New Member.
1965 views

ZCM Agent 11.3.x - Remote Management - Windows User Variable

I noticed this back during the initial deployment of 11.3.1, however have not had a chance to comeback to it. Now we are at 11.3.2 and the issue seems to still be.

On login we have a script that runs via a bundle it tracks user, date, time, computer login info to 2 locations, one on the local workstation to a hidden folder and 2 on the network.....

It looks like this in the log file

"pwolfe" , "192.168.x.x" , "LPTP-PWOLFE" , "Tue 02/03/2015" , "11:44:20.05"

What I have noticed is if someone uses ZRM (Zen Remote Management) to manage the workstation / shadow a user for help or any other such thing...the next logon on the box will look like this

"LPTP-PWOLFE$" , "192.168.x.x" , "LPTP-PWOLFE" , "Tue 02/03/2015" , "11:44:20.05"

Notice the user variable went from the username to the computer name with a dollar sign. I would say it could be the script, however see below it works fine with the old agent installed.

If you reboot the computer its fine, you can login and out time after time and it will display correctly. However if someone remote manages the computer it is broke until the next restart.

here is the script that runs:

for /f "Tokens=2 Delims=[]" %%i in ('ping -4 -n 1 "%computername%"') do set IP=%%i
Echo "%username%" , "%IP%" , "%ComputerName%" , "%date%" , "%Time%" >>"\\192.168.x.x\support\utilities\logfiles\IPaddressLog.txt"
Echo "%username%" , "%IP%" , "%ComputerName%" , "%date%" , "%Time%" >>"C:\Utilities\IPaddressLog.txt"


This is being called as a launch item under a user run bundle, it is set to run as logged in user.

This is not happening on the older 11.2.4 separate Zone / server setup that is still in use for the majority of people. Just on the newer 11.3.x environment.

If I remove the 11.3.x agent and install the 11.2.4 agent and point it to the old environment / server it works fine.


Any ideas?


Thanks,
Patrick
Labels (2)
0 Likes
6 Replies
Highlighted
Micro Focus Expert
Micro Focus Expert

Re: ZCM Agent 11.3.x - Remote Management - Windows User Vari

MCCFL_MLA;2346032 wrote:
I noticed this back during the initial deployment of 11.3.1, however have not had a chance to comeback to it. Now we are at 11.3.2 and the issue seems to still be.

On login we have a script that runs via a bundle it tracks user, date, time, computer login info to 2 locations, one on the local workstation to a hidden folder and 2 on the network.....
It looks like this in the log file
"pwolfe" , "192.168.x.x" , "LPTP-PWOLFE" , "Tue 02/03/2015" , "11:44:20.05"
What I have noticed is if someone uses ZRM (Zen Remote Management) to manage the workstation / shadow a user for help or any other such thing...the next logon on the box will look like this
"LPTP-PWOLFE$" , "192.168.x.x" , "LPTP-PWOLFE" , "Tue 02/03/2015" , "11:44:20.05"
Notice the user variable went from the username to the computer name with a dollar sign. I would say it could be the script, however see below it works fine with the old agent installed.
If you reboot the computer its fine, you can login and out time after time and it will display correctly. However if someone remote manages the computer it is broke until the next restart.
here is the script that runs:

for /f "Tokens=2 Delims=[]" %%i in ('ping -4 -n 1 "%computername%"') do set IP=%%i
Echo "%username%" , "%IP%" , "%ComputerName%" , "%date%" , "%Time%" >>"\\192.168.x.x\support\utilities\logfiles\IPaddressLog.txt"
Echo "%username%" , "%IP%" , "%ComputerName%" , "%date%" , "%Time%" >>"C:\Utilities\IPaddressLog.txt"

This is being called as a launch item under a user run bundle, it is set to run as logged in user.
This is not happening on the older 11.2.4 separate Zone / server setup that is still in use for the majority of people. Just on the newer 11.3.x environment.
If I remove the 11.3.x agent and install the 11.2.4 agent and point it to the old environment / server it works fine.
Any ideas?

Thanks,
Patrick



What happens if you create a Shortcut to this bundle and run it manually after the desktop is up and active? (after a RC session that messes stuff up?)
What happens if you create a bundle that runs "cmd.exe" as logged on user and run it manually while this other bundle is having issues? (type "set" from the cmd session....)
--
Please give a hearty thumbs up to any post you find helpful!
To find articles by Craig Wilson simply follow the link: Craig Wilson's Tips!
0 Likes
Highlighted
New Member.

Re: ZCM Agent 11.3.x - Remote Management - Windows User Vari

CRAIGDWILSON;2346111 wrote:
What happens if you create a Shortcut to this bundle and run it manually after the desktop is up and active? (after a RC session that messes stuff up?)
What happens if you create a bundle that runs "cmd.exe" as logged on user and run it manually while this other bundle is having issues? (type "set" from the cmd session....)


Thanks Craig,

I finally got some time to look at this again.

It appears on the first logon to a computer it runs correctly, if a Remote Management session takes place and once logged off and a log in is initiated you get the incorrect information. If you run the application from the Zen App Window it displays correctly. If you reboot the computer it works as expected for the first logon and then stops working if a remote session is initiated.


