The script library

The script library holds tested scripts you can run on devices now, at a set time or on a schedule. Tenvara comes with a starter library of built-in scripts for Windows, macOS and Linux (flushing DNS, restarting a service, checking for a pending restart, BitLocker and FileVault status, disk clean-up, local administrator audits and more), and you add your own alongside them.

Every script is signed by your server when it is published, and the agent refuses anything that does not match the signature, so only what is in your library can run.

Open Devices > Scripts. The page opens on the Library tab, beside Runs and Schedules.

Each row shows the script's Category, Language, the platforms it Runs on, whether it works on the Lite agent, whether it is Built in or Ours, its version, and when it last ran and how that went. Filter by Category, Language, Runs on, Works on the Lite agent, Built in or ours or Tags, and use Show archived to see scripts you have archived.

Looking at a script#

Click a script to see it in a panel beside the list, with Run and a link to open its page.

• The header shows the Language, what it Runs on, whether it Runs as System or the signed-in user, when it Stops after, its Category and when it last ran.
• Code shows the version runs use. Pick an older version from the menu to read it.
• Parameters lists the values a technician gives when running it.
• Runs shows its latest runs, with All runs.
• Schedules shows where it runs on its own, with Schedule.
• Versions lists every published version, who published it and its fingerprint.

The ... menu holds Schedule it, Make a copy to change and Archive.

Note: Built-in scripts cannot be edited. Use Make a copy to change to create your own version, which then shows as Ours.

Write a new script#

1. Click New script.
2. Write the script in the editor. Tab indents, Shift+Tab outdents and Cmd+S saves a draft. Type RMM_ for suggestions of the variables every run gets (below).
3. Under About, give it a Name, say What it does (shown in the library and the run dialog), and add a Category and Tags.
4. Under How it runs, choose:
   • Language: PowerShell (Windows PowerShell 5.1), PowerShell 7, Batch, Bash, Shell, Zsh or Python.
   • Runs on: Windows, macOS and Linux as the language allows.
   • Runs as: System (SYSTEM on Windows, root on macOS and Linux) or Signed-in user.
   • Stop after (seconds): when the time is up, the script is stopped with everything it started.
5. Add any Parameters (below).
6. Click Create.

The exit code decides success: 0 succeeds, anything else fails. Everything the script writes to its output and error streams is shown live on the run page.

Parameters#

Parameters are values a technician fills in each time the script runs, such as a service name or a folder.

1. Click Add a parameter.
2. Enter the Name the script uses, a Label for the run dialog, and some Help.
3. Pick the Type: Text, Number, Yes or no, Choice, Secret or Credential from the vault.
4. Set a Default and tick Required if the script cannot run without it.

In PowerShell each parameter arrives as a named parameter, so a param() block picks it up. In every language it is also set as an environment variable named RMM_PARAM_<NAME>: a parameter called service reaches the script as RMM_PARAM_SERVICE.

Tip: Use Secret for passwords and keys. The value reaches the script but is removed from the stored run afterwards, so it never shows in the run history.

Credentials from the vault#

A Credential from the vault parameter takes a username and password from the credentials vault instead of anyone typing them:

• One shared credential: the same credential on every device.
• Each customer's credential named: a name such as Domain admin, looked up in each device's customer's vault when the script runs.

The username and password are read only when the command is sent to that device, reach the script as two variables (a PowerShell script that declares a [PSCredential] parameter gets a credential object), and are removed from the stored command once the agent has it. The run shows the credential by name, never its password, and every use is a line in the vault audit log naming the run. See The credentials vault.

Variables every script gets#

Every run also gets the device's details as environment variables. The Variables panel in the editor lists them: click one to put it in the script.

A script can also set a device custom field by printing a line to its output:

RMM_SET_FIELD asset_tag=HA-0151

The change is checked as a person's would be, and what was set, or why not, is shown on the device's result and its timeline.

Note: These names are the same on every install, whatever brand the agent wears. Scripts of your own that read variables by an older name need changing to the RMM_ names.

Scripts on the Lite agent#

Devices on older Windows run the Lite agent, which runs Command Prompt and Windows PowerShell scripts only, as the system, and only scripts marked Works on the Lite agent. The mark is a switch on the script's page: turn it on once you have checked the script against the older PowerShell those machines have (2.0 on Windows 7 and Server 2008 R2). A copy of a script keeps its mark, and the library's Lite agent column and filter show which scripts have it. See Older Windows and the Lite agent.

Publishing with a second person#

With Publishing needs someone who did not write the draft on (it is on by default, under Second person approval in Settings > Device management), an administrator who edited a draft cannot publish it alone: publishing asks another administrator through Approvals, and the script is published the moment they approve. The library shows Publishing is waiting for approval until then. Someone who did not edit the draft publishes straight away.

A script can also be marked Runs need approval (administrators, on the script's page): every run of it then waits for a second person. See Running and scheduling scripts.

Archiving#

Choose Archive from the ... menu to hide a script you no longer use. Its runs stay in the history. Turn on Show archived in the library to find it again.