BRU failing in silent mode randomly

[DomazinUS]

Hi, first of all, thanks for this amazing tool! But recently I started having issues, BRU is failing randomly for some computers in silent mode and I'm not sure why. They are all Dell computers running Windows 10 Enterprise. For some computers it runs fine and for others I get this:

PS>TerminatingError(): "The pipeline has been stopped."

TerminatingError(): "The pipeline has been stopped."
TerminatingError(): "The pipeline has been stopped."
TerminatingError(): "The pipeline has been stopped."

The error above seems to be random, but I can provide full logs if you want. The script is running in silent mode, admin access, not sure what's happening. I'm using it to remove Dell bloatware only, nothing else, as I said, it works fine for some computers, but not for others with identical setup. Do you have any idea on how I can mitigate this problem? Thanks!

[arcadesdude]

Thanks! Yes please send full logs when it is failing and how you are running or where it is being run from.

[DomazinUS]

I'm deploying it via Intune, all it is your original script with a simple command line that you can check in the logs. I'm attaching 3 logs, two from the same machine that failed at two different points and another one from another machine. Thank you very much!

Bloatware-Removal-10-aug-2022-07-53(DESKTOP-978Q6M3).log
Bloatware-Removal-11-ago-2022-14-55(DESKTOP-7TT0LQ3).log
Bloatware-Removal-11-ago-2022-08-15(DESKTOP-7TT0LQ3).log
.

[arcadesdude]

Can you also send logs from the endpoint from c:\programdata\microsoft\intunemanagementextension\logs please?

[DomazinUS]

Sure! At the moment, I only have access to the machine which I sent the 2 logs before. Please find the logs on the attachments :)
IntuneManagementExtension-20220810-162526.log
IntuneManagementExtension-20220811-175149.log
AgentExecutor.log
ClientHealth.log

[arcadesdude]

Just researching it now. Might be running as 32bit host and failing something. Can you try to rerun the job but have Intune set in script settings to run script in 64 bit Powershell Host to Yes?

[DomazinUS]

The problem is, I'm deploying it as a Windows app (Win32), not as a script because the script option won't let me provide any command line for it, only run the PS1 file. Would love to use the script option if I could set the parameters and applications to remove directly on the PS1 file. Not sure how to do that, I'm not very experienced with PS.

[arcadesdude]

This should help:

https://www.anoopcnair.com/intune-win32-app-deploy-system32-vs-syswow64/

Can you change your command line as above to force it to use 64bit context?

[DomazinUS]

Cool! I have updated my command line on Endpoint Manager Admin Center with the command "%systemroot%\sysnative\cmd .exe" /c. It's looking like this now: "%systemroot%\sysnative\cmd .exe" /c "install.cmd"

I'll test it and report with feedback as soon as possible. Thank you very much!

[arcadesdude]

Hope it helps the random pipeline terminations. If it does solve it I'll update the readme to include a section on running this from Intune. If it doesn't then we can look further, maybe try it without the restore point option and make sure you have no other automation going on (like reboots) during the time scripts execute that could cause it to exit like that.

[arcadesdude]

If the pipeline terminations keep happening it also might be AV (like the one baked into Dell SupportAssist).

[DomazinUS]

Hi, sorry for the late response, but the testing took a bit of time. Unfortunately, the new command line doesn't seem to make a difference, I'm still getting some random pipelines terminations. I'm going to try your suggestion of skipping the restore point creation, it doesn't seem to be necessary for my needs. I'll keep you updated and thanks again!

[arcadesdude]

Ok if it keeps happening then I suspect the AV is killing it. You could also run in GUI mode to see what happens?

[DomazinUS]

The GUI mode seems to work better, the problem is that we need to run in silent mode because we want no end user interaction at all because otherwise it would be a real mess. I'm talking about 1000+ devices with users potentially removing things they are not suppose to remove hehe

[arcadesdude]

Right but the point of GUI mode is to determine what is killing the pipeline. Is there AV doing it? Like SupportAssist? Procmon can record stuff going on if you can repeat it then it might be possible to figure out what is going on to fix it.

…

On Wed, Aug 17, 2022, 9:59 AM DomazinUS ***@***.***> wrote: The GUI mode seems to work better, the problem is that we need to run in silent mode because we want no end user interaction at all because otherwise it would be a real mess. I'm talking about 1000+ devices with users potentially removing things they are not suppose to remove hehe — Reply to this email directly, view it on GitHub <#18 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADMOAUXBL5WP5TUY574LUQ3VZTV4NANCNFSM56L6SNDA> . You are receiving this because you were assigned.Message ID: ***@***.***>

[arcadesdude]

Another thought is if you're doing this with autopilot then it starts to run and the end user powers off the device that could kill it.

[arcadesdude]

closing due to no response, unable to replicate