Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:
According to the Forescout CounterACT HPS Inspection Engine Configuration Guide Version 10.8, when the Endpoint Remote Inspection method is set to "Using MS-WMI," scripts are run using WMI, but they may not be run interactively using this method.
MS-WMI Script Execution:
According to the HPS Inspection Engine guide:
"When Remote Inspection uses MS-WMI, run scripts with
MS-WMI – note that interactive scripts are not supported by WMI on all Windows endpoints. Functionality that relies on interactive endpoint scripts is not implemented when you choose this option. For example, the Start Antivirus and Update Antivirus actions require interactive scripts to manage some antivirus packages."
Interactive Script Limitations with WMI:
According to the documentation:
"WMI does not support interactive scripts (such as scripts that support Guest Registration and other HTTP-based actions) on some Windows endpoints."
How WMI Scripts Are Run:
According to the documentation:
When using WMI for script execution:
Background Scripts - Most background scripts can run via WMI
Interactive Scripts - NOT supported by WMI on all endpoints
Workaround for Interactive Scripts - CounterACT uses:
fsprocsvc service (fsprocsvc.exe) - For interactive script support
Microsoft Task Scheduler - Alternative for interactive scripts
WMI vs. Other Methods:
According to the documentation:
Method
Interactive Scripts
Limitations
MS-WMI
Not supported on all endpoints
Limited to background scripts
fsprocsvc
Supported
Service must be running
Task Scheduler
Not on Vista/7
Legacy OS limitations
Script Execution Flow with MS-WMI:
According to the documentation:
"CounterACT runs most background scripts using WMI. WMI does not support interactive scripts (such as scripts that support Guest Registration and other HTTP-based actions) on some Windows endpoints. CounterACT uses the fsprocsvc service or Microsoft Task Scheduler to run interactive scripts on these endpoints."
Why Other Options Are Incorrect:
A. Using Task Scheduler but with limitations - Task Scheduler is an ALTERNATIVE to WMI, not what MS-WMI uses
B. Using WMI, which will allow interactive scripts - Incorrect; WMI does NOT allow interactive scripts
C. Using RRP, which will allow interactive scripts - RRP is Remote Registry Protocol, not the script execution method with MS-WMI
E. Using fsprocserv.exe, but scripts may not be run interactively - fsprocserv.exe (fsprocsvc) DOES support interactive scripts; it's used as an alternative to overcome WMI limitations
Referenced Documentation:
CounterACT Endpoint Module HPS Inspection Engine Configuration Guide v10.8 - Script Execution Services section
When Remote Inspection uses MS-WMI, run scripts with
About MS-WMI
