@Kamil W , that script is used to shutdown Media Agents:

https://documentation.commvault.com/11.26/expert/12598_restart_deduplication_database_mediaagent.html

Are those IPs from within their CommCell?

Hi Mike,

I have forwared you question to the Customer. I’ll let you know ASAP.

Rgds,

Kamil

Hi Mike,

I spoke to the Customer.

These addresses are outside of the CommCell (outside of the internal network)

Rgds,

Kamil

In that case, open a support incident.  Definitely sounds like it should be checked/verified.

Let me know the case number once you do.

Thanks Mike.

I will do.

Rgds,

Kamil

Here you go, @Mike Struening 

https://ma.commvault.com/Case/Details/220614-168

Rgds,

Kamil

Thanks, @Kamil W !

@Kamil W - The mentioned IPs resolve to Akamai and is a service that is used by Commvault.  

Additional information on the usage can be found here

https://documentation.commvault.com/11.24/expert/4787_external_urls_for_commvault_features.html

Usage:  Fetches Akamai server time to generate Akamai token.

I’m interested in how it was determined that the vbs script was performing the communication to akamai?  Do you have a log snippet (log name) showing that the script was making this call?  Since, this script performs a shutdown of services. 

We have an answer:

I have the update from Development Team,

The VB script that we installed does not connect to any external website.

It only stops the local services. Development Team has highly recommended to check with Microsoft for the sites contacted.

It is possible that WScript.exe that is part of Windows OS is contacting these sites.