Automox Developer Resources

Dev Hub

507 Topics

jbh
jbhPro
posted in Community Worklets

Return list of all servers (~2K) using API and pagination - what am I missing?

I cobbled this together from several items in the Automox Labs and API documentation: $orgID = "myorgid" $apiKey = 'myapikeyhere' $filepath = ‘.\ServerInventory.csv’ $page = 0 $limit = 500 $data = @() Write-Output "Page" while($true) { $headers = @{"Authorization" = "Bearer $apiKey" } $url = "https://console.automox.com/api/servers?$orgID?l=$limit&p=$page" $response = (Invoke-WebRequest -Method Get -Uri $url -Headers $headers).Content | ConvertFrom-Json Write-Output $page $data += $response $page += 1 if($response.count -lt $limit) { break } } $data | Group-Object display_name | Sort-Object name | Select-Object Count,name ` | Export-Csv -Path $filepath -NoTypeInformation The result is that it produces a csv of 500 server names as I’d expect. When I change “$page” to “1” in the script (and change the csv output file name) and run it again, it produces a new, blank csv. I’ve read this: About Automox API and feel like I’m doing

6
jbh
1 year ago
jack.smith
jack.smithAll Star
posted in Community Worklets

Worklet - Enforced Reboots with Notifications using Scheduled Tasks

The idea behind this worklet is to display balloon tip in the taskbar once every 5 hours and then every 15 minutes to warn end users of an upcoming reboot and when. If an end user reboots during the notification stages, there is a scheduled task that triggers upon restart that will run another powershell script that was written to cancel out running any future events built by this worklet. The notification is using a custom icon file I built using a company logo. Please do a lot of testing beforehand as the code is not professionally written to accommodate for every scenario one could encounter. Enjoy! Evaluation Code # Cleanup prior reboot task Unregister-ScheduledTask -TaskName 'RebootMsg*' -Confirm:$false | Out-Null # Establish Reboot Data Points $uptime = (get-date) - (gcim Win32_OperatingSystem).LastBootUpTime $sysInfo = New-Object -ComObject "Microsoft.Update.SystemInfo" if($sysInfo.RebootRequired -or $uptime.Days -gt 28) { exit 1} else { exit 0} Remediation C

1
P
1 year ago
L
lindsaydallas
posted in Community Worklets

Worklet Schedule Issue

Hi Everyone, I have created a worklet using the Community Worklet, "Targeted Reboot within Timeframe’. Issue is, i am unable to make this run using the Schedule. I have set the Schedule time 2am everyday and ticked ‘If a device misses configured patch time, it will patch next time the device checks in’ along with setting targeted time within the script of 2am Start time and 5.45am End Time. With checking the Activity Log for this Worklet, nothing appears. If i Run the Policy Manually, it works great and as expected, the server is evaluated, Rebooted if Pending and adds a record into the Activity Log. Can worklets run using the Schedule or is something else required? Appreciate any assistance. Cheers,

3
MarkH-Automox
1 year ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Community Worklets

CIS Compliance: Windows 10 - 1 Account Policies - 1.2 Account Lockout

This section contains covers the Worklet that automatically applies the CIS recommendations for (1) Account Policies (1.2) Account Lockout. It is highly recommended that all Windows devices adhere to these recommendations and be evaluated frequently to ensure compliance. 1.2.1 (L1) Ensure ‘Account lockout duration’ is set to ‘15 or more minute(s)’ 1.2.2 (L1) Ensure ‘Account lockout threshold’ is set to ‘10 or fewer invalid logon attempt(s), but not 0’ 1.2.3 (L1) Ensure ‘Reset account lockout counter after’ is set to ‘15 or more minute(s)’ You can set these to be more restrictive than the settings above, but the following remediation code run without changes will set the thresholds as listed above. Remediation code: #SYPNOSIS #Automatically configures the Account Policies -> Account Lockout Policies the CIS recommended configuration for Windows 10 1809 #1.2 Account Lockout Policy #1.2.1 Ensure 'Account lockout duration' is set to '15 or more minute(s)' #1.2.2 Ensure 'Account lockou

2
K
1 year ago
D
David_MitchellNovice
posted in Community Worklets

Worklet to install Arduino IDE

I just wanted to share an example of getting creative with installs. This software will require a user prompt to install the certificates, but if they are already installed, you can install it silently. So I installed the software on a workstation manually and exported the certs. I added them to the policy package and use powershell to install the certs before installing the software. #REQUIRES -Version 2.0 <# .SYNOPSIS This script allows an admin to install Arduino IDE. .DESCRIPTION #> #Handle Exit codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function Arduino{ #############Change the settings in this block####################### ##################################################################### Try { certutil -addstore TrustedPublisher ArdruinoLLC.cer certutil -addstore TrustedPublisher ArdruinoSRL.cer certutil -addstore TrustedPublisher adafruit.cer Start-Process -FilePath "arduino-1.8.16-windows.exe" -A

