Automox Worklets

This is something that I put together to fix corrupt installs of Sophos caused by our old imaging system. The logic could be used for any workflow that needs to span reboots and continue. I am attaching two executables and two PowerShell scripts to the worklet. The worklet then copies them to C:\Windows\Temp so they are not removed when the worklet completes and they can continue after reboot. Eval code -I always want this to run on whatever target devices are selected Exit 1 Remediation Code #Create scheduled task to trigger script1 on next boot $AtStartup = New-ScheduledTaskTrigger -AtStartup -RandomDelay 00:00:30 $Settings = New-ScheduledTaskSettingsSet $Principal = New-ScheduledTaskPrincipal -UserID "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount -RunLevel Highest $Action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-NonInteractive -NoLogo -NoProfile -ExecutionPolicy Bypass -File "c:\windows\temp\script1.ps1"' $Task = New-ScheduledTask -Trigger $AtStartup -Settin

Afternoon, I have managed to find a worklet for installing Carbon Black on a Mac EndPoint - but I am unable to find one for installing on a Windows Endpoint, is there a template available or has anyone else had any luck in writing one? The “12 Hour” time frame from the CB console is too long for sensible deployments 🙂 Thanks

I wonder if its possible to make a mac script that would check if system is pending a reboot and then push user notifications to do it, not necessary to have an option for user to do it from the message, just want to alert user they need to reboot…repeatedly…until they hopefully do.

The following worklet is used to mitigate the abuse of a low privilege user that have RX permissions in the %windir%\system32\config directory. With the availability of VSS shadow copies, this low privilege user may obtain credentials and DPAPI computer keys, install programs, delete data, or create new accounts. The following worklet follows the recommendations of Microsoft for a suggested workaround. Note: The recommendations provided by Microsoft includes the deletion of shadow copies. Please be advised that ransomware authors may also delete shadow copies, and many antiviruses and EDR solutions may block or flag this activity. Additionally, depending on your backup software and/or policies, this mitigation may conflict with your existing practices. Please consult with your IT/Security policies first prior to implementing this worklet. Also per best practice, please also test this worklet on a small sample size prior to implementing across the organization. Evaluation Code To evalu

I faced issues using a worklet to extract information out of the 64-bit registry hive. The issue is due to Crowdstrike detecting this as malicious activity (I followed the steps here: https://support.automox.com/help/enforce-windows-registry-settings-worklet). For those who face the same issue, you can use the sample code below to read the 64-bit registry. Make adjustments are required. The sample code below reads HKLM:\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration and returns the registry key called “Platform” to detect the bitness of version of Office installed. $key = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, [Microsoft.Win32.RegistryView]::Registry64) $subKey = $key.OpenSubKey(“SOFTWARE\Microsoft\Office\ClickToRun\Configuration”) $root = $subKey.GetValue(“Platform”) Write-Output “Office bitness: $root”

Anyone happen to have a worklet for cyberduck for win / mac ?

For a Windows worklet using Powershell, what is the command that prints to the Details field of the Activity Report Log? For example, in a Required Software worklet how can I print a message to the details field of the Activity Report Log? Now it outputs “Installed Software”, but I don’t see this in the remediation script. $proc = Start-Process WindowsSensor.MaverickGyr.exe -ArgumentList '/install /quiet /norestart CID=XXXX' -PassThru Write-Output "Exit Code was $($proc.ExitCode)" Exit $proc.ExitCode

Hi, everybody - Chad here. As we keep re-launching some popular recurring posts, I discovered the Worklet Deep Dive interview series, where we get some details into the creation of a specific worklet. This month, we’re talking to @marina about her SeriousSAM/HiveNightmare LPE Vulnerability worklet and how it came to be. What prompted the creation of this particular worklet? This worklet stemmed from the disclosure of a 0-day impacting Windows machines, so time was of the essence to get this tested and shipped to protect users and customers. I also wanted to try my hand at PowerShell scripting, so this was an opportune moment to help protect customers and get some practice. What difficulties or obstacles came up while creating it? Well, I’ve never written a Windows worklet before, and I have limited PowerShell scripting prowess, so there was a steep learning curve for me. For the script itself, there were lots of variables to account for: presence of shadow copies, presence of builtin u

When comparing Automox to competitor products, one feature I found lacking was the ability to apply policies based on device manufacturer. As many admins are already aware, Dell specifically has had a couple zero days released in recent months. This worklet is a slight modification of the code posted by JHagstrom, and simply adds the device manufacturer as a tag so it can be targeted. One thing I haven’t figured out is how to add the tag without removing existing tags. Be aware that this will delete any existing tags on the device. Function Invoke-AutomoxAPI{ [cmdletbinding()] Param() $apiKey = "INSERT API KEY HERE" $apiUrl = "https://console.automox.com/api/servers/" $headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" $headers.Add("Authorization", "Bearer $apiKey") #Get all devices in the org to parse $response = Invoke-RestMethod $apiUrl -Method 'GET' -Headers $headers -Body $body $response | ConvertTo-Json $currentMachineName = $env:COMPUTERNAME; #Perf

Has anyone created a worklet to mitigate the HiveNightmare zero-day? I tried to create one but it didn’t work.

