Worklets

All things Worklets for Windows, macOS, and Linux

585 Topics

M
Max NewmanRookie
asked in Find & Share Worklets

Uninstall Rapid7 Agent from Linux

Looking for a bash script to uninstall Rapid7 agent on Linux/Ubuntu … please :)

0
M
11 minutes ago
D
danrubinsRookie
posted in Find & Share Worklets

Feature request: Crowdstrike deploy via tags

We’ve been making good use of the Automox Agent Deployer and it really has helped us get started quickly. As we enter the next phase of our rollout, we want to target deployments with a given Automox Key to a subset of machines that share a Crowdstrike Host Group with machines we don’t want to target - so we’d really like to be able to deploy using FalconGroupingTag and SensorGroupingTag.I think our workarounds would be move machines into different Crowdstrike Host Groups, which would be challenging due to our other integrations, or manually run the script against each host via Crowdstrike RTR, which would require other development work and doesn’t make use of the excellent Automox Agent Deployer that is already built.

0
D
10 hours ago
jack.smith
jack.smithAll Star
posted in Find & Share Worklets

Worklet - Toast Notifications with Branding and Ignores Focus Assist

Yup. Another Toast Notification post :-) What makes this one unique is how customizable it can be with company branding and links to internal sites, interactive buttons and so on. Once you get the hang of this one you can apply this to multiple scenarios that fit your needs.Really need to read Martin Bengtsson blog before you get started. https://www.imab.dk/windows-10-toast-notification-script/  Download the scripts here https://github.com/imabdk/Toast-Notification-Script Edit config-toast.xml to your satisfaction or desired outcome. Create a new worklet and associate to the right groups Set the Evaluation Code to whatever you want exit 1 Set the Remediation Code Payload # Scheduled Task Name$schdtaskname = 'ToastNotify'# Working Directory$workdir = 'C:\ProgramData\ToastNotify'IF((Test-Path $workdir) -eq $false){mkdir $workdir -Force | Out-Null}IF((Test-Path $workdir\Images) -eq $false){mkdir $workdir\Images -Force | Out-Null}# Cleanup Prior Scheduled tasks if they existUnregister-Sc

8
jack.smith
18 hours ago
D
doomerNovice
asked in Find & Share Worklets

Worklet - Deployment language tool on windows x64

 Hello,I'm trying to create a worklet to deploy LanguageTool on my Windows x64 fleet. However, in the feedback, it says that the installation went well but ultimately fails. Can you help me fix the code?Evaluation Code ########################################## --! Evaluate Compliance !--if (Get-Win32App | Where-Object { $_.Name -eq $appName }) {    Write-Output "$appName is already installed. Now exiting."    exit 0}# Si LanguageTool n'est pas détecté, le worklet déclenchera l'installationelse {    Write-Output "$appName was not detected."    installLanguageTool -AppName $appName -AppInstallerType $appInstallerType -AppURL $appURL -IsSilent}Remediation Code # Set temporary folder path$tempFolderPath = Join-Path -Path $env:TEMP -ChildPath "automox"Write-Output "Creating temporary folder at $tempFolderPath"New-Item -ItemType Directory -Force -Path $tempFolderPath | Out-Null# Download Language Tool setup executable$url = "https://languagetool.org/download/windows-app/LanguageTool-latest.

8
D
2 days ago
A
Arunchandar NRookie
asked in Find & Share Worklets

Agent uninstallation restriction

Hey Folks, We were told that automox team has this road map on agent tamper protection last year, Where are we on this do we have any ETA when this will be implemented.This would be very useful and does not let end users tamper or play with the agents when they are provided with admin rights.

5
jack.smith
3 days ago
Juanmbi
JuanmbiRookie
posted in Find & Share Worklets

Worklet: WinVerifyTrust Signature Validation Vulnerability (CVE-2013-3900) mitigation

This is an older CVE that was reissued by Microsoft January 21 2022. There is no patch for this vulnerability. It affects all current and previous versions of Windows OS. And is considered “opt-in” with no plans to enforce stricter verification. This is listed in the CISA known exploited vulnerabilities catalog. Updated reissue:CVE-2013-3900 - Security Update Guide - Microsoft - WinVerifyTrust Signature Validation Vulnerability Other:https://nvd.nist.gov/vuln/detail/CVE-2013-3900https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-098 Evaluation Code:#Clears all errors prior to running script$Error.Clear()#All values tested$Value1 = Test-Path -Path "HKLM:\\SOFTWARE\Microsoft\Cryptography\Wintrust\Config"$Value2 = Test-Path -Path "HKLM:\\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config"$Value3 = Get-ItemPropertyValue -Path "HKLM:\\SOFTWARE\Microsoft\Cryptography\Wintrust\Config" -Name "EnableCertPaddingCheck"$Value4 = Get-ItemPropertyValue -Path "HKLM

