Is the Windows agent plugin mk_inventory.vbs broken?

Troubleshooting
1

CMK version:
2.2.0p40 CEE

OS version:
Agent running on Windows Server 2016, 2019 and Windows 11.

Error message:
Msi API Error: ProductsEx,Product,UserSid,Contexts

Description of Problem
I’m using the agent bakery to install the inventory plug-in on our monitored Windows system, however the list of software installed only ever included the Checkmk Agent, and nothing else.

Looking at the agent output shows something like this:

<<<win_wmi_software:sep(0):persist(1743603394)>>>
mk_inventory.vbs(221, 21) Msi API Error: ProductsEx,Product,UserSid,Contexts

The VisualBasic version of ProductsEx doesn’t seem to like the “everyone” SID that is documented in the native C++ method.

This code (based on code in mk_inventory.vbs) demonstrates the problem.

const WI_SID_EVERYONE = "s-1-1-0"
const WI_ALL_CONTEXTS = 7
 
Dim oInstaller : Set oInstaller = CreateObject("WindowsInstaller.Installer")
 
' This gives an error: "Msi API Error: ProductsEx,Product,UserSid,Contexts"
' Dim oProducts : Set oProducts = oInstaller.ProductsEx("", WI_SID_EVERYONE, WI_ALL_CONTEXTS)
 
' This works
Dim oProducts : Set oProducts = oInstaller.ProductsEx("", "", WI_ALL_CONTEXTS)
 
For Each oProduct In oProducts
    WScript.Echo(oProduct.InstallProperty("ProductName"))
Next

Unfortunately, patching the installed version of mk_inventory.vbs doesn’t seem to fix the issue, so I’m a bit lost.

Anyone got any more ideas on how to fix this?

2

Is there anybody for which mk_inventory.vbs is working properly?

3

I can only say that i have no problems with the “mk_inventory.vbs” on my systems at the moment. The range is from 2.2 or older up to current 2.3 versions.

EDIT: i think i found your problem - if the agent is executed with some other user than “Local System” you get no wmi software data. Or?

4

On most Windows 10 endpoint systems its working here with 2.1.0p9 raw.

In a few cases not, but mostly when I reschedule the Check_MK HW/SW Inventory check with at least 4 hours after last check, it’s working afterwards. Then suddenly I got 1500+ inventory items again, instead 25 or so when failing.

It’s not a very resource friendly check and I assume that it sometimes times out.

When I run the script outside of the checkmk agent I do get similar errors:
C:\ProgramData\checkmk\agent\plugins\mk_inventory.vbs(236, 21) Msi API Error: ProductsEx,Product,UserSid,Contexts

5

Feels like I cluelessly played muse for you here … :yum:

6

EDIT: i think i found your problem - if the agent is executed with some other user than “Local System” you get no wmi software data. Or?

The agent is running as “Local System”. Of course, it’s easiest to see the error when I run the plugin as myself, but I’m fairly sure I saw it in the connection tests of a host.

The caching thing makes it hard to debug the problem. Is there a way to see what the plug in is producing when run normally?

I can only say that i have no problems with the “mk_inventory.vbs” on my systems at the moment. The range is from 2.2 or older up to current 2.3 versions.

It used to work for me, through many versions going back years. I recently moved to the enterprise version, but I couldn’t say for sure when it stopped working.

7

We have problems with other windows sections, too. The win_os section is failing on some hosts which is directly produced by the agent. But we currently have no pattern which should give us an idea where to look at. Sometimes it helped to restart the performance indicators, sometimes a reboot of the server did the trick. When other sections fail on wmi methods, the agent doesn’t even reach the mk_inventory-plugin.

1 Like
8

It used to work for me, through many versions going back years. I recently moved to the enterprise version, but I couldn’t say for sure when it stopped working.

I’ve narrowed it down.

Running 2.2.0p37 with plugin version 2.2.0p24 worked.

Running 2.2.0p37 with plugin version 2.2.0p37 didn’t work.

This was probably around the time we switched to the enterprise edition, and started using the agent bakery rules to distribute the plugin.

1 Like
9

It stopped working after updating to 2.2.0p36, so I’d guess the problem is related to “Werk #17196: Crash in during HW/SW inventory on Windows”.

cscript mk_inventory.vbs (as NT Authority/SYSTEM) dumps the full inventory.

