How to run a script on a device and read the result
Save a script, give it values from variables, run it on a device, and read how it went.
Browse
On this page
How to do it
Open RMM and click Variables. Then click New Variable.
Fill in Key, Label, a type of Text, Number, Yes/No or Secret, and a Scope of Global or Client-specific. The key is the name scripts use, so it cannot change later. A global variable has one value for everyone. A client-specific variable has its own value for each client, set on that client's RMM tab. There is no fallback, so a client with no value fails any run that uses it. To change a scope, make a new variable. Click Create Variable.
Make a password or key a Secret.
Pick the Secret type and type the value. It is stored encrypted and never shown again after you save. Under Allowed consumers, a Secret defaults to Scripts only. Leave the value blank on a later edit to keep the current secret. A tech who writes scripts can see the name of a secret, but not the value. Local admin passwords are still the job of LAPS.
Open RMM, then Scripts, and click New script.
Give it a Name, pick the Interpreter, add a Description and type the Script. Command Prompt scripts can be saved but cannot be run through the signed plane. Tick the destructive box only if the script makes changes that cannot be undone.
Add a parameter to the script.
Click Add parameter. Fill in Name, Label, Type, Required and Default. Point it at a variable, or use Insert variable for a built-in value. The script reads the value as an environment variable. Its name is EZDA_PARAM_ plus the parameter name. Click Create.
Open the device, click Run, and choose Run a saved script.
The box is titled Run a saved script. Pick the script under Script. A secret parameter shows Pick a secret, and only the secret's name is saved with the run. A destructive script asks you to tick that you understand, and needs the destructive-run permission. Click Run on this device. A toast reads Queued with the script name on this device. It runs when the device next checks in.
Open RMM, then Scripts, then Run History, and find your run.
The table is titled Script runs. Search by device or script. Each run shows one status. Waiting: the device has not picked it up yet. Sent: the device has it but has not started. Running: the device said it started. Done: it finished fine. Failed: it ran and came back badly, or the device refused it. Interrupted: the agent stopped midway, such as in a power loss. Expired: the device did not take it in time, usually 60 minutes. Stopped: a tech pressed Stop and the device confirmed. Stop shows only on a run that is Waiting, Sent or Running. Finished runs older than 90 days are removed.
Open a run that did not finish to read what happened.
When a script ran and failed, the detail panel shows the last lines it printed, up to 1,000 characters, with secrets removed. The Values used section shows what the run was given. A Device queue full badge means nothing ran, so wait and run it again. A run that reads Blocked was refused by the device. Usually the security product on that device said no to the agent's script. Nothing ran.
What you will have
- Make a variable that a script can use, including a secret.
- Save a script that reads that variable.
- Run the saved script on one device.
- Read the run status and what to do about each one.
- Know why a run says Blocked or Not delivered.
Why it works this way: How to run a script on a device and read the result
A script runs on any device you manage. There is no client to pick and no step that saves a script to a client.
Nothing is ever pasted into the script text. The portal looks up the value for that device and its client when the run starts.
Every run goes through the signed plane. The device must be approved, with execution on, or it gets nothing to run.
If it did not work: How to run a script on a device and read the result
- A run reads Not delivered - run again: the device never received it, so nothing ran. It is not retried for you, so nothing runs twice. Run it again from the script or the device page.
- A run stops and names a variable and a client: that client has no value for a client-specific variable. Add the value on the client's RMM tab.
- A run reads Secret unavailable: a secret it needs could not be set up. Fix the value in the variable list and run it again.
- The device gets nothing to run: it may be pending or have execution turned off. It must be approved with execution on.
- Change or delete a variable and a script that uses it fails its next run.
- The Blocked filter lists blocked runs, but the Failed filter does not. On an older agent version the Exit column can still say Failed.
Questions this page answers
How do I run a saved script on one device?
Open the device, click Run, choose Run a saved script, pick the script and click Run on this device. It runs when the device next checks in.
How do I give a script a password without pasting it in?
Make a variable of the Secret type. Point a script parameter at it. The script reads it as an environment variable. Its name is EZDA_PARAM_ plus the parameter name.
What do the script run statuses mean?
A run goes from Waiting to Sent to Running, then ends as Done, Failed, Interrupted, Expired or Stopped. Blocked means the device refused to open it.
Why does a script run say Not delivered - run again?
The device never received the run, so nothing ran. It is not retried for you. Run it again from the script or the device page.
Was this helpful?