2
Juanmbi
8 days ago
jack.smith
jack.smithAll Star
asked in Find & Share Worklets

Worklet - Install Cisco Umbrella Anyconnect Agent

This worklet will install Cisco Umbrella with certificate and config files. This also checks for the OpenDNS agent and removes as well.  EvaluationParamaters Thumbprint ID of the root certificate used by your own SWG deployment If any of the services don’t exist, run remediation csc_vpnagent csc_swgagent csc_umbrellagent If running an older version of the service Umbrella_RC, run remediation If the Root Certificate is missing, run remediation If OrgInfo.json is not in place, run remediation#params$thumbprint = "<your-org-thumbprint>"# Cisco AnyConnect VPN Module$service = Get-Service csc_vpnagent -ErrorAction SilentlyContinueIF(!$service){ exit 1}# Cisco AnyConnect Diagnostics and Reporting Tool$service = Get-Service csc_swgagent -ErrorAction SilentlyContinueIF(!$service){ exit 1}# Cisco AnyConnect Umbrella Roaming Security Agent$service = Get-Service csc_umbrellaagent -ErrorAction SilentlyContinueIF(!$service){ exit 1}# Root Certificate used to inpsect HTTPS traffic

7
A
8 days ago
M
Maulik_BusaNovice
asked in Find & Share Worklets

Activity log not showing output for below worklet.

Hi all, im trying to fetch those system update packages from endpoints. im doing this via this worklet here , for some reason its not showing output in Automox console. can anyone suggest what am i doing wrong here.. i also have same problem for other command Test-PendingReboot -detailed to when i try to verify if endpoint is waiting for a reboot or not..  i also checked out this too and ive tried both standard output stream PowerShell: Write-Output/Write-Host but none of it worked.. just getting an empty box in log summary. Any help would be highly appreciated. Thanks  # Check if the PSWindowsUpdate module is installed, if not, install itif (-not (Get-Module -Name PSWindowsUpdate -ListAvailable)) {    Install-Module -Name PSWindowsUpdate -Force -AllowClobber -Scope CurrentUser -Repository PSGallery}# Import the PSWindowsUpdate moduleImport-Module PSWindowsUpdate# Get a list of available updates$updates = Get-WindowsUpdate# Iterate through each updateforeach ($update in $updates) {   

3
jack.smith
8 days ago
james.whiting.gsl
james.whiting.gslRookie
asked in Find & Share Worklets

Worklet? Crowdstrike Uninstall to Move Asset to another Crowdstrike Console

We’ve just set up 2 extra Crowdstrike consoles to allow segregation of assets and users. However, I’m struggling to find a way to move these assets in bulk, as I need to uninstall the sensor on each asset, and then reinstall with a different Customer ID. Does anyone think this would be possible via a couple of worklets? Otherwise I’m looking at a huge manual job… Thanks!

1
jack.smith
8 days ago
C
CallmePHNovice
asked in Find & Share Worklets

Root password change policy

Has anyone created a worklet to change the root password on Linux machines? Can Secrets be leveraged maybe to have this automated on a 90-120 days basis maybe? 

0
C
14 days ago
M
Marcus73Rookie
asked in Find & Share Worklets

Agent: DIsconected

I moved some servers from VMware to Proxmox. Since then they show up with Agent: Disconnect.Uninstalling and reinstalling didn't help.With amagent --setkey c2ba..... Error creating Path: mkdir C:\Program Files (x86)\Automox: A file cannot be created if it already exists.amagent --checkcompat2024/03/21 08:24:12 Error creating Path: mkdir C:\Program Files (x86)\Automox: A file cannot be created if it already exists.2024/03/21 08:24:13 Setting for AUTOMOX_API_BASE_URL:https://api.automox.com2024/03/21 08:24:15 Checking agent compatibility against https://api.automox.com2024/03/21 08:24:15 Posting /compatibilitycheck...2024/03/21 08:24:15 POST https://api.automox.com/compatibilitycheck2024/03/21 08:24:15 No proxy found. Using direct connectionSuccessfully verified system compatibilityDoes anyone here have an idea for me?