1
A
1 year ago
D
david.thomsonNovice
posted in Community Worklets

TPM 2.0 / Windows 11

Here is a quick way to check if a device has TPM 2.0. The output is written to reports > activity log. I’m sure there is a better way to do this, but on the other hand, it is better than checking devices manually. Remediation code: $info = (wmic /namespace:\root\cimv2\security\microsofttpm path win32_tpm get * /format:textvaluelist.xsl)) write-output $info exit 0

0
D
1 year ago
M
Mike_JanewayNovice
posted in Community Worklets

Disk cleanup- delete temp files

I am looking for a way to perform a disk cleanup that will delete temp files. I would like to perform it on command and also run daily on users computers. Thanks in advance

14
M
1 year ago
Thor
ThorRookie
posted in Community Worklets

Worklet to install Enercalc

I’m working on a worklet to install Enercalc. In the documentation it says to run it unattended to use: ECSEL6_SETUP.EXE /S /Q /V PAC “my_PCC_CODE_HERE” I wrote just a quick and dirty oneliner to just to see if I could get it to work as I never wrote a worklet before. I came up with: Start-Process -FilePath 'ecsel20_setup.exe' -ArgumentList ('/s', '/q', '/v', "_PAC_", '"MY_PCC_CODE_HERE"') -Wait -Passthru In a powershell, it works great and install. I decided to test it on a worklet and something interesting happened. During the install of Enercalc, if you don’t have the Microsoft VC++ redistributables installed on the PC it automatically installs them. So the Enercalc install automatically installed all of them on my test machine, except didn’t install Enercalc. I’m really not sure where to go to try and figure out what’s going on, but a thought that I have is that during the install of Enercalc it displays an install screen during install, but I’m not sure if that would affect this

2
Thor
1 year ago
R
rmullenNovice
posted in Community Worklets

Worklet - Java 271

Hey guys, just need some assistance finalising the Java worklet. The automatic patching seems to have uninstalled Java from a fair few machines so need to resolve. It works fine running from the local machine, however no luck from Automox. Eval is fine. It downloads the two files then does not run the commands; installing 2 instances of Java (32 and 64bit). #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } try{ $process1 = Start-Process -FilePath 'jre-8u271-windows-i586.exe' -ArgumentList '/s', 'REMOVEOUTOFDATEJRES=1', '/L C:\ProgramData\amagent\worklets\java\java_86.log' -Wait -Passthru -ErrorAction Stop $process2 = Start-Process -FilePath 'jre-8u271-windows-x64.exe' -ArgumentList '/s', '/L C:\ProgramData\amagent\worklets\java\java_64.log' -Wait -Passthru -ErrorAction Stop exit 0 } Catch{ $Exception = $error[0].Exception.Message + "`nAt Line " + $error[0].InvocationInfo.ScriptLineNumber Write-Output $Exception exit 90 } Would app

5
B
1 year ago
D
dmunsonChannel Partner
posted in Community Worklets

Worklet to set screen lock on Mac

My company is working on making sure we have automatic screen lockouts on our machines. For our Windows machines we control this through GPO, but that does not affect the handful of Mac machines we have in our environment. Does anyone know how to script out a way to have Macs lock after a certain amount of inactivity (i.e. 5 minutes)? My DuckDuckGoing has been unsuccessful in searching for an answer to this. Thanks!

1
J
1 year ago
M
msheth
posted in Community Worklets

I am trying to copy files from share server but not able to do it.

hey everyone, I have been trying to get the copy file to work. but on the Automox it shows it was copied but it is not. when I ran the scripted locally with x86 it looks to be able to copy the files. Copy-Item -Path ‘\servername\freenas4\installs\VPN Certs*’ -Destination ‘c:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile’ -PassThru

3
D
1 year ago
AdamN-Automox
AdamN-AutomoxAutomox Employee
posted in Community Worklets

OMIGOD: Worklet to patch OMI

Hey Automox Community, As some of you may be aware, a number of high/critical vulnerabilities targeting Azure Virtual Machines have been discovered and patched by Microsoft. These vulnerabilities target the Open Management Infrastructure (OMI) agent running on Linux VM’s, and include remote code execution and privilege escalation vulnerabilities. This worklet will install the correct Microsoft repository based on your distribution of Linux and patch the OMI agent. We suggest running this worklet if any of your assets are Azure Linux VM’s. For more information about the vulnerability, see CVE-2021-38647 and Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions. Evaluation Code: #!/bin/bash #================================================================ # HEADER #================================================================ #% SYNOPSIS #+ Updates OMI on Azure Linux VM's. #% #% DESCRIPTION #% The eval code checks to see if the device is an Azu

5
R
1 year ago
Y
YB_OpsRookie
posted in Community Worklets

Greenshot

Hi Any one got a working worklet for greenshot ?

