Getting Data In

When trying to run a PowerShell script with New-PSDrive and PSCredentials, why am I getting the following error?: "A specified logon session does not exist. It may already have been terminated"

Path Finder

I have Windows Server 2008 R2 SP1.

I'm able to run a ps1 script with Get-Process just fine.

But, when I try to use New-PSDrive with PSCredentials, I get an error. I tried to google and got some references to remote execution policies etc (for example: Enable-WSManCredSSP Server and Enable-PSRemoting) and I tried to enable those as well, but it did not help.

As far as I have understood, the Splunk forwarder is running a 'wrapper' script from splunk_home/bin/splunk-powershell.ps1, which has a ref:

this script is launched with the following command from splunk-powershell.exe:

powershell.exe -command "& {get-content "C:\Users\AppData\Local\Temp\input.tmp" | "c:\splunk_build\bin\splunk-powershell.ps1" }"

I'm wondering is there any way to manually mimic the forwarder execution from the cmd with some proper inputs?

My configs are below:


    script = . "$SplunkHome\etc\apps\myapp\scripts\getCIFSUsage.ps1"
    schedule = 0 * * * * ?
    sourcetype = CIFSUsage
    index = sandbox


$User = "looser"
$PWord = ConvertTo-SecureString -String "verystrongandlongfoobarpwdhere" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $User, $PWord
New-PSDrive -Name X -PSProvider FileSystem -Root \\cifs-server1\mount -Credential $Credential -Persist | Select-Object Used,Free
# Disconnect the mount
Remove-PSDrive X


ERROR User script exception: : A specified logon session does not exist. It may already have been terminated
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...