Scripts stored outside the Commvault installation folder are blocked by default on newly installed clients. Run the script under target machine credentials, or allowlist its location using one of the options below.
Run scripts under target machine credentials (recommended)
Provide credentials for the target machine so the script runs under them. This is the recommended approach. On Windows, enable Impersonate user and select a credential in the script configuration.
Other options when credentials can't be used
| Option | Use when | Configuration |
|---|---|---|
| Installation folder | Scripts can be stored with the Commvault installation files, for example C:\Program Files\Commvault\Base\scripts\ (Windows) or /opt/commvault/scripts/ (Unix/Linux). |
No configuration needed |
| Folder path | Scripts are organized in dedicated folders, for example C:\scripts\backup\ or /opt/backup/scripts/. Any executable under the allowlisted folders can run. |
sAdminWhiteListPaths additional setting with folder paths |
| File name | Specific trusted executables, for example powershell.exe or backup.sh, must run regardless of location. A file name alone doesn't specify a location. |
sAdminWhiteListBinaries additional setting with file names |
Note
Settings in the Local category must be entered directly on the target machine. They can't be configured from the Command Center interface.
Restrict executable execution
The nLimitedAdminAccess additional setting controls restrictions on executable execution by Commvault infrastructure machines, including CommServe, Web Server, and Workflow Engine.
Set nLimitedAdminAccess to 1 to restrict these machines from running executables outside the Commvault installation folder on client machines.
Grace period for security enforcement
Newly installed clients enforce these security restrictions immediately. Clients upgraded to Long-Term Support Release 11.40 and later receive a three-month grace period for initial setup, configuration, and testing. After the grace period, enhanced security is enabled automatically.
If a script runs outside the Commvault installation directory during the grace period, the grace period extends by three months from that execution date.
Related allowlisting features
Pre- and post-process scripts, workflows, quick access tools, and Data Import use the same additional settings to control executable execution:
-
Workflows: Use
sAdminWhiteListPaths,sAdminWhiteListBinaries, andnLimitedAdminAccessfor workflow scripts. -
Quick access tools: Use the same settings for quick access tool execution.
-
Data Import: Uses executable allowlisting settings when importing backup vendor archives into Commvault.