Automox Developer Resources

Dev Hub

481 Topics

H
Hunter_Klein
posted in Community Worklets

Installing the Arctic Wolf Agent via Automox

Installing the Arctic Wolf Agent Recently we had to go about deploying an agent from a managed SOC called “Arctic Wolf” to all of our server endpoints. The trouble is, the MSI file had to be in the same directory as a “customer.json” file in order to work. This was an issue because Automox only allows you to upload the MSI. Luckily, with PowerShell your imagination is the limit. This is how we got around the limitation as the “customer.json” file is a rather small (one line) file and can be created at runtime with PowerShell. Create a Required Software policy for Windows Upload the MSI to Automox Set the Package Name and Package Version to how it appears in the Win32_Product WMI class when installed on a machine. This is how Automox determines if the package is installed and if a machine is compliant. Currently as of writing this, the name is Arctic Wolf Agent 2020-05_01 and the version is 20.20.0501. Use the following PowerShell syntax to install the software, replacing the customerU

8
Ariel-Automox
2 years ago
J
JHagstromPro
posted in API & Integrations

Script | Export all applied patches from all company machines to CSV

Hello! Thought I would share this API script I wrote that exports all applied patches on all machines to a CSV. UseCase: For audits this allows an easy way to export every single patch on a machine to prove that machines have been patched during a time period. Notes: This is meant to be run on a machine NOT through a worklet. Make sure to add in your own API Key for this to work. For a full list of objects you can pull from the API see Automox API Documentation under “Response”. This script is not perfect. If run multiple times it will keep adding to the same CSV, so make sure to either clear the CSV and save or just delete it. Powershell Code: #Set Execution policy to allow for 3rd party modules Set-ExecutionPolicy Unrestricted -Force #Define API Key and URL to get initial Machine list $apiKey = "*INSERT YOUR API KEY HERE*" $apiUrl = "https://console.automox.com/api/servers/" $headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" $headers.Add("Authorizatio

0
J
2 years ago
Tony-Automox
Tony-AutomoxAutomox Employee
posted in Community Worklets

Worklet: Install Notepad++ for Windows

Download the version of Notepad++ you want to install, upload it to the worklet, and set $saveFile in the remediation to match the name of the file you upload. Evaluation: <# .SYNOPSIS This Test script checks to see if an application is installed .DESCRIPTION This script queries the installed files for 64bit software and returns a 0 if product is installed or 1 if not .Notes File Name :App_Install_Test.ps1 Author :Automox Prerequisite :PowerShell V2 over Win7 and later #> #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function App_Install_Test { <# .SYNOPSIS This function Checks to see if app is installed on system or not . .DESCRIPTION After checking the app availability, based on the exit code tool will decide to call remediation code or not. #> ## Name of the desired application ## $appName = 'Notepad' ## You must also hard-code the app name in the $scriptblock be

0
Tony-Automox
2 years ago
Tony-Automox
Tony-AutomoxAutomox Employee
posted in API & Integrations

API: Locate GUID for package to use InstallUpdate command in "Issue a Command to a Device"

If trying to use the InstallUpdate command to “Issue a Command to a Device”, you’ll see that it wants a GUID for the update: https://docs.automox.com/api/endpoints/issue-a-command-to-a-device So that you don’t have to comb through the registry trying to find it, you can run this script on a device that has the update installed to find the GUID so that you can use it to install it on other devices with API: $UninstallKeys = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall", "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" $null = New-PSDrive -Name HKU -PSProvider Registry -Root Registry::HKEY_USERS $UninstallKeys += Get-ChildItem HKU: -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'S-\d-\d+-(\d+-){1,14}\d+$' } | ForEach-Object { "HKU:\$($_.PSChildName)\Software\Microsoft\Windows\CurrentVersion\Uninstall" } if (-not $UninstallKeys) { Write-Verbose -Message 'No software registry keys found' } else { foreach ($UninstallKey in $Uninst