1
A
1 year ago
V
viennaNovice
posted in Community Worklets

Worklet: Uninstall TeamViewer on Windows

Hi all, we had a couple machines that had TeamViewer installed and needed to mass uninstall, thought I’d share the Worklet to uninstall this Evaluation: if (Test-Path -Path "C:\Program Files (x86)\TeamViewer") { Write-Output "TeamViewer not installed, skipping" exit 0 } else { Write-Output "TeamViewer installed, we will uninstall" Exit 1 } Remediation: $AllApps = Get-ItemProperty "HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" $TeamViewer = $AllApps | Where-Object {$_.DisplayName -Like "TeamViewer*"} Write-Output "Uninstalling TeamViewer" Start-Process -FilePath ($TeamViewer.UninstallString) -ArgumentList "/S" -WindowStyle Hidden

3
J
1 year ago
J
jesumyipPower User
posted in Community Worklets

Create scheduled task to run at user log-on as user him/herself

Hi everyone We sometimes have a requirement to replicate the behaviour of GPOs that run in the user context. This means you need to execute a task under the current logged on user and trigger it to occur only when user logs on. To achieve this, we can use a scheduled task with 2 special settings: It is triggered only when a user logs on It runs under the context of the local “USERS” group. With #2, you are able to access all the usual user-context-specific data such as %USERNAME%, HKCU, etc. And, this approach makes the scheduled task run under the context of ANY user that logs on. Say for example you have 2 users - USERA and USERB logging on, the scheduled task will take on the security context of USERA or USERB depending on who logs on. Unfortunately, you cannot achieve this with the New-ScheduledTask cmdlet. You will have to use COM programming. Here’s the code: $ShedService = New-Object –comobject 'Schedule.Service' $ShedService.Connect() $Task = $ShedService.NewTask(0) $Task.Re

4
D
1 year ago
C
chevychaserRookie
posted in Community Worklets

Install Nessus Agent on Linux Hosts - Bash Script

has anyone created any worklets or required software policy for installing Nessus on linux hosts? This would include configuring the agent with the necessary switches.

2
C
1 year ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Community Worklets

Worklet: Windows Cleanup Tool

This worklet will allow you to run the Windows Cleanup Tool on any of your Windows endpoints, based on the amount of free space remaining on the C: drive. If you use the /SageSet and /SageRun commands, you’ll need to create presets on the endpoints first. This /SageSet process can be automated, as some folks have demonstrated here: stackoverflow.com Automate process of Disk Cleanup cleanmgr.exe without user intervention powershell, registry, powershell-3.0, resource-cleanup asked by Pinte Dani on 11:01AM - 04 Mar 15 UTC If you don’t want to bother with the /SageSet presets you can use the /VeryLowDisk flag instead, with the caveat that this will pop up the scan completion window on the endpoint, which might be confusing to users. More documentation on the cleanmgr.exe flags here: Winaero – 2 Dec 16 Disk Cleanup Cleanmgr Command Line Arguments in Windows 10 The built-in tool, Dis

1
M
1 year ago
C
CSV
posted in Community Worklets

Dell Command | Batch File either not running or not producing log file

I have a batch file which disables BIOS updates in Dell command: “%PROGRAMFILES%\Dell\CommandUpdate\dcu-cli.exe”/configure -autoSuspendBitLocker=disable -outputLog=C:\Temp\dell.log The remediation code is: Copy-Item -Path “dellcommand.bat” -Destination “c:\Temp” Start-Process C:\Temp\dellcommand.bat New-Item -Path “C:\Program Files\Dell\CommandUpdate” -Name “BIOSudDisabled” -ItemType “Directory” It copies the batch file to the temp folder and creates the new folder but there is no evidence of the batch file actually being executed. I can’t seem to get my head around why as everything works fine when run locally. Any help appreciated.

