Getting Data In

When trying to run a PowerShell script with New-PSDrive and PSCredentials, why am I getting the following error?: "A specified logon session does not exist. It may already have been terminated"

Path Finder

I have Windows Server 2008 R2 SP1.

I'm able to run a ps1 script with Get-Process just fine.

But, when I try to use New-PSDrive with PSCredentials, I get an error. I tried to google and got some references to remote execution policies etc (for example: Enable-WSManCredSSP Server and Enable-PSRemoting) and I tried to enable those as well, but it did not help.

As far as I have understood, the Splunk forwarder is running a 'wrapper' script from splunk_home/bin/splunk-powershell.ps1, which has a ref:

this script is launched with the following command from splunk-powershell.exe:

powershell.exe -command "& {get-content "C:\Users\AppData\Local\Temp\input.tmp" | "c:\splunk_build\bin\splunk-powershell.ps1" }"

I'm wondering is there any way to manually mimic the forwarder execution from the cmd with some proper inputs?

My configs are below:


    script = . "$SplunkHome\etc\apps\myapp\scripts\getCIFSUsage.ps1"
    schedule = 0 * * * * ?
    sourcetype = CIFSUsage
    index = sandbox


$User = "looser"
$PWord = ConvertTo-SecureString -String "verystrongandlongfoobarpwdhere" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $User, $PWord
New-PSDrive -Name X -PSProvider FileSystem -Root \\cifs-server1\mount -Credential $Credential -Persist | Select-Object Used,Free
# Disconnect the mount
Remove-PSDrive X


ERROR User script exception: : A specified logon session does not exist. It may already have been terminated
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...