Automox Worklets

Hey guys, It has come up a few times that modifying HKCU in a worklet doesn’t behave as expected. This is because the process is running under the SYSTEM account. So only the keys under the SYSTEM SID (S-1-5-18 ) will be modified if you point to HKCU:\. This evaluates and sets the desired value for every local user account tied to that device: Evaluation #Define desired registry settings $regPath = "Key Path Here" $regName = "Property/Value Name Here" $desiredValue = "I'm a String" #Get User details including SID from Get-LocalUser $users = Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount = 'True'" #Add HKEY_USERS to a PSDrive for easy access later New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS -ErrorAction SilentlyContinue | Out-Null $nonCompliant = @() #Loop through the list of users to check each for compliance foreach ($user in $users) { #Retrieve SIDs for each user $sid = $user.SID $name = $user.Name #Load Registries for users, if ntus

Have a few PowerShell scripts I’ve been testing and for some reason they will not work properly via an Automox policy, but if I run them locally they seem to work fine. RDP Disable - Worklet Set-ItemProperty -Path “HKLM:\System\CurrentControlSet\Control\Terminal Server” -Name “fDenyTSConnections” –Value 1 Teams Install - Required Software Start-Process -FilePath “Teams_windows_x64.exe” -ArgumentList “-s” -Wait -PassThru To my knowledge the Automox agent is supposed to run all the PowerShell commands as SYSTEM which should have elevated privileges. Was hoping to see if anyone else has run into this and what I can do to resolve it? Thanks in advance.

I have been testing the Enforce REboot Policy and it works as designed, however the message either is flashing to fast for me to see or it’s now showing up at all. Below is the code I’m using. Is there anything else I need to do to get the message to show. $execute = “C:\Windows\System32\msg.exe” $message = “Machine will reboot in 30 second Please save all work” $time = (Get-Date).AddSeconds(30) $triggerAt = New-ScheduledTaskTrigger -At $time -Once $currentusr = (Get-WmiObject -class win32_process -ComputerName ‘localhost’ | Where-Object name -Match explorer).getowner().user $argument = $currentusr + " " + “/W” + " " + $message $command = $execute + " " + $argument + " " + “| Out-Null `n” New-Item -Path “c:\ProgramData\Amagent” -Name “message.ps1” -ItemType “file” -Value $command Add-Content -Path “c:\ProgramData\Amagent\message.ps1” -Value “Restart-Computer” $action = New-ScheduledTaskAction -Execute Powershell.exe -Argument “-windowstyle hidden c:\ProgramData\Amagent\message.ps1” R

I cobbled this together from several items in the Automox Labs and API documentation: $orgID = "myorgid" $apiKey = 'myapikeyhere' $filepath = ‘.\ServerInventory.csv’ $page = 0 $limit = 500 $data = @() Write-Output "Page" while($true) { $headers = @{"Authorization" = "Bearer $apiKey" } $url = "https://console.automox.com/api/servers?$orgID?l=$limit&p=$page" $response = (Invoke-WebRequest -Method Get -Uri $url -Headers $headers).Content | ConvertFrom-Json Write-Output $page $data += $response $page += 1 if($response.count -lt $limit) { break } } $data | Group-Object display_name | Sort-Object name | Select-Object Count,name ` | Export-Csv -Path $filepath -NoTypeInformation The result is that it produces a csv of 500 server names as I’d expect. When I change “$page” to “1” in the script (and change the csv output file name) and run it again, it produces a new, blank csv. I’ve read this: About Automox API and feel like I’m doing

The idea behind this worklet is to display balloon tip in the taskbar once every 5 hours and then every 15 minutes to warn end users of an upcoming reboot and when. If an end user reboots during the notification stages, there is a scheduled task that triggers upon restart that will run another powershell script that was written to cancel out running any future events built by this worklet. The notification is using a custom icon file I built using a company logo. Please do a lot of testing beforehand as the code is not professionally written to accommodate for every scenario one could encounter. Enjoy! Evaluation Code # Cleanup prior reboot task Unregister-ScheduledTask -TaskName 'RebootMsg*' -Confirm:$false | Out-Null # Establish Reboot Data Points $uptime = (get-date) - (gcim Win32_OperatingSystem).LastBootUpTime $sysInfo = New-Object -ComObject "Microsoft.Update.SystemInfo" if($sysInfo.RebootRequired -or $uptime.Days -gt 28) { exit 1} else { exit 0} Remediation C