2
C
1 year ago
jack.smith
jack.smithAll Star
posted in Community Worklets

Windows Update Troubleshooter

This will kick off the Windows Update Troubleshooter process and attempt to report back results of the process into the activity log. Remediation Code $tsp = Get-TroubleshootingPack C:\Windows\diagnostics\system\WindowsUpdate Invoke-TroubleshootingPack -Pack $tsp -AnswerFile .\WUDAnswers.xml -Unattended -Result $env:HomeDrive\WUDResult [xml]$xml = Get-Content $env:HomeDrive\WUDResult\ResultReport.xml $xml.ResultReport.Package.Problem.DetectionInformation.DetailedInformation.Detail.Contents.Objects.Object | % { write-output $_.'#text';write-output ". " }

0
jack.smith
1 year ago
Stambo-Automox
Stambo-AutomoxAutomox Employee
posted in Community Worklets

Check disk space on C: drive

Automox requires a minimum of 3GB of free disk space in order to execute daily functions prioperly. This worklet checks for free disk space on the C:\ drive. The worklet will produce a result in the Activity Log only if a host has less than 3.0GB of free space on the C:\ drive. Evaluation: $runCheck = { $minDiskSpaceGB = 3.0 $diskCheck = Get-WmiObject -Class Win32_logicaldisk -Filter "DriveType = '3'" | Where-Object {$_.DeviceID -eq "C:"}| Select-Object -Property DeviceID, @{L='FreeSpaceGB';E={"{0:N2}" -f ($_.FreeSpace /1GB)}},@{L="Capacity";E={"{0:N2}" -f ($_.Size/1GB)}} | Where-Object {[float]$_.FreeSpaceGB -lt $minDiskSpaceGB} if ( $diskCheck -eq $null ) { return 0 } else { return 1 } } exit $exitCode = & $runCheck Remediation: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } $runCheck = { $minDiskSpaceGB = 3.0 $diskCheck = Get-WmiObject -Class Win32_logicaldisk -Filter "DriveType = '3'" | Where-Object {$_.DeviceID -eq "C:"}| Select-Object -Property De

5
Stambo-Automox
1 year ago
O
ORORNovice
posted in Community Worklets

Knowbe4 Phish Alert Button(PAB) installation

I have this KB article: Outlook (Client-based) Phish Alert Button Product Manual – Knowledge Base Can anyone help me to create the worklet for Win10 device?

2
O
1 year ago
D
David_MitchellNovice
posted in Community Worklets

Worklet: Example of a workflow to continue across reboots to fix corrupt Sophos install using scheduled tasks

This is something that I put together to fix corrupt installs of Sophos caused by our old imaging system. The logic could be used for any workflow that needs to span reboots and continue. I am attaching two executables and two PowerShell scripts to the worklet. The worklet then copies them to C:\Windows\Temp so they are not removed when the worklet completes and they can continue after reboot. Eval code -I always want this to run on whatever target devices are selected Exit 1 Remediation Code #Create scheduled task to trigger script1 on next boot $AtStartup = New-ScheduledTaskTrigger -AtStartup -RandomDelay 00:00:30 $Settings = New-ScheduledTaskSettingsSet $Principal = New-ScheduledTaskPrincipal -UserID "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount -RunLevel Highest $Action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-NonInteractive -NoLogo -NoProfile -ExecutionPolicy Bypass -File "c:\windows\temp\script1.ps1"' $Task = New-ScheduledTask -Trigger $AtStartup -Settin

0
D
1 year ago
gareth.blakecoggins
gareth.blakecogginsRookie
posted in Community Worklets

Carbon Black - Windows

Afternoon, I have managed to find a worklet for installing Carbon Black on a Mac EndPoint - but I am unable to find one for installing on a Windows Endpoint, is there a template available or has anyone else had any luck in writing one? The “12 Hour” time frame from the CB console is too long for sensible deployments 🙂 Thanks

2
owl-IT
1 year ago
S
scriptpirateNovice
posted in Community Worklets

System needs a reboot prompting script?

I wonder if its possible to make a mac script that would check if system is pending a reboot and then push user notifications to do it, not necessary to have an option for user to do it from the message, just want to alert user they need to reboot…repeatedly…until they hopefully do.

18
S
1 year ago
Marina-Automox
Marina-AutomoxAutomox Employee
posted in Community Worklets

Worklet: SeriousSAM/HiveNightmare LPE Vulnerability (CVE-2021-36934)

The following worklet is used to mitigate the abuse of a low privilege user that have RX permissions in the %windir%\system32\config directory. With the availability of VSS shadow copies, this low privilege user may obtain credentials and DPAPI computer keys, install programs, delete data, or create new accounts. The following worklet follows the recommendations of Microsoft for a suggested workaround. Note: The recommendations provided by Microsoft includes the deletion of shadow copies. Please be advised that ransomware authors may also delete shadow copies, and many antiviruses and EDR solutions may block or flag this activity. Additionally, depending on your backup software and/or policies, this mitigation may conflict with your existing practices. Please consult with your IT/Security policies first prior to implementing this worklet. Also per best practice, please also test this worklet on a small sample size prior to implementing across the organization. Evaluation Code To evalu

9
Marina-Automox
1 year ago

Badge winners

Show all badges
Terms & ConditionsCookie settings