First time user of Automox/worklets in general. Wanted to create a worklet to run against CentOS servers for the following command: ‘yum update check; echo $?’. My goal is if the command returns a 1 (which means there’s some error(s)), is there a way for the worklet/Automox to let I (or anyone in general know) that that server needs to be looked at. For the remediation code, I would believe it’s something as simple as: yum update check; echo $? But not sure what I would need for the Evaluation code & how to alert which server(s) return a code of ‘1’ so they could be looked at. Again, apologies, this is my first time using a worklet so as much help will greatly be appreciated. Thank you.

This is an exploit that affects domain controllers. In a nutshell, if you have the “Print Spooler” service enabled (which is the default), any remote authenticated user can execute code as SYSTEM on the domain controller. More detail in this article: BleepingComputer Public Windows PrintNightmare 0-day exploit allows domain takeover Technical details and proof-of-concept (PoC) exploit have been accidentally leaked for a currently unpatched vulnerability in Windows that allows remote code execution. This worklet disables the print spooler service on domain controllers and disables it from running at startup. You can run it against any group that contains domain controllers and it will only target the DCs. Note: More information has come out that this might affect all servers - not just DCs. I modified my original evaluation with the option of checking all servers (not just DCs). If you want to run this against all server

The Automox console will allow you to uninstall patches using the Rollback Action from the Device Details page. Unfortunately, this method may become cumbersome for a large number of devices. So for this scenario, we can apply a Worklet that will allow us to detect the presence of, and subsequently remove, the unwanted patch. Note: Not all patches are uninstallable. Refer to the Microsoft Update Catalog for details for your particular patch. Evaluation Code To evaluate this, we simply need to determine if the patch is present. This is simple to do with the PowerShell command Get-HotFix . Based on the response of that command for the patch we’re concerned with, we use the appropriate Exit Code to indicate it’s compliance status. #### EVALUATION CODE #### # If you want to have an ongoing evaluation use this script # to see if the patch is present. # If you just want to manually execute this policy, this can be as # simple as "Exit 1" # Change this KB number to match what you

From Worklet: Predictable Reboot Notifications for Windows RebootNotifications.pdf (133.8 KB)

In our latest community Security Alerts Gavin discusses the new IE zero-day vulnerability that is tracked under CVE-2019-1367. This vulnerability allows for malicious remote code execution, where a bad actor to run code under the same permissions as the current user. The Worklet Gavin posted in the Security Alert update is an effective way to quickly remediate a group of devices and ensure they are patched against this vulnerability. However, with so many different KB’s for each Windows OS version in both 32 and 64-bit processors, it can be a real time-consuming task to remediate all of the different endpoints that you manage in your infrastructure. Below is the IE11 “One-click” remediation Worklet that will remediate all of your Windows devices no matter what version, or processor in a single Worklet. The Worklet is designed to evaluate both the Windows OS version, and the processor to determine which .msu file is needed to install the respected KB. Once the .msu is determined then

This worklet will disbable the Remote Printing capability on any Windows endpoint while still allowing local printing, which mitigates remote exploitation of CVE-2021-34527 If you would like to stop the PrintSpooler service altogether, use this Worklet: Band-Aid PrintNightmare Zero-Day Exploit on Domain Controllers Evaluation code: #Forces the worklet to run; alternatively, you can move the If statement below into this section to only execute on endpoints where Remote Printing is enabled. Exit 1 Remedation code: #Define desired registry settings: $regPath = "HKLM:\Software\Policies\Microsoft\Windows NT" $regKey = "Printers" $regName = "RegisterSpoolerRemoteRpcEndPoint" #Check whether the registry value is already present and configured and if so, do nothing: if ((Get-ItemProperty -Path $regPath\$regKey).$regName -eq 2) { Write-Output "Remote Printing Service already disabled on:$gc $env:computername" } else { #Create the new Printers registry key: New-Item -Path $regPath\$regKey #

Been working on a worklet policy to grab bitlocker keys ID and recovery keys. So far I’ve been successful at making the policy create a .csv locally to the machine. Not sure if this is the best place to post this, but if anyone wants to expand on this such as. a) out-putting to FTP server, URL, etc. please do $KeyProperties = @() $KeyObj = @() $Computer = $env:Computername $Keys = Get-BitlockerVolume -MountPoint C: $selected = $Keys | Select-Object -ExpandProperty KeyProtector $Selected[1] | select-Object KeyprotectorID, RecoveryPassword Foreach ($S in $Selected) { $KeyProperties = [pscustomobject]@{ Computer = $Computer KeyProtectorID = $S.KeyProtectorID RecoveryPassword = $S.RecoveryPassword } $KeyObj += $KeyProperties } $KeyObj[1] | Export-CSV "C:\$($Computer)_Keys.csv" -NoTypeInformation