1
jack.smith
15 days ago
H
harryc123Rookie
asked in Find & Share Worklets

Disable ALL reboots on Servers unless done so via restart worklet

There are a few servers that we do not want to restart at any time, unless done manually by our application teams.The policy assigned to devices  has "Do not enable automatic restart after updates are installed" however, these servers do reboot overnight an hour or so after updates are installed. From talking to support Automox cannot stop all reboots.  Has anyone from the community found a relaible GPO/Scripit or anything that can prevent restarts completely on servers? Process we are aiming for: 2nd Wednesday of the week at 11PM install all updates.2nd Thursday of the week at 6AM restart via worklet if restart is required. Currently, the restart can happen anytime after updates are installed, so i’d like the policy/script to prevent that, so that the server only restarts when the worklet is ran. 

1
jack.smith
15 days ago
A
anuj.johriRookie
asked in Find & Share Worklets

Worklet to deploy Cisco Secure Client Umbrella module on Mac

Hi all, I”m looking for the software script to deploy Cisco Secure Client Umbrella module and the root certificate on Mac. 

5
jack.smith
15 days ago
A
anuj.johriRookie
asked in Find & Share Worklets

Script to unhide Cisco Secure Client VPN module

Hi all,  I'm looking for PowerShell to unhide the Cisco Secure Client VPN Module. Cisco Secure Client is already on our machine, but the VPN module is hidden. I want to unhide it.   

1
S
21 days ago
Tony-Automox
Tony-AutomoxAutomox Employee
posted in Find & Share Worklets

Set Windows 10 Screensaver

Set your screensaver, the timeout, and whether prompted for a login upon resume. This code is easy to select any of the built-in savers located in C:\Windows\System32, but you could enhance it to attach your own screensaver, copy it to System32, and set it as the one to use. Note: The settings may not take effect until after a reboot Evaluation: # Define desired registry settings. Set remediation to match ------ # 1 = On resume display logon screen, 0 = No logon screen on resume $ssSecure = 1 # Time in seconds $ssTimeout = 600 # Screensaver used $saver = "C:\WINDOWS\system32\Ribbons.scr" #------------------------------------------------------------------ if (!((Get-WmiObject Win32_OperatingSystem).Caption -match "Microsoft Windows 10")) { Exit 0 } $regPath = 'Control Panel\Desktop' # Get User details including SID from Get-LocalUser $users = Get-CimInstance -Class Win32_UserProfile -Filter "Special = $false" #Add HKEY_USERS to a PSDrive for easy access later New-PSDrive -PSPr

5
D
24 days ago
C
CallmePHNovice
posted in Find & Share Worklets

Linux server not showing in device console.

I have a few Linux servers (varying flavors including Centos and RHEL) that after successful install and service start do no show up in the Device Console. I have made sure ports 443 etc are open, and not having this issue with the other Linux servers I have installed in the same network and vlan. Any thoughts or help would be greatly appreciated! 

15
K
24 days ago
V
VTM9Rookie
asked in Find & Share Worklets

Worklet to first Uninstall Microsoft Office 2019 then install MS Office 2021

Hi, I tried to use the PS script to directly install MS Office 2021 to the client machine that is currently having the MS Office 2019. I’m getting the error message saying “ You have to uninstall MS Office 2019 ….” I’m not sure if possible, but I’m looking for the worklet with script that first to Uninstall Microsoft Office 2019 Pro then install MS Office 2021 Plus after that...Please help if any one got this procedure done successfully.Thank you!

8
M
27 days ago
F
FerOzRookie
asked in Find & Share Worklets

Delete cashed credentials on Mac

Can you suggest any way to delete cashed credentials on a Macbook via Automox? Just to give context: We have an unreturned asset that we see user is online. We are trying to prevent user using it any further

6
F
29 days ago
Stambo-Automox
Stambo-AutomoxAutomox Employee
posted in Find & Share Worklets

Remote lock workstation and change user's password

This worklet changes the local user’s password and logs them out of the computer. This is useful in instances where there is security risk or an abrupt/unexpected termination. Evaluation exit 1 Remediation #Credit for parts of this script go to Progress $logoutReset = { #Set the username that should have its password changed and sessions logged off on the targeted workstations $user = 'jeff' $password = 'y0urn3wPa$$woRd_heR3' # #Comment out the line below if you do not need to change the password locally but prefer to change it in Active Directory net user $user $password $ErrorActionPreference = 'Stop' $quser = "C:\Windows\Sysnative\quser.exe" $logoff = "C:\Windows\Sysnative\logoff.exe" try { ## Find all sessions matching the specified username $sessions = & $quser | Where-Object {$_ -match $user} ## Parse the session IDs from the output $sessionIds = ($sessions -split ' +')[2]

