Error getting token when running script as scheduled task

[Qbert777]

My script runs fine within the IDE but Request-FalconToken returns ERROR 'Unable to find type [ApiClient]' when running the script as Windows Scheduled Task. Confirmed the prior 'Import-Module -Name PSFalcon' command was successful.

Not saying there is any issue with the PSFalcon module (using 2.1.3), just wondering if anyone has experienced this issue and has any advice to fix?

Thanks.

[bk-cs]

• Where is the module installed?
• Are you using Request-FalconToken after you Import-Module?

If you're getting the Unable to find type [ApiClient] error, that suggests that something didn't load properly when the module was imported or the command is being run without first requesting an authorization token.

The [ApiClient] class is defined in Class\Class.ps1 by the PSFalcon module. When you Request-FalconToken, it creates a variable called $Falcon which captures the provided ClientId, ClientSecret, MemberCid and Hostname (or Cloud) values and creates [System.Net.Http.HttpClientHandler] and [System.Net.Http.HttpClient] objects for your future commands. Saving the credential information allows the module to automatically re-request authorization tokens when they're about to expire.

Generally speaking, if you're trying to set up PSFalcon to be used in a scheduled task, you'll want to ensure that:

1. The module is available to the user/service account that will be running the scheduled task
2. The credentials will be available within the session that's launched by the scheduled task
3. The task imports the module, requests a token, then runs the desired commands

[Qbert777]

Module installed here: 'C:\Users[REDACTED]\OneDrive - [REDACTED] Company\Documents\WindowsPowerShell\Modules'
I verified through logging that the module was successfully imported before the Request-FalconToken.

I will look into #1 and #2 of your troubleshooting steps.
Thanks

Function Connect-CrowdStrike() {

    [CmdletBinding()]
    Param ()
    # Get credentials and load PSFalcon if not already loaded
    if (!(Get-Module "PSFalcon")) {
        # module is not loaded
        Import-Module -Name PSFalcon

    }
}
#-----------------------------------------------------------[Execution]------------------------------------------------------------

try{
    Connect-CrowdStrike
    write-log -LogOutput "Connected to CS" -Path $LogFile
    }
    Catch{
    write-log -LogOutput ("Error connecting to CS:  {0}" -f $_) -Path $LogFile
}

# Load API credentials from local vault
try{
    $CSclientId=Get-Secret -Name CSclientid -Vault MyVault -AsPlainText
    $CSclientSecret=Get-Secret -Name CSclientsecret -Vault MyVault -AsPlainText
    Request-FalconToken -ClientSecret $CSclientSecret -ClientId $CSclientId
    }
    Catch{
    write-log -LogOutput ("Error getting token for $($CSclientId):  {0}" -f $_) -Path $LogFile
}

Logfile:
[23-09-2021 14:00:02] Connected to CS
[23-09-2021 14:00:03] Error getting token for [REDACTED]: Unable to find type [ApiClient].

[bk-cs]

Is the user running the scheduled task the same user that owns the C:\Users\REDACTED\OneDrive - REDACTED Company\Documents\WindowsPowerShell\Modules folder? A permissions issue could prevent the module from performing the [ApiClient] class import during Request-FalconToken.

It's also possible that OneDrive is performing some level of file re-direction. You may be better off installing the module under the user that's running the task, or copying the PSFalcon\<version> folder somewhere else, and importing it manually during your Connect-CrowdStrike function.

[Qbert777]

Yes, the task is running under my profile and I own that folder. I've also tried manually importing from the following locations:

• C:\Users[MyUserName]\OneDrive - [REDACTED] Company\Documents\PowerShell_Scripts\PSFalcon (The script is located one directory up from here)
• C:\Users[MyUserName]\PSFalcon
• C:\Temp\PSFalcon

I'll keep on digging and update here if I get it figured out. Thanks for your help.

[Edit]
I just found this article (https://newbedev.com/powershell-unable-to-find-type-when-using-ps-5-classes) which seems like the issue I'm having although not sure how to implement the suggested fix.

[Qbert777]

I was able to get it working by using the following statement at the top of the script as per this article.

using module PSFalcon

[bk-cs]

Excellent! That's not something I've ever tried before, so it's great to know that it's an option.

[Qbert777]

Yup. Thanks again for helping me work though to a solution!

[bk-cs]

If you'd like to document your process for setting up the scheduled task, I think that would be a great contribution to the Wiki. Many users would benefit from using PSFalcon in a scheduled task.

I added a comment about your use of using to the Installation section.

[Qbert777]

Happy to help! I'll write-up a draft for your review next week. My use case is pulling a list of current users via 'Get-FalconUser' and then checking them against our AD to flag any who are no longer employees so their CS profile can be deleted.

[Qbert777]

After some further experimentation it seems the error only occurs when importing PSFalon from within a function. So this works:

if (!(Get-Module "PSFalcon")) {
    Import-Module -Name PSFalcon
}

This causes the error:

Function Connect-CrowdStrike() {
    if (!(Get-Module "PSFalcon")) {
        Import-Module -Name PSFalcon
    }
}
Connect-CrowdStrike

[bk-cs]

Ah, this is likely because the function is operating within the local scope by default. I didn't catch that when looking at your original example.

[Qbert777]

Other than that, there is nothing special about using PSFalcon in a scheduled task. Below is the relevant information for the task I’ve scheduled. Feel free to use, change or not use in your Wiki as you see fit. Let me know if you need more info and thanks again for PSFalcon!

TASK SCHEDULER
General:
•	Set to run under my user account
•	Run only when user is logged in

Actions:
      <Command>pwsh.exe
      <Arguments>-NoLogo -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\[Username Redacted]\OneDrive – [REDACTED] Company\Documents\PowerShell_Scripts\CrowdStrike\CS-Active-Users.ps1"
      <WorkingDirectory>C:\Users\[Username Redacted]\OneDrive - [REDACTED] Company\Documents\PowerShell_Scripts


SCRIPT
•	Script location: "C:\Users\[Username Redacted]\OneDrive – [REDACTED] Company\Documents\PowerShell_Scripts\CrowdStrike\CS-Active-Users.ps1"
•	I used SecretManagement Module and the following code for non-interactive retrieval of CS API ID and Secret.  Reference article (https://www.mattallford.com/2020/Microsoft-PowerShell-SecretManagement-Module/)

    $CSclientId=Get-Secret -Name CSclientid -Vault MyVault -AsPlainText
    $CSclientSecret=Get-Secret -Name CSclientsecret -Vault MyVault -AsPlainText
    Request-FalconToken -ClientSecret $CSclientSecret -ClientId $CSclientId