Security Compliance
ARM script from template fails to run
This article will explain the issue and solution when the script which is set to run from the template fails to execute.
First published date
7/6/2022 2:06 PM
Last published date
2/11/2025 7:43 PM
Overview
Following this article you will be able to solve the issue with the script failing to execute with one of the error messages shown below in the logs:
- __The runtime file "C:\ProgramData\protected-networks.com\8MAN\scripts\analyze\example.ps1" cannot be found
- ] <>c__DisplayClass50_0.<StartExecuteJob>b__0(Object param): END -> Result: Failed (Failed to duplicate user token for user 8man-demo.local\sa-8man. Error code 1346) (2293 ms)
Product section
Access Rights Manager
Cause
The cause for the error:
__The runtime file "C:\ProgramData\protected-networks.com\8MAN\scripts\analyze\example.ps1" cannot be found
is that the script file is not available on the collector on which the AD scan is set to run.
The cause for the error:
] <>c__DisplayClass50_0.<StartExecuteJob>b__0(Object param): END -> Result: Failed (Failed to duplicate user token for user 8man-demo.local\sa-8man. Error code 1346) (2293 ms)
is that the account set for changes in the related AD Scan configuration contains a dot (.) in the domain part, or if the user set for changes in AD in ARM is not set as a local administrator on the ARM Server machine.
__The runtime file "C:\ProgramData\protected-networks.com\8MAN\scripts\analyze\example.ps1" cannot be found
is that the script file is not available on the collector on which the AD scan is set to run.
The cause for the error:
] <>c__DisplayClass50_0.<StartExecuteJob>b__0(Object param): END -> Result: Failed (Failed to duplicate user token for user 8man-demo.local\sa-8man. Error code 1346) (2293 ms)
is that the account set for changes in the related AD Scan configuration contains a dot (.) in the domain part, or if the user set for changes in AD in ARM is not set as a local administrator on the ARM Server machine.
Resolution
In the situation when we have an AD Scan that uses multiple collectors for a scan, we need to ensure that the script is to be found on every collector which is configured.
Regarding the second possible cause the solution is to set the account for changes in the related AD scan configuration in ARM Config----Scans as 8man-demo\sa-8man instead of 8man-demo.local\sa-8man as illustrated in the example below. The problem here is the dot (.) in the domain part. This is something we are working on to fix.
The user highlighted above must be set as a local administrator on the ARM Server machine.
- The other solution is to use only one collector and have the script there.
- To check which collector you have configured for the AD scan, you will need to follow the steps:
- Open ARM Config client
- Open scans
- Find the AD Scan and expand the options
Regarding the second possible cause the solution is to set the account for changes in the related AD scan configuration in ARM Config----Scans as 8man-demo\sa-8man instead of 8man-demo.local\sa-8man as illustrated in the example below. The problem here is the dot (.) in the domain part. This is something we are working on to fix.
The user highlighted above must be set as a local administrator on the ARM Server machine.