execute script | PeteNetLive

KB ID 0001417

Problem

If you’ve arrived here, you are trying to run a script, and you cant;

[box]PS C:\Users\{User-name}> .\{script-name}.ps1
.\{script-name} : File C:\Users\{User-name}\{script-name} cannot be loaded because running scripts is
disabled on this system. For more information, see about_Execution_Policies at
http://go.microsoft.com/fwlink/?LinkID=135170.
At line:1 char:1
+ .\{script-name}
+ ~~~~~~~~~~~~~~~~~~
+ CategoryInfo : SecurityError: (:) [], PSSecurityException
+ FullyQualifiedErrorId : UnauthorizedAccess
PS C:\Users\\{User-name}>[/box]

Solution

Execute the following command;

[box]Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass[/box]

Then run your script.

THIS WILL ONLY WORK: While that PowerShell window is open, so don’t close it if you are running a lot of scripts.

I Want to Always be Able to Run Scripts?

OK you can either change the ‘Scope’ of that last command, from ‘Process’ to to ‘CurrentUser’, or ‘CurrentMachine’.

Process: The execution policy affects only the current Windows PowerShell process.
CurrentUser: The execution policy affects only the current user.
LocalMachine: The execution policy affects all users of the computer.

Or you can simply change the policy ‘Globally’;

[box]Set-ExecutionPolicy {Value}[/box]

Possible values are;

Restricted: Does not load configuration files or run scripts. Restricted is the default execution policy.
AllSigned: Requires that all scripts and configuration files be signed by a trusted publisher, including scripts that you write on the local computer.
RemoteSigned: Requires that all scripts and configuration files downloaded from the Internet be signed by a trusted publisher.
Unrestricted: Loads all configuration files and runs all scripts. If you run an unsigned script that was downloaded from the Internet, you are prompted for permission before it runs.
Bypass: Nothing is blocked and there are no warnings or prompts.
Undefined: Removes the currently assigned execution policy from the current scope. This parameter will not remove an execution policy that is set in a Group Policy scope.

Problem

I’ve seen this asked a lot in forums, and it came up on EE again today. I’ve never had to set this up in the past, but I’ve posted the links to the correct Cisco articles when people have asked.

After the question was asked again today, I thought I’d take the time to write a decent article on how to do it.

Why would you want to do this? You might want to map/reconnect a mapped drive, or perform anything thats usually acheivable with a login script.

Solution

1. First make sure you have your script, I’m using a simple batch file but you can also use .vbs. As you can see my script just maps a drive (s:) to a network share on the machine you are looking at.

Note: I’ve used an IP address rather than a DNS name, there’s nothing wrong with using a DNS name, providing your remote AnyConnect clients are able to resolve that hostname.

Note2: I’m also embedding the username and password in the drive mapping request, This is because my AnyConnect uses LOCAL usernames and passwords on the ASA, so the server wouldn’t be able to authenticate the request.

2. To ’embed’ this script into the firewall, log into the ASDM > Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Customization/Localization > Script > Import > Give it a name > Select ‘Script runs when client connects‘ > Platform = win > Browse Local Files > Locate your batch file > OK > Import Now > OK.

3. The script wont run unless scripts are allowed in the VPN Client Profile > Note: You may, or may not already have a client VPN Profile > Navigate to Configuration > Remote Access VPN > AnyConnect Client Profile > Add (Or skip to Edit if you already have one) > Give the profile a name > Select your AnyConnect Group Policy (If you don’t know, connect with an AnyConnect client, and see what is shown under ‘Group‘) > OK.

4. Edit your policy.

5. Preferences (Part 2) > Tick ‘Enable Scripting‘ > Tick ‘User Controllable‘ (Note: this just lets a user untick enable scripting in their client software) > OK.

6. Save the changes > Apply > File > Save Running Configuration to Flash.

Troubleshooting AnyConnect OnConnect / Logon Scripts

If theres a problem (i.e. it does not work.) Your first task is to make sure the client got the script, it saves it in the following location.

%ALLUSERSPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\Script

Connect your AnyConnect client, then execute each of the commands in the script locally to see why it’s not working.

PeteNetLive

Technology that 'Just Works'

Tag Archives: execute script

PowerShell: Cannot Be Loaded Because Running Scripts is Disabled

Problem

Solution

I Want to Always be Able to Run Scripts?

Related Articles, References, Credits, or External Links