Command prompt black screen popping on client machines

Products

• IT Management Suite
• Software Management Solution

Issue/Introduction

You have received reports that some client machines are displaying command prompt black screen pop-ups on a regular basis (like every 2 hours). This is just happening on just few client machines.
In this example, the command prompt window seems to be running:

C:\Windows\System32\net.exe

Environment

ITMS 8.7.x, 8.8.x

Cause

Limited Permission. The User account being used has limited admin rights on those client machines.

Resolution

There are many different reasons why a black screen pop-up prompt window can be triggered. Also, there are different Software applications that could trigger such pop-up windows.

In this example, the main clue is that the mentioned windows seems to be running "C:\Windows\System32\net.exe".

Try the following:

1. Capture a "ProcMon" trace. You can find this Microsoft tool here: https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
2. Search for what is been run. Again, for this example you can see: "C:\Windows\System32\net.exe".
3. ProcMon should show you what "process" is calling it. In this example, it is the "AeXNSAgent.exe" (The Symantec Management Agent Service) as seen here:
   
   
   
   
4. Next, review the Sym Agent logs around those times. You should see entries like these:
   
   

   Policy {DBEB45DF-744C-4A6C-A790-D4FBA8DE10D9}Launch net.exe, job task {Index = 0, State = NotStarted, Status = Success, LastCheckTime = 2025-05-21 22:01:00 +5:30, LastRealRunTime = 2025-05-21 21:33:10 +5:30} due at: 5/21/2025 10:31:00 PM
   -----------------------------------------------------------------------------------------------------
   Date: 5/13/2025 8:31:00 AM, Tick Count: 819964187 (9.11:46:04.1870000), Size: 498 B
   Process: AeXNSAgent.exe (13360), Thread ID: 8852, Module: smfagent.dll
   Priority: 4, Source: CDeliveryPolicy::GetNextWakeup()

    

   Adding next task from policy Launch net.exe ({DBEB45DF-744C-4A6C-A790-D4FBA8DE10D9}) to job queue.  Task trigger: 6451aea3-62e3-40ae-a12f-506d23ecf24f
   -----------------------------------------------------------------------------------------------------
   Date: 5/13/2025 8:31:00 AM, Tick Count: 821764234 (9.12:16:04.2340000), Size: 408 B
   Process: AeXNSAgent.exe (13360), Thread ID: 8852, Module: smfagent.dll
   Priority: 4, Source: CDeliveryPolicy::RunJobQueue()

   
   Note: In this example, the policy and task are very obvious (since the policy has net.exe on it) but you can also use the "Date" entries to narrow down which policy or task could be the one if there are multiple ones running at the same time.
   
   
5. After identifying the policy, go to the SMP Console and review the command and/or settings used, especially the "Account" and how to "Run As" it:
   
   
   1. In the Managed Software Delivery (MSD) policy or Quick Delivery task open Advanced options and go to the Run tab. Check the Display window: option and see if you are using "Minimized" rather than "Hidden." It may also be necessary to disable the setting Allow user to interact with installing software.
   2. In the Managed Software Delivery (MSD) policy or Quick Delivery task open Advanced options and go to the Run tab. Under Run as check Current logged-on user or Specific user: and fill in the needed credentials.
      
      
6. To test if a MSD policy will now work save changes then go the client machine's Symantec Management Agent GUI and open Settings. Click Update Configuration then go to the Software Delivery tab, select the policy and then click on the policy under Application Tasks to run it. To test if a Quick Delivery task will now work without the pop-ups with save changes then click Quick Run and run the task on a test machine.
7. Also, you could disable the policy and see if the issue still occurs.
8. OR, run the executable / script / batch file manually using the same commands and see if it behaves the same with triggering the pop-ups. 
9. If you can't identify what policy could be causing it but want to check if it is the Symantec Management Agent triggering these prompts to pop-up, stop the Symantec Management Agent service and wait for the next expected time for this to occur. If nothing pop-ups again, at least you know that one of your policies or tasks could be the culprit.

Additional Information

Batch File does not Work in Managed Software Delivery Policy or Quick Delivery Task but Runs Fine Manually