Attempting to make a script grab the SID of a specific username on the endpoint and store it in a variable. No matter what command I put in to execute, the #global:cmdresults# variable contains the data "ECHO is on." My command that I want to retrieve the result from is: wmic useraccount where name="username" get sid | findstr /r "^S.*[0-9]".
I even tried to the example in the documentation (dir %APPDATA%) but that too returned "ECHO is on." I am verifying the output using the writeTextToFile() statement.
I attempted to use the getVariable() statement with a WMI property type, but I don't see anywhere I can add a "WHERE" clause to skinny the results down by username.
Any ideas would be greatly appreciated, thank you!
EDIT: Just looked in the procedure history for the endpoint and every time I run the procedure it says "Error - unable to detect shell command results." I have also tried to fetch through powershell but the #global:psresult# comes back as ECHO is on as well!
Have you tried including @Echo Off in the command
Or use "Cmd /c wmic useraccount where name="username" get sid | findstr /r "^S.*[0-9]"
Thank you Paul! cmd /c wmic useraccount where name="username" get sid | findstr /r "^S.*[0-9]" was the key. I just need to trim the string a bit and it will be perfect. Appreciate the help!