3 Straight logons, the 4th entry is when I ran it manually from the zen app window:

"pwolfe" , "192.168.30.75 " , "TDLARM280-50125" , "Tue 03/03/2015" , "14:53:33.77"
"TDLARM280-50125$" , "192.168.30.75 " , "TDLARM280-50125" , "Tue 03/03/2015" , "14:54:51.09"
"TDLARM280-50125$" , "192.168.30.75 " , "TDLARM280-50125" , "Tue 03/03/2015" , "14:57:24.29"
"pwolfe" , "192.168.30.75 " , "TDLARM280-50125" , "Tue 03/03/2015" , "14:58:22.51"


Here is the "Set" CMD

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\pwolfe\AppData\Roaming
CommonProgramFiles=C:\Program Files\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=TDLARM280-50125
ComSpec=C:\Windows\system32\cmd.exe
DEFLOGDIR=C:\ProgramData\McAfee\DesktopProtection
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\pwolfe
LOCALAPPDATA=C:\Users\pwolfe\AppData\Local
LOGONSERVER=\\TDLARM280-50125
NUMBER_OF_PROCESSORS=4
NWLANGUAGE=ENGLISH
NWUSERNAME=pwolfe
OS=Windows_NT
Path=C:\ProgramData\Oracle\Java\javapath;C:\Program Files (x86)\Intel\iCLS Clien
t\;C:\Program Files\Intel\iCLS Client\;C:\Windows\system32;C:\Windows;C:\Windows
\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Inte
l\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Mana
gement Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management En
gine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Comp
onents\IPT;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\Progra
m Files (x86)\Novell\ZENworks\bin;C:\Program Files (x86)\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 58 Stepping 9, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=3a09
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PROMPT=$P$G
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\pwolfe\AppData\Local\Temp
TMP=C:\Users\pwolfe\AppData\Local\Temp
USERDOMAIN=TDLARM280-50125
USERNAME=pwolfe
USERPROFILE=C:\Users\pwolfe
VSEDEFLOGDIR=C:\ProgramData\McAfee\DesktopProtection
windir=C:\Windows
WINDOWS_LOGIN=0
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
ZENWORKS_HOME=C:\Program Files (x86)\Novell\ZENworks
0 Likes
Highlighted
New Member.

Re: ZCM Agent 11.3.x - Remote Management - Windows User Vari

Anybody have an alternative idea to test?
0 Likes
Highlighted
Absent Member.
Absent Member.

Re: ZCM Agent 11.3.x - Remote Management - Windows User Vari

We created a file called audit7.bat and stored it on the network where everyone has read access. We also stored curl.exe where everyone has read access. We then added it to the edirectly logon script. It contains the following:

@echo off

REM Get Ip Address Only
FOR /F "TOKENS=3-6 DELIMS=.:( " %%A IN (
'IPCONFIG ^| FINDSTR /c:"IP A" /c:"IPv4 A"'
) DO "\\SERVER\leadata01\audit\curl.exe" -s -d "user=%user%&ipaddr=%%A.%%B.%%C.%%D&ctext=%ctext%&computername=%computername%&action=LogOn" http://inv.DOMAINAME.net/useraudit/addrecord.php


exit


addrecord.php looks like this.

<html>
<body>
<?php
require("useraccess.php");
mysql_select_db('DATABASENAME');
//Set Variable $query to the MYSQL command
$sql = "INSERT INTO DATABASENAME (user, ctext, ipaddr, computername, date, time, action)
VALUES
('$_POST[user]','$_POST[ctext]','$_POST[ipaddr]','$_POST[computername]',NOW(),NOW(),'$_POST[action]')";

if (!mysql_query($sql))
{
die('Error: ' . mysql_error());
}
echo "1 record added";

?>


Username: <?php echo $_POST["user"]; ?><br />
Context: <?php echo $_POST["ctext"]; ?><br />
IP Address: <?php echo $_POST["ipaddr"]; ?><br />
Computer Name: <?php echo $_POST["computername"]; ?><br />
Action: <?php echo $_POST["action"]; ?><br />

</body>
</html>


We then created a few other pages to let us search and view this data. It is all stored in a sql database. Its a completely different but very effective way of doing what you're doing. We also store logoffs and shutdowns as well so we can see when someone comes and goes all in a nicely searchable webpage based on Username, Computer Name, or Ip Address and we can specify date ranges as well. If you're interested in changing to a setup like ours let me know and I can get you more info.

Adam Pitt
0 Likes
Highlighted
Micro Focus Expert
Micro Focus Expert

Re: ZCM Agent 11.3.x - Remote Management - Windows User Vari

All I can suggest is an SR.
The more you can reproduce it the better.
--
Please give a hearty thumbs up to any post you find helpful!
To find articles by Craig Wilson simply follow the link: Craig Wilson's Tips!
0 Likes
Highlighted
Micro Focus Expert
Micro Focus Expert

Re: ZCM Agent 11.3.x - Remote Management - Windows User Vari

CRAIGDWILSON;2351107 wrote:
All I can suggest is an SR.
The more you can reproduce it the better.


Note: ZCM Auditing may be useful too, not for the issue, but for some of the tracking you are doing.
--
Please give a hearty thumbs up to any post you find helpful!
To find articles by Craig Wilson simply follow the link: Craig Wilson's Tips!
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.