Antivirus blocking PowerShell scripts generated by MID Server during discoveryIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } During discovery, the MID Server generates PowerShell scripts on the fly and executes them via the Java process. Antivirus software detects these dynamically created scripts and blocks the incoming PowerShell sessions from the MID Server, generating alerts. Symptoms<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Antivirus alerts are generated for PowerShell scripts during discovery.Incoming PowerShell sessions from the MID Server are blocked by the antivirus. Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } By design, PowerShell probes create temporary .ps1 scripts under the MID Server temp folder at runtime. Antivirus software flags these dynamically generated scripts because they are created and executed on the fly, rather than being pre-existing files. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } To resolve this issue, configure antivirus exclusions using the process and key values that the MID Server uses during PowerShell probe execution. The following information identifies those values. How PowerShell probe scripts are named For every PowerShell probe that passes a .ps file as the probe parameter, a script is created under the MID Server temp folder using the following naming pattern: <NameOfParameter>.<RandomNumber>.ps1 For example, the probe Windows - JBoss Get jboss-service.xml uses the parameter findjbossservicexml.ps1, which produces the following file at runtime: findjbossservicexml.1031966753134230570.PS1 For every WMIRunner probe, scripts are created using the following pattern, based on the WMI fields defined in the probe: WMI_FetchData_<RANDOMNUMBER>.ps1 Internal scripts also run in parallel under the MID Server temp folder. There is no common naming format across PowerShell probe scripts, WMIRunner scripts, and internal scripts — each follows a different format. The full list of probe parameters that generate .ps files can be found at the following URL (replace <instance-name> with the instance name): https://<instance-name>.service-now.com/discovery_probe_parameter_list.do?sysparm_query=nameLIKE.ps&sysparm_first_row=1&sysparm_view=&sysparm_choice_query_raw=&sysparm_list_header_search=true How the MID Server executes PowerShell scripts For any script run on the MID Server, the execution uses scripts\\PowerShell\\PSScript.ps and passes the file under the temp folder as a parameter to that script. The following example shows the full command structure observed during probe execution: "Process" : "\Device\HarddiskVolume3\ServiceNow\agent\jre\bin\java.exe", ... "Key" : "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe", "KeyScriptModule" : "{ [Console]::OutputEncoding = [Text.UTF8Encoding]::UTF8; Write-Output SNC_PowerShell_PID=$pid; & 'scripts\\PowerShell\\PSScript.ps1' -computer '<target-hostname>' -script 'C:\\Users\\SVC-SN~1\\AppData\\Local\\Temp\\script.4422133186211577577.PS1' 'use_mid_service_account' $false -useCred $true -ismid $false -isDiscovery $true -debug $false -logInfo $false -skipTest $false -executeRemote $false -copyScriptToTarget $false; exit $LASTEXITCODE ", "MountPoint" : "", A second example showing the parameter structure for a named probe: "Key" : "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe", "KeyScriptModule" : "{ [Console]::OutputEncoding = [Text.UTF8Encoding]::UTF8; Write-Output SNC_PowerShell_PID=$pid; & 'scripts\\PowerShell\\PSScript.ps1' -computer '<target-ip>' -script 'C:\\Windows\\TEMP\\findjbossservicexml.1031966753134230570.PS1' -useCred $true -ismid $false -isDiscovery $true -debug $false -logInfo $false -skipTest $false -executeRemote $false -copyScriptToTarget $false; exit $LASTEXITCODE ", Points to consider when configuring antivirus exclusions Consider the following points when configuring the antivirus exclusions: 1. The MID Server runs commands using the process \Device\HarddiskVolume3\ServiceNow\agent\jre\bin\java.exe. 2. The command invoked is scripts\\PowerShell\\PSScript.ps — this script is part of the MID Server installation and is intended to be run by the MID Server process. 3. The parameter -isDiscovery $true is present in every discovery-initiated command, which confirms that discovery is the originating process. Adjust the antivirus configuration to treat the process, key, and script values identified above as trusted, so that scripts matching these patterns are not blocked.