Run scripts on devices and release them

What it is for

Scripts do in one step on many devices what would otherwise need a session: restart a service, clean up disk space, read out a value. They are in the console's library, are signed and only run on devices they are released for. This page shows the way from the script to the result. In the console an access is called tenant.

What you need

• Role: technician or higher to run; tenant administrator or higher to create and release.
• Cloud: the service "Scripts" (paid Cloud; not in Free). Own relay: always.
• Access: the rule Allow running scripts must not be Off (G3).
• Device: online, and script execution must be allowed on the device — device setting Remote command line via viewer (exec) set to On. It is off out of the box; the console offers to enable it when you run a script (see step 4).
• Script types: PowerShell and Batch for Windows, Bash for Linux and macOS. The client for Windows XP runs no scripts.

How to do it

Step 1: Create or pick a script

1. Sidebar Scripts & packages → tab Scripts.
2. Pick an existing script — or New script. In the dialog Edit script: under Master data Name *, Type (PowerShell, Batch (cmd), Bash), Description, Category, Timeout (sec.); under Script code the command; under Parameters values that are asked for at start.
3. Save. The relay signs the script; the device checks the signature before every run.

Step 2: Release — where may it run?

A script only runs where it is released:

• For an access: drag the script in the list onto the access in the tree on the left. A right click on the script removes the assignment again.
• For single devices or groups: in the script under Availability & assignment → Release to specific devices / groups → Select devices … or enter a tag.
• For all accesses: tick ALL in the same section.

Step 3: Decide on a question on the device (optional)

Under Behaviour tick Endpoint confirmation required — the user at the device must approve the run. Then the device asks before every run of this script.

Step 4: Run

1. Devices → right-click the device → Run & deploy → Run script….
2. Choose the script, Next.
3. Fill in the parameters. Preview shows the final command line without sending anything.
4. If it says "Script execution is not enabled on the target device — the run would be rejected.": click Enable now. This switches on the device setting Remote command line via viewer (exec) for this device; the device briefly signs in again.
5. Run.

For several devices: choose further devices in the dialog. All runs are listed afterwards under Runs.

How you know it worked

• For one device the dialog shows exit code, duration and output under Result.
• Sidebar Runs → List: every run with device, time and result; a click opens Run details. Analysis shows the result values of a script per device as a table.
• In the device's details under Scripts & packages you see what ran there.

What the other side sees

If the script or the device requires a question, the person at the device sees the script's name and content and must allow it. On the device the switch for this is called Skript-Ausführung bestätigen (confirm script execution, under Einstellungen › Sicherheit (Settings > Security), on out of the box). It only applies when the program runs with a window on the device; the background service only asks for scripts with the tick from step 3.

Good to know

• There is no four-eyes approval for scripts. The Four-eyes approvals only apply to sessions with devices marked as critical (G3). A script needs no second person — the release here means on which devices it may run and whether the device allows execution.
• What "Remote command line via viewer (exec)" opens: the same setting allows on the device scripts from the console, start buttons with scripts, ending processes (G10) and the command line in a session (E29). Only switch it on for devices where you want that.
• A script changed between saving and running does not run — the device checks content and signature.
• The library ships ready-made scripts for start buttons (block USB, repair printer …); they are unmeasured on the device (G13).
• Several steps in a row, with waiting and conditions: workflows (G8).

If it does not work