<<<win_reg_uninstall:sep(0):persist(1746080397)>>>
Notepad++ (64-bit x64) Notepad++ Team  Notepad++ 8.8
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34438 Microsoft Corporation  {2E15F519-4FDA-4834-B4EE-7EFCE7D8D4EE} 14.42.34438  20250331 1033
Google Chrome Google LLC  {3AC1073B-083C-3A6C-94BE-7339E0B00CD4} 135.0.7049.115  20250423 1033

cmk-agent-ctl.exe dump (as the same user) shows one installed package and then just empty lines, until the next plugin block starts.

<<<win_wmi_software:sep(0):persist(1746080263)>>>
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.42.34438





                       <<<cmk_update_agent_status:sep(0):cached(1745990949,3600)>>>
10

The master branch of the Checkmk source code now contains all formerly VBS Windows agent plugins rewritten in PowerShell including the HW/SW inventory:

You could try to use that as the output format should be the same.

11

The master branch of the Checkmk source code now contains all formerly VBS Windows agent plugins rewritten in PowerShell including the HW/SW inventory

This sounded great, but isn’t working either. I don’t know if there’s an incompatibility, or it’s buggy.

Running it as my own user, I get PowerShell errors. I don’t know how to run it as SYSTEM to see what the output would be in that case. (I’m not allowed to download psexec by our anti-virus.)

12

I checked it at one of my machines and it runs without any error message as an local user. Keep in mind that this user needs admin rights, this is the case also for Local System normally.

1 Like
13

It’s one particular installed package it’s stumbling over.

Get-ItemProperty : Cannot retrieve the dynamic parameters for the cmdlet. The specified wildcard
character pattern is not valid: Redacted Remote Access Jump Client
[xxxxxxx.yyyyyyyyyyy.com-HEXCODE]
At C:\ProgramData\checkmk\agent\local\mk_inventory.ps1:299 char:35

  • … $value = (Get-ItemProperty -Path $subkey.PSPath -Name $var -ErrorAc …
  •             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    • CategoryInfo : InvalidArgument: ( : ) [Get-ItemProperty], ParameterBindingException
    • FullyQualifiedErrorId : GetDynamicParametersException,Microsoft.PowerShell.Commands.GetItemPropert
      yCommand

Same error on line 299 6 times, and one more on line 293.

14

Here’s a patch to escape the square brackets and make it work:

--- mk_inventory.ps1.orig	2025-05-01 13:42:50.987314927 +0100
+++ mk_inventory.ps1	2025-05-01 13:44:08.809481462 +0100
@@ -286,17 +286,19 @@
                 $booleanContent = $false
 
                 foreach ($var in $regVars) {
+                    $escpspath = $subkey.PSPath
+                    $escpspath = $escpspath -replace '([][[])', '`$1' # escape square brackets
                     if ($var -eq "PSChildName") {
                         $value = $subkey.PSChildName
                     }
                     elseif ($var -eq "Language") {
-                        $value = (Get-ItemProperty -Path $subkey.PSPath -Name $var -ErrorAction SilentlyContinue).$var
+                        $value = (Get-ItemProperty -Path $escpspath -Name $var -ErrorAction SilentlyContinue).$var
                         if ($null -ne $value) {
                             $value = $value.ToString()
                         }
                     }
                     else {
-                        $value = (Get-ItemProperty -Path $subkey.PSPath -Name $var -ErrorAction SilentlyContinue).$var
+                        $value = (Get-ItemProperty -Path $escpspath -Name $var -ErrorAction SilentlyContinue).$var
                     }
 
                     if ($null -ne $value -and $value -is [string]) {
15

I’ve submitted a pull request with my fix.

2 Likes
16

So, the PowerShell version, with the fix given above, produces a valid inventory, but Checkmk isn’t picking up the “win_reg_uninstall” section now, so I’m not seeing the complete software inventory.

I wonder if this is an incompatibility, or another bug?

17

TBH I have not checked the changes on the server side.

The Checkmk docu will tell you that the agent must not be newer than the monitoring site. This also applies to agent plugins.

1 Like