PowerShell remoting for Discovery

  • Release version: Washingtondc
  • Updated February 1, 2024
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of PowerShell Remoting for Discovery

    The PowerShell remote execution framework simplifies the execution of scripts on target devices during Discovery in ServiceNow's IT Operations Management. This framework enhances consistency, efficiency, and stability in remote script execution, which is crucial for effective application discovery.

    Show full answer Show less

    Requirements

    To utilize the PowerShell remote execution framework, ensure the following prerequisites are met:

    • The MID Server must have read and write access to the target's network share.
    • The remote target must run PowerShell version 3 or higher (up to 5.1).
    • For MID Servers using WinRM or WMI and opting to copy scripts, the MachinePolicy and UserPolicy scopes should be set to Undefined. If not copying scripts, any execution policy up to Restrictive is acceptable.

    Application Discovery

    The framework allows for file copying to remote targets, which is essential for certain probes like Windows — File discovery. This process enables scripts to invoke themselves on the remote target, reducing errors associated with script length during execution. Be mindful that anti-virus software may flag copied scripts; adding them to the permitted list can mitigate this issue.

    Probe Configuration

    For the Windows — Active Connections probe, the configuration allows the selection of options for remote script execution:

    • The "Execute script remotely" checkbox enables execution on the remote target if the ECC queue topic is WMIRunner or PowerShell.
    • If "Copy script to target" is checked, the script is copied and executed on the remote target. If unchecked, the script executes directly on the target without copying.

    PowerShell Probe Development

    The unified framework eliminates the need for probe developers to create their own remote execution code, streamlining the process and reducing inconsistencies. The developer can write scripts as if they were running locally, as the framework automatically manages remote execution. MID Servers configured for WinRM offer better efficiency and stability compared to those using WMI with launchProcess.

    Probe developers can use the PowerShell remote execution framework to automatically handle remote execution of scripts on target devices. The unified framework removes inconsistencies in remote execution, increases efficiency, and improves stability.

    Requirements

    To use PowerShell remote execution framework, the following requirements must be met:
    • The MID Server must be able to write to and read from the network share of the target.
    • The remote target must have PowerShell 3 or higher (up to 5.1).
    • For MID Servers using WinRM or WMI which choose to copy the script to the remote target, the MachinePolicy and UserPolicy scopes must be set to Undefined. If the script is not copied, the execution policy can be any other setting up to Restrictive.

    See Set up MID Servers to use PowerShell for more information.

    Application discovery

    The PowerShell remote execution framework has options for copying files to the remote target when executing a scan. Copying files to the target is important for probes like Windows — File discovery because its script invokes itself on the remote target to spawn off a new process. MID Servers using WMI to execute scripts remotely can experience an error with launchProcess if the script is too long. Copying the script to the remote target resolves this error. Copying a script to a remote target may result in anti-virus software on the target flagging the script. To avoid issues with anti-virus software, add the scripts to the permitted list in the anti-virus app.

    Probe configuration

    The following is the configuration page for the Windows — Active Connections probe, which is included in the Windows — ADM multiprobe.

    Windows — Active Connections probe configuration page

    The Execute script remotely check box is visible when the ECC queue topic is WMIRunner or PowerShell. When checked, the script executes on the remote target. Otherwise the script executes on the MID Server.

    The Copy script to target check box is visible when Execute script remotely is checked. If Copy script to target is checked, then the script is copied to, and run on, the target. If Copy script to target is unchecked, then the script is executed on the target without copying it.

    PowerShell probe development

    PowerShell remote execution framework is a unified method of executing PowerShell scripts, contained in a probe parameter, on a remote target server. The framework removes the need for probe developers to write their own remote execution code, which can cause inconsistencies between developers. The probe developer writes the script as if the probe was collecting information locally because the remote execution framework automatically handles remote script execution.

    The framework handles remote execution whether the MID Server is configured to use WMI or WinRM. If the MID Server is configured for WMI, the probe uses launchProcess to execute commands on the remote target. Using launchProcess complicates remote execution and can cause failures. However, a MID Server configured for WinRM does not use launchProcess, and so is more efficient and stable.