Hi Everyone, I have created a worklet using the Community Worklet, "Targeted Reboot within Timeframe’. Issue is, i am unable to make this run using the Schedule. I have set the Schedule time 2am everyday and ticked ‘If a device misses configured patch time, it will patch next time the device checks in’ along with setting targeted time within the script of 2am Start time and 5.45am End Time. With checking the Activity Log for this Worklet, nothing appears. If i Run the Policy Manually, it works great and as expected, the server is evaluated, Rebooted if Pending and adds a record into the Activity Log. Can worklets run using the Schedule or is something else required? Appreciate any assistance. Cheers,

This section contains covers the Worklet that automatically applies the CIS recommendations for (1) Account Policies (1.2) Account Lockout. It is highly recommended that all Windows devices adhere to these recommendations and be evaluated frequently to ensure compliance. 1.2.1 (L1) Ensure ‘Account lockout duration’ is set to ‘15 or more minute(s)’ 1.2.2 (L1) Ensure ‘Account lockout threshold’ is set to ‘10 or fewer invalid logon attempt(s), but not 0’ 1.2.3 (L1) Ensure ‘Reset account lockout counter after’ is set to ‘15 or more minute(s)’ You can set these to be more restrictive than the settings above, but the following remediation code run without changes will set the thresholds as listed above. Remediation code: #SYPNOSIS #Automatically configures the Account Policies -> Account Lockout Policies the CIS recommended configuration for Windows 10 1809 #1.2 Account Lockout Policy #1.2.1 Ensure 'Account lockout duration' is set to '15 or more minute(s)' #1.2.2 Ensure 'Account lockou

I just wanted to share an example of getting creative with installs. This software will require a user prompt to install the certificates, but if they are already installed, you can install it silently. So I installed the software on a workstation manually and exported the certs. I added them to the policy package and use powershell to install the certs before installing the software. #REQUIRES -Version 2.0 <# .SYNOPSIS This script allows an admin to install Arduino IDE. .DESCRIPTION #> #Handle Exit codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function Arduino{ #############Change the settings in this block####################### ##################################################################### Try { certutil -addstore TrustedPublisher ArdruinoLLC.cer certutil -addstore TrustedPublisher ArdruinoSRL.cer certutil -addstore TrustedPublisher adafruit.cer Start-Process -FilePath "arduino-1.8.16-windows.exe" -A

Here is a quick way to check if a device has TPM 2.0. The output is written to reports > activity log. I’m sure there is a better way to do this, but on the other hand, it is better than checking devices manually. Remediation code: $info = (wmic /namespace:\root\cimv2\security\microsofttpm path win32_tpm get * /format:textvaluelist.xsl)) write-output $info exit 0

I am looking for a way to perform a disk cleanup that will delete temp files. I would like to perform it on command and also run daily on users computers. Thanks in advance

I’m working on a worklet to install Enercalc. In the documentation it says to run it unattended to use: ECSEL6_SETUP.EXE /S /Q /V PAC “my_PCC_CODE_HERE” I wrote just a quick and dirty oneliner to just to see if I could get it to work as I never wrote a worklet before. I came up with: Start-Process -FilePath 'ecsel20_setup.exe' -ArgumentList ('/s', '/q', '/v', "_PAC_", '"MY_PCC_CODE_HERE"') -Wait -Passthru In a powershell, it works great and install. I decided to test it on a worklet and something interesting happened. During the install of Enercalc, if you don’t have the Microsoft VC++ redistributables installed on the PC it automatically installs them. So the Enercalc install automatically installed all of them on my test machine, except didn’t install Enercalc. I’m really not sure where to go to try and figure out what’s going on, but a thought that I have is that during the install of Enercalc it displays an install screen during install, but I’m not sure if that would affect this

