Powershell and exception policy on UF

[jariw]

L.s.,

At our company we deploy the Windows UF on all the vdi machine's. For security reason we make use of the security policy where powershell is prohibited to run.

On a vdi machine with the command Get-ExecutionPolicy -List | Format-Table -AutoSize i get below:

Scope ExecutionPolicy
----- ---------------
MachinePolicy Undefined
UserPolicy Undefined
Process Undefined
CurrentUser Undefined
LocalMachine Restricted

The last part is where the problem is.. it restricts the local system account from executing the scripts in the universal forwarder bin folder.  It gives an error for the splunk-powershell.ps1 script and then consumes a lot of cpu.

What can we do to use the scripts and use the secutiry policy? The policy is a demand in our company, so we can't dump that one.

Thanx in advance..

[jariw]

Hi SinghK

Thanx for the idea, i will look at that., could be the way to go.

But why is the UF calling the splunk-powershell.ps1 script in de bin foder, what is its purpose..

[SinghK]

you can try this :

https://docs.splunk.com/Documentation/Splunk/8.2.4/Data/MonitorWMIdata