0
Tony-Automox
2 years ago
Wes-Automox
Wes-AutomoxAutomox Employee
posted in Community Worklets

Worklet: Disable weak and vulnerable algorithms in sshd

Howdy! Here is a worklet to detect and disable weak and vulnerable algorithms in the sshd service. These algorithms are usually kept enabled for compatibility reasons but they’re usually safe to disable if your users have updated systems. Here is a good write-up on known weak and vulnerable algorithms. Evaluation: #!/bin/bash sshd -T | grep "\(ciphers\|macs\|kexalgorithms\)" | grep "\(sha1\|rc4|arcfour|md5|blowfish|idea|3des|cast128|cbc\)" # return 0 if value exists; return non-zero if value does not exist [[ $? -eq 0 ]] && exit 1 exit 0 Remediation: #!/bin/bash # Add a definitive list of ciphers to the sshd config. This list was tested to work on a fresh install of Ubuntu 18.04 cat >> /etc/ssh/sshd_config <<EOL Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256 MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@ope

0
Wes-Automox
2 years ago
AdamW-Automox
AdamW-AutomoxAutomox Employee
posted in Community Worklets

Worklet: Automatic OS Upgrade to Windows 10 1909

Hi Ya’ll Big Shoutout and thanks to @rich for getting the information needed in order for this script to work successfully! This is a one-click automatic upgrade without needing to pre-deploy the 1909 .iso image to your devices. This Worklet will automatically build out the download link for 1909 based on your OS’s architecture, download the .iso image to you local system, mount the .iso to a disk drive, and then automatically run the download setup all silently without any user interaction. It will remove the iso after the installation completes. The Evaluation and Remediation code for the Worklet is as follows: Evaluation: $iso = "C:\programdata\Windows1909OSUpgrade.iso" if ((Test-Path $iso) -eq $true) {Remove-Item $iso } $osversion = (Get-Item "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion").GetValue('ReleaseID') if (($osversion -lt "1909")) {exit 1 } else {exit 0 } Remediation: $lang = "English" $locID = "en-US" $verID = "Windows10ISO" $skuID = "9029" $prodID =

35
D
2 years ago
Maikel
MaikelChannel Partner
posted in Community Worklets

Upload Automox agent logfile to Azure Storage Container

So i was looking for a quick way to retrieve a log file of an automox enabled system without physical or netwerk access. It had to be lean mean and fast so i came up with this solution to upload the logfile to a azure blob storage container using a sas-token. only fill out the url variable before the slash and sas token variable and you are good to go! Evaluation code exit 1 Remediation Code if ($PSVersionTable.PSVersion -eq "2.0") { Write-Output "This worklet requires PowerShell version 3.0 or higher!" exit 0 } else { $Policy = "RemoteSigned" If ((Get-ExecutionPolicy) -ne $Policy) { Set-ExecutionPolicy $Policy -Force Write-Output "Changed execution policy to 'RemoteSigned'. "} #SAS Token $sas = "" #Automox Log File Location $filesource = "C:\Programdata\amagent\amagent.log" #Copy Log File Copy-Item $filesource -Destination "C:\Programdata\amagent\amagent_upload.log" $file = "C:\Programdata\amagent\amagent_upload.log" #Get the File-Name without path + add computername +

10
Maikel
2 years ago
J
jesumyipPower User
posted in Community Worklets

Disable Office Macros - Malware Protection

Hi all Are you guys seeing a sudden spike of Emotet related spam mails arriving? The org I’m working in is seeing this. They arrive from compromised email accounts. The email messages are hijacked from original email conversations so the content looks 100% legit. The email has a password encrypted ZIP file, which has macros, which decrypts some obfuscated Powershell, which then runs to download the actual Emotet payload. I would like to share a worklet I’ve developed based on: https://www.microsoft.com/security/blog/2016/03/22/new-feature-in-office-2016-can-block-macros-and-help-prevent-infection/. The necessary registry settings can be found here: https://www.slipstick.com/outlook/block-macros-office-20132016/ Here’s the worklet. The registry settings are under HKCU, so the powershell code to do this is a bit more convoluted. The nice thing about the code below is it will work whether there is a current user logged in or not (since Automox’s agent runs in the SYSTEM context, accessing