Hey guys, just need some assistance finalising the Java worklet. The automatic patching seems to have uninstalled Java from a fair few machines so need to resolve. It works fine running from the local machine, however no luck from Automox. Eval is fine. It downloads the two files then does not run the commands; installing 2 instances of Java (32 and 64bit). #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } try{ $process1 = Start-Process -FilePath 'jre-8u271-windows-i586.exe' -ArgumentList '/s', 'REMOVEOUTOFDATEJRES=1', '/L C:\ProgramData\amagent\worklets\java\java_86.log' -Wait -Passthru -ErrorAction Stop $process2 = Start-Process -FilePath 'jre-8u271-windows-x64.exe' -ArgumentList '/s', '/L C:\ProgramData\amagent\worklets\java\java_64.log' -Wait -Passthru -ErrorAction Stop exit 0 } Catch{ $Exception = $error[0].Exception.Message + "`nAt Line " + $error[0].InvocationInfo.ScriptLineNumber Write-Output $Exception exit 90 } Would app

My company is working on making sure we have automatic screen lockouts on our machines. For our Windows machines we control this through GPO, but that does not affect the handful of Mac machines we have in our environment. Does anyone know how to script out a way to have Macs lock after a certain amount of inactivity (i.e. 5 minutes)? My DuckDuckGoing has been unsuccessful in searching for an answer to this. Thanks!

hey everyone, I have been trying to get the copy file to work. but on the Automox it shows it was copied but it is not. when I ran the scripted locally with x86 it looks to be able to copy the files. Copy-Item -Path ‘\servername\freenas4\installs\VPN Certs*’ -Destination ‘c:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile’ -PassThru

Hey Automox Community, As some of you may be aware, a number of high/critical vulnerabilities targeting Azure Virtual Machines have been discovered and patched by Microsoft. These vulnerabilities target the Open Management Infrastructure (OMI) agent running on Linux VM’s, and include remote code execution and privilege escalation vulnerabilities. This worklet will install the correct Microsoft repository based on your distribution of Linux and patch the OMI agent. We suggest running this worklet if any of your assets are Azure Linux VM’s. For more information about the vulnerability, see CVE-2021-38647 and Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions. Evaluation Code: #!/bin/bash #================================================================ # HEADER #================================================================ #% SYNOPSIS #+ Updates OMI on Azure Linux VM's. #% #% DESCRIPTION #% The eval code checks to see if the device is an Azu

Hi Any one got a working worklet for greenshot ?

Hi all, we had a couple machines that had TeamViewer installed and needed to mass uninstall, thought I’d share the Worklet to uninstall this Evaluation: if (Test-Path -Path "C:\Program Files (x86)\TeamViewer") { Write-Output "TeamViewer not installed, skipping" exit 0 } else { Write-Output "TeamViewer installed, we will uninstall" Exit 1 } Remediation: $AllApps = Get-ItemProperty "HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" $TeamViewer = $AllApps | Where-Object {$_.DisplayName -Like "TeamViewer*"} Write-Output "Uninstalling TeamViewer" Start-Process -FilePath ($TeamViewer.UninstallString) -ArgumentList "/S" -WindowStyle Hidden

Hi everyone We sometimes have a requirement to replicate the behaviour of GPOs that run in the user context. This means you need to execute a task under the current logged on user and trigger it to occur only when user logs on. To achieve this, we can use a scheduled task with 2 special settings: It is triggered only when a user logs on It runs under the context of the local “USERS” group. With #2, you are able to access all the usual user-context-specific data such as %USERNAME%, HKCU, etc. And, this approach makes the scheduled task run under the context of ANY user that logs on. Say for example you have 2 users - USERA and USERB logging on, the scheduled task will take on the security context of USERA or USERB depending on who logs on. Unfortunately, you cannot achieve this with the New-ScheduledTask cmdlet. You will have to use COM programming. Here’s the code: $ShedService = New-Object –comobject 'Schedule.Service' $ShedService.Connect() $Task = $ShedService.NewTask(0) $Task.Re

We’re continuing to crank out more worklets for you to download and use: https://community.automox.com/c/worklets and we’re looking for some input from the community as to what we should work on next. What tasks would you love to automate but haven’t had the time to script? Tell us what you’d like and we can help by putting together a worklet for you.

has anyone created any worklets or required software policy for installing Nessus on linux hosts? This would include configuring the agent with the necessary switches.