6
F
30 days ago
A
anuj.johriRookie
asked in Find & Share Worklets

Worklet to deploy Cisco Secure Client Umbrella module

Cisco AnyConnect and Umbrella Roaming client is EOL in April/24 I’m looking for guidance to create a worklet that will install a Cisco secure client with an Umbrella module and enable the Computer Services option so only administrators start/stop Cisco Secure Client's services on a device. https://support.umbrella.com/hc/en-us/articles/17890678933012-Cisco-Secure-Client-with-Umbrella-Module-Installation

2
A
30 days ago
L
laurencechildsnsNovice
asked in Find & Share Worklets

uninstall DELL Support Assist

Hi Allwe’ve noticed DELL Support Assist started running an agent task that is hogging major amounts of system RAMwe have a dispersed user population so I'd like to look at uninstalling the DELL Support Assist application from our remote users via Automox, has anyone managed to uninstall DELL SA remotely?cheers :)

1
M
1 month ago
K
KTicerRookie
posted in Find & Share Worklets

Worklet: Force Check\Install Windows Updates

Evaluation Code:# Check for pending updates$updateSession = New-Object -ComObject Microsoft.Update.Session$updateSearcher = $updateSession.CreateUpdateSearcher()$updates = $updateSearcher.Search("IsInstalled=0")# If there are pending updates, proceedif ($updates.Updates.Count -gt 0) { Write-Host "There are pending updates. Proceeding..." exit 1}else { Write-Host "No pending updates. Exiting..." exit 0}Remediation Code:# Check for administrative privilegesif (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { Write-Host "Please run this script as an administrator." exit}# Save the current execution policy$originalPolicy = Get-ExecutionPolicy# Set the execution policy to allow scriptsSet-ExecutionPolicy Bypass -Scope Process -Force# Install NuGetInstall-PackageProvider -Name NuGet -ForceGet-PackageProvider -Name NuGetRegister-PackageSource -Name NuGet.org -Loc

1
S
1 month ago
N
neothebatRookie
asked in Find & Share Worklets

How do I delete payloads from my worklet?

I have many worklets that I need to update the payload on but there is no way to remove previously uploaded payloads, only to upload more.I tried overwriting the previous payload by uploading another with the same name but I just get a error.The only work around I found is to delete the worklet and recreate it, which can be quite a chore. Is there a better way?

2
N
1 month ago
M
Maulik_BusaNovice
asked in Find & Share Worklets

Critical patch policies keep failing

Hi Everyone, im trying to figure out why critical patch policies is keep failing with below error code(ignore OpenVPN). its happening to almost 70 percent of device.. i tried restarting windows update services to find out if that resolve the issue but so far no luck. any suggestion this would be highly appreciated.Thanks    Failed to apply patches ("OpenVPN Connect" "Remote Desktop" "2024-01 Security Update for Windows 10 Version 22H2 for x64-based Systems (KB5034441)" "FileZilla Client" "AWS Command Line Interface v2"): Error: OpenVPN Connect is unable to patch because it is currently runningInstallMSUpdates : Install failed with ResultCode 4 and HResult -2145124318At C:\Program Files (x86)\Automox\execDir177495117\execcmd237205320.ps1:1727 char:17+                 InstallMSUpdates $lst+                 ~~~~~~~~~~~~~~~~~~~~~    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,I

6
V
1 month ago
J
justlookingRookie
asked in Find & Share Worklets

Office 365 Worklet not working

Hello. I wanted to get assistance on correcting a office 365 installation worklet. This was previously working and now it is receiving the following error. You cannot call a method on a null-valued expression.At C:\Program Files (x86)\Automox\execDir519974115\execcmd211621094.ps1:225 char:5+     $postVer = $64Config.getvalue("VersionToReport")+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException    + FullyQualifiedErrorId : InvokeMethodOnNull COMMAND TIMED OUT. The script <# .SYNOPSIS     Install M365 Apps - Evaluation Script     OS Support: Windows 8.1 and above     Powershell: 3.0 and above     Run Type: Evaluation or OnDemand .DESCRIPTION     This Worklet is designed to grant an Admin the ability to install Microsoft 365 Apps (Office) on devices that do not     currently have them installed.     While it is possible to remove legacy MSI installations (Office 2016/etc) as part of the ODT,

3
D
1 month ago
Terms & ConditionsCookie settings