Cisco AMP can potentially block PowerShell scripts from the MID Server host, affecting Discovery and the Upgrade process. - Support and Troubleshooting

Cisco AMP can potentially block PowerShell scripts from the MID Server host, affecting Discovery and the Upgrade process. Issue It seems the MID Server can be affected if the host has the Cisco AMP service running. It can affect the Discovery process, for example, giving the following error messages when running a Windows Discovery:

"Active, couldn't classify: No WMI connection, now finished."

Release All

Cause Check if Cisco AMP is running on the MID Server host. If it is, check the Agent logs from the MID Server. If you can find a similar log message:

09/28/21 13:45:17 (231) commons-pool-EvictionTimer SEVERE *** ERROR *** Exception during executeCommand but will not keep PowerConsole in busy state&#13; java.lang.IllegalStateException: Power console has been closed.&#13; at com.service_now.mid.win.powershell.api.PowerConsole.executeCurrentCommand(PowerConsole.java:267)&#13; at com.service_now.mid.win.powershell.api.PowerConsole.executeCommand(PowerConsole.java:202)&#13; at com.service_now.mid.win.powershell.api.PowerConsole.execute(PowerConsole.java:174)&#13; at com.service_now.mid.win.powershell.api.APowershellSession.executeWithoutResultExtraction(APowershellSession.java:366)&#13; at com.service_now.mid.win.powershell.api.APowershellSession.execute(APowershellSession.java:346)&#13; at com.service_now.mid.win.powershell.api.APowershellSession.execute(APowershellSession.java:334)&#13; at com.service_now.mid.win.powershell.api.LocalPowerShellSession.close(LocalPowerShellSession.java:48)&#13; at com.service_now.mid.win.powershell.api.PowerShellConnectionPoolFactory.destroyObject(PowerShellConnectionPoolFactory.java:33)&#13; at com.service_now.mid.win.powershell.api.PowerShellConnectionPoolFactory.destroyObject(PowerShellConnectionPoolFactory.java:18)&#13; at org.apache.commons.pool2.impl.GenericKeyedObjectPool.destroy(GenericKeyedObjectPool.java:1076)&#13; at org.apache.commons.pool2.impl.GenericKeyedObjectPool.evict(GenericKeyedObjectPool.java:962)&#13; at org.apache.commons.pool2.impl.BaseGenericObjectPool$Evictor.run(BaseGenericObjectPool.java:1036)&#13; at java.base/java.util.TimerThread.mainLoop(Timer.java:556)&#13; at java.base/java.util.TimerThread.run(Timer.java:506)&#13;

This is most likely related to the Cisco AMP service blocking the PowerShell to execute. It was observed this can occur randomly and for different/specific devices.

The Cisco AMP can also affect a MID Server upgrade. For that, you can check KB0827747 and KB0867749.

Resolution As Cisco AMP is a third-party application, the solution is to make sure the Cisco AMP is disabled for relief. Also, check with Cisco AMP team to add an exception for Discovery/PowerShell scripts similar to what is done for the upgrade (KB0867749).

There's a Cisco Community post about PowerShell issues with Cisco AMP and tips to overcome this: https://community.cisco.com/t5/endpoint-security/unable-to-start-powershell-or-run-any-scripts-due-to-amp-all/td-p/4394548