When using Remote Inspection for Windows, which of the following properties require fsprocsvc.exe interactive scripting?

The "Windows Expected Script Result" property is specifically designed to evaluate the output of a custom script executed on a Windows endpoint. This functionality is provided by the Windows Run Script action. Forescout's Remote Inspection capability deploys a temporary service, fsprocsvc.exe, onto the endpoint to facilitate the execution of such scripts. This service is essential for running the script and capturing its output, which is then evaluated by the "Windows Expected Script Result" property within a policy.

A. User Directory Common Name: This property is typically resolved by querying a directory service like Active Directory via LDAP, not by executing a script on the endpoint.

B. Update Microsoft Vulnerabilities: This is an action, not a property. The related properties for vulnerability status are determined by scanning installed patches via the registry or WMI.

D. Antivirus Running: This standard property is resolved by querying the Windows Security Center (WSC) via WMI or by checking specific registry keys and service states.

E. Windows Service Running: This standard property is resolved by querying the Windows Service Control Manager, typically using WMI, which does not require custom scripting.

1. Forescout eyeExtend Module: Windows End-user and Administrative Actions Configuration Guide, Version 1.3.1, Page 10, Section: "About the Module": "The module provides actions that run on Windows endpoints. To run these actions, the Forescout Process Service (fsprocsvc.exe) is installed on the endpoint." This confirms fsprocsvc.exe is the mechanism for actions.

2. Forescout eyeExtend Module: Windows End-user and Administrative Actions Configuration Guide, Version 1.3.1, Page 17, Section: "Run Script": This section details the "Run Script" action, which executes scripts on endpoints. The guide states, "The Expected Script Result property lets you create a policy condition that is based on the output of a script that you run on endpoints." This directly links the script execution to the "Expected Script Result" property.

3. Forescout Administration Guide, Version 8.2, Page 533, Section: "How Remote Inspection Works": The guide explains that for certain checks and actions on Windows endpoints where an agent is not installed, Forescout temporarily installs a service to perform the required operations. This service is fsprocsvc.exe, which is used for advanced actions like running scripts. Standard properties like service status or AV status are typically retrieved using native protocols like WMI.