0
J
2 years ago
Maikel
MaikelChannel Partner
posted in Community Worklets

Reset Windows Update Settings (Without Reboot)

There a various topics on this community about resetting windows updates to its default settings. The attached worklet is similair to others posted but it can be run without a reboot. So far we have very good results with this worklet in production environments and because the reboot is not necessary it can be used without user impact. This worklet will me maintained on Github: github.com Dutch-Technology-eXperts/Automox/blob/main/windows_updates_settings_reset.ps1 #Evaluation Code Exit 1 #Remediation Code $arch = Get-WMIObject -Class Win32_Processor -ComputerName LocalHost | Select-Object AddressWidth #1. Stopping Windows Update Services... Stop-Service -Name BITS Stop-Service -Name wuauserv Stop-Service -Name appidsvc Stop-Service -Name cryptsvc #2. Remove QMGR Data file... Remove-Item "$env:allusersprofile\Microsoft\Network\Downloader\qmgr*.dat" -ErrorAction SilentlyContinue #3. Renaming the Software Distribution and CatRoot Folder... Remove-Item $env:system

0
Maikel
2 years ago
M
Melvin_Luijten
posted in Community Worklets

Worklet: workaround for CVE-2020-16898

In this worklet we check if a host is possibly vulnerable for CVE-2020-16898 based on the OS version and the installation status of the patch. If the patch is not installed the workaround is implemented. For more info check: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-16898#ID0EUGAC The only manual task is to later revert this change when the patch is applied. Evaluation code: #define osversion number $osversion = (get-itemproperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -Name ReleaseId).ReleaseId #define KB Number and check for presence $1709 = 'KB4580328' $1803 = 'KB4580330' $1809 = 'KB4577668' $1903 = 'KB4577671' $2004 = 'KB4579311' #Check applicable OS version and installation of patch if ($osversion -eq '1709'){ $patched1 = Get-Hotfix -Id $1709 -ErrorAction SilentlyContinue } elseif ($osversion -eq '1803'){ $patched2 = Get-Hotfix -Id $1803 -ErrorAction SilentlyContinue } elseif ($osversion -eq '1809'){ $patched3 = Get-Ho

0
M
2 years ago
Tony-Automox
Tony-AutomoxAutomox Employee
posted in Community Worklets

Worklet: Add Shortcut to Web Application Specifying Which Browser to Use

This worklet as written adds a Chrome shortcut to the user’s desktop and start menu named “TSheets” which points to a web app. You can choose to only create the shortcut in one place or the other if you want. If you wish your app to be opened with a different browser, specify $BrowserPath to point to the installed browser you wish to use. The parameters in the remediation below describe how to set the variables. Evaluation: Exit 1 Remediation: <# .PARAMETER BrowserPath Location of the Google Chrome browser executable. Google Chrome needs to already be installed for this script to work. If you wish for a different browser to execute the Web App, alter $BrowserPath .PARAMETER ShortcutName Display Name of the shortcut. .PARAMETER ShortcutUrl URL associated with the shortcut. .PARAMETER ShortcutIconLocation Optional: Path to an icon to associate with the shortcut. .PARAMETER ShortcutOnDesktop Set to $true if the Shortcut n

0
Tony-Automox
2 years ago
A
andrew_moon
posted in Community Worklets

Disable USB ports

Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR” -Name “start” -Value 4

0
A
2 years ago
J
JHagstromPro
posted in Community Worklets

Worklet: Change Local GPO + Security Options

Disclaimer: This uses a 3rd party Powershell addon called “PolicyFileEditor”. The addon is trusted and has around 29M downloads. Another addon named “NuGet” is installed as PolicyFileEditor doesnt seem to work without it. More detail on the addon can be found here: https://www.powershellgallery.com/packages/PolicyFileEditor/3.0.1 Hello All! Just made this worklet and thought I’d share incase anyone else finds it useful. Use case: For remote employees that are off domain network and cannot have GPO’s applied to them and need to have password policies applied to their machines for compliance reasons. The worklet is pretty straight forward and labeled. You can feel free to remove the “Write-Host” lines as they are just for reporting purposes. Code: #Set Execution policy to allow for 3rd party modules Set-ExecutionPolicy Unrestricted -Force #Instal NuGet which is needed for PolicyFileEditor Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force #Install PolicyFileEditor Inst

