Applications Systems

Cannot run specific exe files from system32 folder in SAM Powershell Monitor component

This article describes an issue where you cannot run specific .exe files from the system32 folder using the SAM Powershell Monitor component.

First published date

6/4/2019 2:46 PM

Last published date

6/29/2020 5:22 AM

Overview

If you are using SAM Powershell Monitor component and try to call a specific .exe file from the windows system32 folder such as Tftp.exe or Telnet.exe then it may return an error message like:
 
The term 'C:\Windows\System32\TFTP.EXE' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again
 
To determine what applications beginning with t are found using this Powershell monitor, you can first paste into Powershell component monitor a wildcard for the first character such as t*.exe.
$dir = dir c:\windows\system32\t*.exe
Write-host "Message: $dir"
Write-host "Statistic: 0"

Result:
C:\windows\system32\takeown.exe
C:\windows\system32\TapiUnattend.exe 
C:\windows\system32\taskkill.exe 
C:\windows\system32\tasklist.exe 
C:\windows\system32\Taskmgr.exe 
C:\windows\system32\tcmsetup.exe 
C:\windows\system32\TCPSVCS.EXE 
C:\windows\system32\tdlrecover.exe 
C:\windows\system32\ThumbnailExtractionHost.exe 
C:\windows\system32\timeout.exe 
C:\windows\system32\TokenBrokerCookies.exe 
C:\windows\system32\TpmInit.exe 
C:\windows\system32\tracerpt.exe 
C:\windows\system32\TRACERT.EXE 
C:\windows\system32\tscon.exe 
C:\windows\system32\tsdiscon.exe 
C:\windows\system32\tsecimp.exe 
C:\windows\system32\tskill.exe 
C:\windows\system32\TSTheme.exe 
C:\windows\system32\TsWpfWrp.exe 
C:\windows\system32\typeperf.exe 
C:\windows\system32\tzutil.exe

As you can see above, the TFTP is indeed missing.

Product section

Server Application Monitor

Cause

By default .NET apps run as 32 bit and they won't see the files in C:\Windows\System32, they'll see the files in C:\Windows\SysWOW64.

Resolution

  1. Change the template to x64 polling method:
  2. Edit the Application
  3. Expand Advanced, and in the Platform to run polling job on the field, change the value to x64
  4. ​​​​​​​If you run the script again you shall see the application is now present.

C:\windows\system32\tabcal.exe 
C:\windows\system32\takeown.exe 
C:\windows\system32\TapiUnattend.exe 
C:\windows\system32\taskhostw.exe 
C:\windows\system32\taskkill.exe 
C:\windows\system32\tasklist.exe 
C:\windows\system32\Taskmgr.exe 
C:\windows\system32\tcmsetup.exe 
C:\windows\system32\TCPSVCS.EXE 
C:\windows\system32\tdlrecover.exe 
C:\windows\system32\telnet.exe 
C:\windows\system32\TFTP.EXE 
C:\windows\system32\ThumbnailExtractionHost.exe 
C:\windows\system32\TieringEngineService.exe 
C:\windows\system32\timeout.exe 
C:\windows\system32\TokenBrokerCookies.exe 
C:\windows\system32\TpmInit.exe 
C:\windows\system32\tpmvscmgr.exe 
C:\windows\system32\tpmvscmgrsvr.exe 
C:\windows\system32\tracerpt.exe 
C:\windows\system32\TRACERT.EXE 
C:\windows\system32\tscon.exe 
C:\windows\system32\tsdiscon.exe 
C:\windows\system32\tsecimp.exe 
C:\windows\system32\tskill.exe 
C:\windows\system32\TSTheme.exe 
C:\windows\system32\TSWbPrxy.exe
C:\windows\system32\typeperf.exe 
C:\windows\system32\tzsync.exe 
C:\windows\system32\tzutil.exe

  1. You shall now be able to submit the changes to the template and the script will execute the program as expected.