This worklet will allow you to run the Windows Cleanup Tool on any of your Windows endpoints, based on the amount of free space remaining on the C: drive. If you use the /SageSet and /SageRun commands, you’ll need to create presets on the endpoints first. This /SageSet process can be automated, as some folks have demonstrated here: stackoverflow.com Automate process of Disk Cleanup cleanmgr.exe without user intervention powershell, registry, powershell-3.0, resource-cleanup asked by Pinte Dani on 11:01AM - 04 Mar 15 UTC If you don’t want to bother with the /SageSet presets you can use the /VeryLowDisk flag instead, with the caveat that this will pop up the scan completion window on the endpoint, which might be confusing to users. More documentation on the cleanmgr.exe flags here: Winaero – 2 Dec 16 Disk Cleanup Cleanmgr Command Line Arguments in Windows 10 The built-in tool, Dis

I have a batch file which disables BIOS updates in Dell command: “%PROGRAMFILES%\Dell\CommandUpdate\dcu-cli.exe”/configure -autoSuspendBitLocker=disable -outputLog=C:\Temp\dell.log The remediation code is: Copy-Item -Path “dellcommand.bat” -Destination “c:\Temp” Start-Process C:\Temp\dellcommand.bat New-Item -Path “C:\Program Files\Dell\CommandUpdate” -Name “BIOSudDisabled” -ItemType “Directory” It copies the batch file to the temp folder and creates the new folder but there is no evidence of the batch file actually being executed. I can’t seem to get my head around why as everything works fine when run locally. Any help appreciated.

This will kick off the Windows Update Troubleshooter process and attempt to report back results of the process into the activity log. Remediation Code $tsp = Get-TroubleshootingPack C:\Windows\diagnostics\system\WindowsUpdate Invoke-TroubleshootingPack -Pack $tsp -AnswerFile .\WUDAnswers.xml -Unattended -Result $env:HomeDrive\WUDResult [xml]$xml = Get-Content $env:HomeDrive\WUDResult\ResultReport.xml $xml.ResultReport.Package.Problem.DetectionInformation.DetailedInformation.Detail.Contents.Objects.Object | % { write-output $_.'#text';write-output ". " }

Automox requires a minimum of 3GB of free disk space in order to execute daily functions prioperly. This worklet checks for free disk space on the C:\ drive. The worklet will produce a result in the Activity Log only if a host has less than 3.0GB of free space on the C:\ drive. Evaluation: $runCheck = { $minDiskSpaceGB = 3.0 $diskCheck = Get-WmiObject -Class Win32_logicaldisk -Filter "DriveType = '3'" | Where-Object {$_.DeviceID -eq "C:"}| Select-Object -Property DeviceID, @{L='FreeSpaceGB';E={"{0:N2}" -f ($_.FreeSpace /1GB)}},@{L="Capacity";E={"{0:N2}" -f ($_.Size/1GB)}} | Where-Object {[float]$_.FreeSpaceGB -lt $minDiskSpaceGB} if ( $diskCheck -eq $null ) { return 0 } else { return 1 } } exit $exitCode = & $runCheck Remediation: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } $runCheck = { $minDiskSpaceGB = 3.0 $diskCheck = Get-WmiObject -Class Win32_logicaldisk -Filter "DriveType = '3'" | Where-Object {$_.DeviceID -eq "C:"}| Select-Object -Property De

I have this KB article: Outlook (Client-based) Phish Alert Button Product Manual – Knowledge Base Can anyone help me to create the worklet for Win10 device?