0
J
2 years ago
N
ncarawayRookie
posted in Community Worklets

Install CylanceProtect on Macs

!/bin/bash mkdir /tmp/cylanceinstall scp CylancePROTECT.pkg /tmp/cylanceinstall sleep 3 echo [Copy install token here] > /tmp/cylanceinstall/cyagent_install_token sudo installer -pkg /tmp/cylanceinstall/CylancePROTECT.pkg -target /

0
N
2 years ago
T
TechieOneKenobiRookie
posted in Community Worklets

Script I use to remove various things before I image a clean install

#Set-up script to remove apps and enable/disable features. #Creates a logfile in C: Start-Transcript -Path C:\SetupLog.txt -NoClobber #List of apps to remove. May be ammended in the future. #Please Note: Do Not Remove the Windows Store App. This will cause problems. $AppsToRemove = @( “Microsoft3DViewer” “GetHelp” “Getstarted” “OfficeHub” “SolitaireCollection” “MixedReality” “OneNote” “People” “SkypeApp” “Wallet” “Alarms” “windowscommunicationsapps” “FeedbackHub” “Finance” “News” “Sports” “SoundRecorder” “XBox” “YourPhone” “Zune” “LinkedIn” “DellInc” “Watchdog” “Messaging”) #This is the main loop that removes the programs specified. #It removes the apps from the current user and from provisioned packages preventing them from being #installed when a new user profile is created, such as when a domain user logs into a new computer. ForEach($App in $AppsToRemove){ Get-AppxPackage -AllUsers | ? Name -Like “$App” | Remove-AppxPackage Get-AppxProvisionedPackage -Online | ? DisplayName -Like

0
T
2 years ago
ChrisL-Automox
ChrisL-AutomoxFormer Automox Employee
posted in Community Worklets

Install Brave Browser on Debian 9+, Ubuntu 14.04+ and Mint 17

I wanted to make it easier for folks to install my favorite privacy-focused browser on Linux, so I’m sharing this script. Hope to increase adoption of this great browser!! Evaluation: exit 0 Remediation: sudo apt install apt-transport-https curl curl -s https://brave-browser-apt-release.s3.brave.com/brave-core.asc | sudo apt-key --keyring /etc/apt/trusted.gpg.d/brave-browser-release.gpg add - echo "deb [arch=amd64] https://brave-browser-apt-release.s3.brave.com/ stable main" | sudo tee /etc/apt/sources.list.d/brave-browser-release.list sudo apt update sudo apt install brave-browser

0
ChrisL-Automox
2 years ago
NickW-Automox
NickW-AutomoxAutomox Employee
posted in Community Worklets

Clear cache, cookies and history from IE and Chrome

Figured it might be good to clear caches and cookies with a Worklet. Found this script fo target IE, Chrome and Chromimum directories together, and lets you define how old of data you’d like to remove by defining $DaysToDelete. This is written to be run manually. I’m repurposing this script from a script I found online because I’m jealous of the Yeti tumblers and this also seems like a good worklet to have (scanned this script with my sales eyes and it looks legit): Evaluation exit 0 Remediation: $DaysToDelete = 1 ## Set this to the number of days to keep data on the device $temporaryIEDir = "C:\users\*\AppData\Local\Microsoft\Windows\Temporary Internet Files\*" ## Remove all files and folders in user's Temporary Internet Files. $cachesDir = "C:\Users\*\AppData\Local\Microsoft\Windows\Caches" ## Remove all IE caches. $cookiesDir = "C:\Documents and Settings\*\Cookies\*" ## Delets all cookies. $locSetDir = "C:\Documents and Settings\*\Local Settings\Temp\*" ## Delets all local se

