.NET Runtime Error (System.Runtime)

[freeman]

Hello,

I found an error related to the EXE creation. If the "Disable Script Block logging while running" option has been activated, a crash may occur when the EXE is executed. But only very few clients were affected.

EventLog Error 1026 - .NET Runtime
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.Runtime.InteropServices.COMException
bei ..(UInt32)
bei ...ctor(.)
bei .+.()
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
bei System.Threading.ThreadHelper.ThreadStart()

Solution
After a long search I found the problem. The following file was broken on the affected clients: C:\Windows\System32\GroupPolicy\Machine\Registry.pol
On these clients also the gpedit.msc could not be opened correctly anymore. After deleting the file, the PowerShell EXE was able to run successfully.

To reproduce the behavior, the Registry.pol can be intentionally destroyed with Notepad (add any text to the file and then save it). After that, there will be an unexpected crash when the EXE is executed.
Unfortunately I can not say how it came to the broken Registry.pol file.

Second Problem
A few months ago I had a similar problem. If the EXE is created with the option "Do not execute unless script block logging is disabled", it can also crash. If the "Script Block Logging" is not deactivated on the system, the message "Script Block Logging not disabled, aborting process" is displayed when the EXE is started. However, on some clients the message was not displayed and an unexpected error occurred during execution. I've found that one of the following folders is missing on the affected clients:
C:\Windows\System32\GroupPolicy\Machine
C:\Windows\System32\GroupPolicy\User

If one of the two folders is missing, the EXE crashes simply without display a warning message. However, the error does not occur when the EXE is started as an administrator. In this case, the missing folders are created automatically. Once the folders are present, the warning message is displayed with a user without admin rights and the EXE doesn't crash.

Because of these two issues, we have already reinstalled Windows because we could not find the error. If you know the behavior, it is not a big deal to fix the problem with the affected clients, but it would be nice if the behavior is fixed.

Thank you.

[Olga_B]

Hello,

Thanks for reporting the issue. We are investigating this and will update you as soon as we have more information.

Could you clarify what is setting in Packager Setting for Output Setting/Alternate Credentials/Run Mode?

[freeman]

I use the following settings in each case.

Output Settings
Manifest Creation: Embed a default manifest
Run Mode: Current user

Execution Restrictions
Do not execute unless Script Block logging is disabled
Disable Script Block logging while running (Requires elevated admin privileges)

[Alexander Riedel]

I’ll see if we can add some additional checks. The folders we can definitely check, just need to see how that interprets as status.