XML Custom EXE Script error

So the command works fine if you execute it locally?

Sure does. Have tested both x86 and x64 modes of PowerShell

Are you specifying the user in the code, or in the settings for the sensor in PRTG to have it run as local admin?

Also, can you try executing it on the PRTG server with the parameters coded into it for the target machine and user context?

The user for the Unifi side is specified in the script but I have also tested using parameters. Both work when run manually in Powershell command windows but not when run by PRTG

Andre, I'll ask some of my colleagues who are more versed in coding than I am to take a look at this.

Hello Andre,
thank you for your KB-Post and I'm happy to hear that my script works. :)

The error message looks misleading:

Line 138 from the script is basically generating the XML result:

[...]
		  <float>0</float>
		  <mode>Difference</mode>
		  <CustomUnit>Pakete</CustomUnit>
[...]

However, the script has some differences to mine, for example this:

$ValidTLS = [System.Net.SecurityProtocolType]'Tls11,Tls12'
[System.Net.ServicePointManager]::SecurityProtocol = $ValidTLS

In my version of the script I explicitly accept more protocols:

#Define supported Protocols
[System.Net.ServicePointManager]::SecurityProtocol = @("Tls12","Tls11","Tls","Ssl3")

That could be something you can try. Otherwise I'm pretty much out of ideas.

Best Regards,
Luciano Lingnau [Paessler Support]

Hi Luciano,

Thanks for the information. I gave what you suggested a try but still get the same error. I didn't actually expect it to work since that is what is used for communicating with the Unifi controller and when run manually works as expected (even the feedback to the HTTP Push Data sensors).

This really looks like an issue with PRTG and how it interacts with Powershell on Windows 10 when running as a Local System service. I just can't work out what security context PRTG is using since it seems to be ignoring the unrestricted execution policy that has been set.

Is there any additional logging that can be obtained out of PRTG to see what its doing?

Hello Andre,
thank you for your reply.

The best way to have the script run in a specific user context is to configure the sensor to "Use security context of probe service" and then configure the PRTG Probe Service to run with a specific user account (can be done via services.msc). However, this should make little difference since the Powershell script doesn't use Windows Authentication for anything (only Unifi controller credentials).

As for debugging/logs, the "Write EXE result to disk" option is really the only alternative from PRTG's side. The other thing you could try is using Process Monitor (from Sysinternals/microsoft) to find out what happens during the script's execution.

Please keep in mind that as described here, the PRTG Probe Service is a 32-bit application and will use the 32-bit version of powershell, which can have a different configured execution policy. However, if the problem was the execution policy we would usually see that in the log result.

Please let me know how it works out.

Best Regards,
Luciano Lingnau [Paessler Support]

Hello Andre, I'll try my best.

1. PRTG is a 32bit program and uses the 32bit powershell. Keep that in mind whenever you write your own scripts:-)
2. The PRTG Probe runs as LocalSystem or as a username. This user must be able to start a Powershell. One Thing can happen. The PowerShell runs some Kind of "autoexec"-Skript it is in "$Profile" and normally points to something like “C: :\Users\fcarius\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1” Make sure this file exists. (it can be empty). See powershell-authorizationmanager-check-failed
3. Downloads from the Internet or even a UNC-Path are linked to an "Zone" and this can prevent the execution based on your IE Zone Settings. Use your Windows Explorer and check the Properties of the PS1-File is there a Button on the lower right Windows Position to "unlock" the Script ?. Click it to unlock the script.
4. Sometimes you can use Sysinternals Procmon to trace the execution of Probes and their problems.
5. Can you use Notepad and create a simple PS1-File only to send back a result like "0:OK" or a XML. So we should see, that a PS1 File is executed. If that the case then use Notepad again and copy the code to the temporary file and see if it works.

Frank