0
NickW-Automox
2 years ago
BustaBubz11
BustaBubz11Rookie
posted in Community Worklets

Worklet: Robocopy backup for Documents Folder on endpoint

robocopy C:\users\zacp\documents f:\mybackup\documents /copyall /e /r:0 /dcopy:t /mir

0
BustaBubz11
2 years ago
Tony-Automox
Tony-AutomoxAutomox Employee
posted in Community Worklets

Worklet: Windows Reboot History

This worklet will return the recent reboot history for the machine(s) it’s run against. As written it returns the 5 most recent reboots, but you can change that number to your liking. It is also written with what I felt were the most important fields to see, but you can change the last Select-Object statement to include additional fields listed in the first Select-Object statement. This worklet is designed to be run manually. If you schedule it, change the evaluation to “Exit 1”. Evaluation: Exit 0 Remediation: Get-WinEvent -FilterHashtable @{logname='System'; id=1074} | ForEach-Object { $rv = New-Object PSObject | Select-Object Date, User, Action, Process, Reason, ReasonCode, Comment $rv.Date = $_.TimeCreated $rv.User = $_.Properties[6].Value $rv.Process = $_.Properties[0].Value $rv.Action = $_.Properties[4].Value $rv.Reason = $_.Properties[2].Value $rv.ReasonCode = $_.Properties[3].Value $rv.Comment = $_.Properties[5].Value $rv } | Select-Ob

0
Tony-Automox
2 years ago
Tony-Automox
Tony-AutomoxAutomox Employee
posted in Community Worklets

Worklet: BitLocker Compliance Checker

This worklet as written checks all drives on non-server Windows devices for BitLocker compliance. You can remark out or alter the first IF statement to account for more types of systems. Compliance consists of full drive encryption AND protection status is on. If you schedule it, it will report to the activity log ONLY the devices that aren’t fully compliant on every drive in the system. If you manually run it (or change the evaluation to just: Exit 1), it will report compliance and non-compliance on ALL devices to the activity log unless you put the $HardwareType check from the evaluation into the remediation to pare down the types of devices checked. Evaluation: # PowerShell 4.0 and Above # Windows 8 and later $HardwareType = (Get-WmiObject -Class Win32_ComputerSystem).PCSystemType # Exit if computer is known type and a server # Remark out this line if you want all hardware checked, or change the if statement to the hardware you want # $HardwareType = 0-Unknown, 1-Desktop, 2-Mobil

0
Tony-Automox
2 years ago
J
jesumyipPower User
posted in Community Worklets

Skype for Business uninstall

Hi everyone As we know, Microsoft is retiring Skype for Business next year from the suite of Office 365 applications. We haven’t found a way to uninstall Skype for Business unless you either Modify the installed O365 package (option to Modify isn’t always available, depending on how you installed it initially), or you completely uninstall the entire suite of Office 365 apps, and reinstall it without Skype for Business (which is a royal pain in the ***!). I’ve opted to do 3 things Stop the Skype for Business auto-start process (this is a registry setting). You can read about it here https://answers.microsoft.com/en-us/msoffice/forum/msoffice_sfb-mso_winother-mso_o365b/stop-skype-for-business-from-starting/44c65b0a-a2b3-4d65-877c-70bfd2adb052. I found out later on Windows 10 that there is a catch to this. You also need to terminate the Skype process otherwise this won’t work. The settings are ignored. Hence do a “Stop-Process lync” to achieve this. You can read about it here https://ans

