<<< *XXXXXXXX*}
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordEx 
ception
+ FullyQualifiedErrorId : ExpectedValueExpression

[string]

As you can see it's not reading the subject as a string. Somewhere in the process my quotation marks get removed. I don't know where to approach this from. Can I rework the way I type my script into K1000 or should I upload it as a file instead and launch it from the CIR field? I'm stuck.

Thanks in advance

(Obviously the XXXXXX is actually a certain certificate subject)



EDIT: I solved this by making a script that would write to a file. A CIR would later read the file, and thus, a correct report could be made.


0 Comments   [ + ] Show comments

Answers (3)

Posted by: SMal.tmcc 8 years ago
Red Belt
1
try it like this, with a combination of single and double quotes.

ShellCommandTextReturn(cmd /c powershell.exe -command "Get-ChildItem -path cert:\CurrentUser\Root | where {$_.subject -like '*XXXXXXX*'}")

Comments:
  • That makes the CIR not turn up in the inventory of the devices I forced an update on. - IsakJ 8 years ago
    • The more I look at this I think your solution of writing a file is the right way to go. CIR's run as system so when that runs it does not know how to handle the path of "currentuser" - SMal.tmcc 8 years ago
Posted by: jknox 8 years ago
Red Belt
0
Do you get that same error with no additional escaping or quotes?  Is this running under the LocalSystem context?

Also, try it like this:

ShellCommandTextReturn(cmd /c "powershell.exe -command Get-ChildItem -path cert:\CurrentUser\Root | where {$_.subject -like "*XXXXXXX*"}")
If you can't figure it out, enable debug, force an inventory update.  Then get a KaptureState and submit a support ticket so that KACE can take a look.

Comments:
  • That's the first thing I tried. When it failed I went searching IT Ninja for a solution and based on previous answers I thought escaping might do the trick. - IsakJ 8 years ago
    • From a command prompt on a machine this should work on, run this assuming 64 bit:

      "C:\Program Files (x86)\Dell\KACE\kdeploy.exe" -custominventory

      That command may show you what the CIR is returning when it runs. - jknox 8 years ago
      • The error I listed in my original post is what the CIR is returning. I can replicate the same error in PS by running Get-ChildItem -path cert:\CurrentUser\Root | where {$_.subject -like *XXXXXXX*}

        (That's without the quotation marks) - IsakJ 8 years ago
Posted by: flip1001 8 years ago
Black Belt
0
ShellCommandTextReturn(cmd /c powershell.exe -Command "Get-ChildItem -path cert:\CurrentUser\Root | where-object {$_.subject -like '*XXXXXXX*'}")

Don't be a Stranger!

Sign up today to participate, stay informed, earn points and establish a reputation for yourself!

Sign up! or login

Share

 
This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