PowerShell Script Running successfully in ISE but Failing as a Scheduled Task

Question

PowerShell Script Running successfully in ISE but Failing as a Scheduled Task

Maranya, Damon 326

I am working on a script that takes a list of DIDs/GUIDIds from a locally stored file generated by another script. It then removes the listed devices from Active Directory. But it won't run as a scheduled task.

The Last Run Result status is 0x1. Which as far as I can tell is a vague catchall value meaning "I can't". There is nothing in the History tab at all.

I am logged in with the account that will be used to run task in the Task Scheduler. I've already delegated delete device permissions to the account that will run the script, and it currently completes without error when I run it manually in ISE. During the manual runs I am using the -whatif parameter, so that I don't lose the devices that the first script found. But that shouldn't affect the result when running it without the parameter in a scheduled task.

The Task Scheduler logs show task started>action started>action completed> task completed. The PowerShell logs show PowerShell Console Startup>PowerShell Named Pipe IPC>PowerShell Console Startup. There are no events after PowerShell Console Startup.

Accepted answer

1 additional answer

Your answer

Answer 1

MotoX80 36,291

Add a transcript to the script so that you can see the errors that Powershell generates.

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.host/start-transcript?view=powershell-5.1

Start-Transcript -path C:\Logs\MyScriptLog.txt

.... the rest of your script


Stop-Transcript

Maranya, Damon 326 Reputation points

2023-01-11T14:40:06.0133333+00:00

Oops, double posted...
Maranya, Damon 326 Reputation points

2023-01-11T14:45:22.9166667+00:00
I've actually already got the script starting a transcript before it even defines the variable. I wanted to make sure it was literally the first thing the script did.

However, no files appear at the path where Start-Transcript should be writing them. That is part of what has me so confused here.

I've included a redacted version of the script as it currently exists below. Please let me know if you see anything that I've missed.

Start-Transcript -Path [Transcript path]\$($date)_AD_Device_Cleanup_Log.csv $devices = Get-Content -Path [Source file path]\$($date)_Stale_AAD_Devices.csv foreach ($device in $devices){ Remove-ADComputer -Identity $device } Stop-Transcript
MotoX80 36,291 Reputation points

2023-01-11T15:18:34.4433333+00:00
There is no $date variable. And the transcript is not in csv format. Do it like this with the log on the C drive:

Start-Transcript -Path "c:\Logs\" + (Get-Date -Format 'yyyyMMdd-HHmmss') + "_AD_Device_Cleanup_Log.txt" "AD Cleanup Started - " + (Get-Date)

Is your [Source file path] on a mapped network drive? If so, use the UNC path (\ServerName\ShareName\FolderName) instead of the drive letter.

The task scheduler impersonates the user, it doesn't do a full desktop logon where drives get mapped.
Maranya, Damon 326 Reputation points

2023-01-11T15:34:57.37+00:00

The missing date variable shouldn't make a difference. It should just create the file without the date prefix. But the file type in the transcript line could definitely be causing an issue. So, thanks for spotting that.

After correcting the file type and running the task again, there is still nothing present in the log destination. I've also added to date variable just to make absolutely sure that isn't the issue. But no luck there either.

The source file is not on a network share. All script files, log destinations, and source files are local to the server running the script.
MotoX80 36,291 Reputation points

2023-01-11T15:46:41.5+00:00
Create a bat file that executes Powershell. Echo %date% %time% as the first and last line the .bat so that know when the task starts and ends.

@echo %date% - %time% MyScript is starting. Powershell.exe c:\Scripts\MyScript.ps1 @echo %date% - %time% MyScript is ending.

Then change the scheduled task to execute program "cmd.exe".

In the arguments field set it like this example:

/c C:\Scripts\MyScript.bat 1>>"C:\Scripts\Logs\MyScript-%date:~10,4%-%date:~4,2%%date:~7,2%.log" 2>&1

That will create a daily log file of all executions of the task. That will capture stdout and stderr for programs that get called.
Maranya, Damon 326 Reputation points

2023-01-11T16:57:55.73+00:00

I created the BAT file and changed the arguments line using the templates you provided. But there are still no logs being generated.

I can run the BAT file from the command prompt manually and it works as expected. So, something has to be blocking the task from executing (despite the log data). But I'm not sure what that would be.
MotoX80 36,291 Reputation points

2023-01-11T17:54:23.8033333+00:00

Check the security permissions on log folders. Or set the task to run as the system account and just try it (even if it fails).

Also check your security eventlog for anything related to that account.
Rich Matheisen 47,901 Reputation points

2023-01-11T19:41:45.22+00:00

Maybe it's time to look at the way the scheduled task has been configured?
Maranya, Damon 326 Reputation points

2023-01-13T16:30:40.6333333+00:00

The script outputs a log to the correct location when run manually using the same account that the scheduled task is using. So, I don't think it's a folder permissions issue.

If I run the task, then look through the security event log, I find plenty of events from the service account being used by the task. But they are nearly all Audit Success events.

I see only one Audit Failure (Microsoft Windows Security Event ID 4673) associated with the service account. It is a Sensitive Privilege Use event, and it looks like it appears roughly every 10 minutes. But repeatedly running the task does not produce multiple Audit Failures. So, I don't think that it is directly related to the scheduled task and/or script.

Running the task using the SYSTEM account does return a log file. But there are no events other than the transcript start and transcript stop actions in it. Which is weird, because if it ran all the way through the script, which it would have to do to hit the Stop-Transcript cmdlet. I would expect to see failures from Remove-ADComputer. As the local SYSTEM account does not have the permissions required to make changes to our AD.

The task was created using the same method as the other script that is performing correctly. So, I would expect them both to either work or not work. Also, the task does run when using the local SYSTEM account. It just doesn't complete all of the scripted actions. Which I don't believe it would do if the task configuration was the issue.
Maranya, Damon 326 Reputation points

2023-01-13T16:38:46.3966667+00:00

Okay it looks like I spoke too soon about the log. I forgot to generate a new device list today and it's looking based on the current date, so it didn't have anything to check.

The task says that it ran successfully, and the log does have data in it. It even looks like successful actions as the entries are things like ""Cannot find an object with identity: '-------- ' under: 'DC=domain,DC=local'.", and What if: Performing the operation "Remove" on target "CN=.

So, it looks like that was the issue.
Jade Chen 0 Reputation points

2023-12-05T01:14:20.23+00:00

Thanks @MotoX80 your script just helped me identified the access issue of our scheduler account.

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Share via

PowerShell Script Running successfully in ISE but Failing as a Scheduled Task

1 additional answer

Your answer