0
J
2 years ago
Tony-Automox
Tony-AutomoxAutomox Employee
posted in API & Integrations

Execute Multiple Policies on a Windows Machine Using API

This script will apply multiple policies from your organization to a system. Say you always apply the same five policies to a newly built system, you could use this to apply those policies with one click to your new system. This will install any policy available in your organization regardless of whether it is attached to the group the system is in or not. Make sure you’re not attempting to apply a macOS/Linux worklet or required software to a Windows device. Just set the following: $apiKey = 'YOUR_API_KEY' - in your console, go to Settings->API and select the API key. Note that the API key is per admin user, so you and another admin in your console will have different API keys. $orgID = 'YOUR_ORG_ID' & $serverID = 'YOUR_SERVER_ID' - put your Org ID & Server ID which can be found by looking at the URL on the device page and selecting the value after the “?s=” & “?o=”: [https://console.automox.com/device-detail?s=99999&o=1234]. In this example the Server ID is 999

4
Nic-Automox
2 years ago
jbragdon
jbragdonRookie
posted in Community Worklets

Worklet: Get-IPConfigurations

______ __ ________ ______ _____ __ _ / ____/__ / /_ / _/ __ \/ ____/___ ____ / __(_)___ ___ ___________ _/ /_(_)___ ____ / / __/ _ \/ __/_____ / // /_/ / / / __ \/ __ \/ /_/ / __ `/ / / / ___/ __ `/ __/ / __ \/ __ \ / /_/ / __/ /_/_____// // ____/ /___/ /_/ / / / / __/ / /_/ / /_/ / / / /_/ / /_/ / /_/ / / / / \____/\___/\__/ /___/_/ \____/\____/_/ /_/_/ /_/\__, /\__,_/_/ \__,_/\__/_/\____/_/ /_/ /____/ https://github.com/bragdonjm/PS-Automox-Worklets/blob/main/Worklets/Get-IPConfiguration.ps1 Computer system sprawl is a real thing. Finding specific information about a system in some easy to use automatic method can be tricky. Here is a worklet to grab detailed information about all network interfaces on a remote windows system. Note: - Powershell is only. - Verbose is supported though there is not m

0
jbragdon
2 years ago
jbragdon
jbragdonRookie
posted in Community Worklets

Worklet: Get-FailedLogons

______ __ ______ _ __ ____ / ____/__ / /_ / ____/___ _(_) /__ ____/ / / ____ ____ _____ ____ _____ / / __/ _ \/ __/_____/ /_ / __ `/ / / _ \/ __ / / / __ \/ __ `/ __ \/ __ \/ ___/ / /_/ / __/ /_/_____/ __/ / /_/ / / / __/ /_/ / /___/ /_/ / /_/ / /_/ / / / (__ ) \____/\___/\__/ /_/ \__,_/_/_/\___/\__,_/_____/\____/\__, /\____/_/ /_/____/ /____/ https://github.com/bragdonjm/PS-Automox-Worklets/blob/main/Worklets/Get-FailedLogons.ps1 Computer not connected to Activate Directory can have issues reporting failed login attempts. Through Automox Worklets, you can now query batches of remote Windows computers running Automox for any failed logins attempts. A nicely formated table including the most relevent metadata is returned. Note: - This script must be run as admin. To access the security log, you must run this throu

0
jbragdon
2 years ago
jbragdon
jbragdonRookie
posted in Community Worklets

Worklet: Get-DiskSpace

_____ _ ______ _ _ | __ \ | | | _ \(_) | | | | \/ ___ | |_ ______ | | | | _ ___ | | __ ___ _ __ __ _ ___ ___ | | __ / _ \| __||______|| | | || |/ __|| |/ // __|| '_ \ / _` | / __| / _ \ | |_\ \| __/| |_ | |/ / | |\__ \| < \__ \| |_) || (_| || (__ | __/ \____/ \___| \__| |___/ |_||___/|_|\_\|___/| .__/ \__,_| \___| \___| | | |_| https://github.com/bragdonjm/PS-Automox-Worklets/blob/main/Worklets/Get-DiskSpace.ps1 End users calling you day and night complaining about disk space? Need a fast way to check remote disk space? Are you running Automox? You are in luck! Use this script to report back disk space usage and User Folder total usage. Note: - Powershell is only. - Verbose is s

0
jbragdon
2 years ago

Badge winners

Show all badges
Terms & ConditionsCookie settings