There isn’t much worklet examples for Linux so I will place this here. Thanks @ncaraway for Install CylanceProtect on Macs it was good guidance. Evaluation Code (could be done different) #!/bin/bash #evaluate the device to see if the Sentinel One service is running #service running exit with a 0 #service not running exit with a 1 sentinelctl version | grep 'Agent version' if [[ $? = "Agent Version: 21.6.3.7" ]]; then exit 0 else exit 1 fi Remediation Code #!/bin/bash #copy the files to the /tmp directory of the device scp SentinelAgent_linux_v21_6_3_7.deb /tmp #run installation of Sentinel One on the device. error logs are output to /tmp/s1install.log sudo dpkg -i /tmp/SentinelAgent_linux_v21_6_3_7.deb 2> /tmp/s1linux.log & process_id=$! wait $process_id sudo /opt/sentinelone/bin/sentinelctl management token set YOURTOKENHERE sudo /opt/sentinelone/bin/sentinelctl control start #check to ensure the S1 service is

Sometimes our scripts need to store sensitive information. I’d imagine there are far superior ways to store secrets in a vault and call them into the script when necessary. When that’s out of reach, I’d say this approach is better than storing an API key in clear text. Just know that anyone with the right skillsets can still decrypt. Below are two methods. In method 1 the key file travels with the script. In method 2 the key file is created by using raw certificate data that ideally would only exist on the endpoints the script runs on. method 1 - building random key file # build key file - do this step outside of your script $PasswordFile = "aes.key" $Key = New-Object Byte[] 32 [Security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($Key) $Key | out-file $KeyFile # encrypting password with key file - do this step outside of your script $Key = Get-Content $KeyFile $PasswordFile = "pw.txt" $Password = "super-secure-password" | ConvertTo-SecureString -AsPlainText -Force $Pas

Install Microsoft Teams Commercial for Windows x64 bit OS Here is an example of how to use the “MSI Software Installation - 64-Bit OS” Worklet template available in the Automox Console new Community Worklets section. You will need the Machine-Wide Installer bits. They can be found here: https://docs.microsoft.com/en-us/microsoftteams/msi-deployment For this example, I am using the Commercial 64-bit version: 64-bit From within the Automox Console, navigate to the SYSTEM MGMT node, and select the Community Worklets tab. Click on the “MSI Software Installation - 64-Bit OS” Worklet, and then click “Create Policy”. In the Evaluation Code block on line 34, fill in the $appName variable. Currently, it is ‘Teams Machine-Wide Installer’ In the Remediation Code block on line 28, fill in the $fileName variable. Currently, it is ‘Teams_windows_x64.msi’. On line 100 add ‘ALLUSERS=1’ to the ArguementLIst. NOTE: Do not add the single quotes listed above in either code block if you copy-paste. T

Hi! I’m facing a lot of problems patching Chrome. If Chrome is running, then it won’t patch, and if user don’t close it in a lot of days the same. So at the end, it takes too much time for applying the patch. I want to run a simple worklet to stop Chrome process: EVALUATION $chrome=Get-Process -Name "chrome" -ErrorAction SilentlyContinue function checkChrome { if ($chrome.si -ne 0) {exit 1} else {exit 0} } checkChrome REMEDIATION Stop-Process -Name "chrome" -ErrorAction SilentlyContinue Start-Process -FilePath "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -WorkingDirectory "C:\Program Files (x86)\Google\Chrome\Application" As you see, it just checks if Chrome is running and then it stop the process and starts it. Doing this on localhost works, running from Automox nothing happends. Any ideas? Thanks

This worklet will determine the health percentage of a battery in a Windows laptop. There are two ways to use it… The first way is if you want to set it on a schedule (don’t run this manually or you will get erroneous information from skipping the evaluation). This will automatically generate entries to the activity log for only laptops with a health lower than what is set as an acceptable percentage. The machines will also appear as non-compliant for the worklet until the issue is resolved. Evaluation: # Set Minimum Acceptable Health Percentage. $MinHealth = "90" # Determine type of computer $HardwareType = (Get-WmiObject -Class Win32_ComputerSystem).PCSystemType # Checking Battery Specification. $BatteryDesignSpec = (Get-WmiObject -Class "BatteryStaticData" -Namespace "ROOT\WMI").DesignedCapacity $BatteryFullCharge = (Get-WmiObject -Class "BatteryFullChargedCapacity" -Namespace "ROOT\WMI").FullChargedCapacity # Check if Battery Replacement is required. [int]$CurrentHealth = ($B

This worklet will delete the contents of all users’ Download folders on a system. It also checks the location if the folder was remapped into OneDrive. If you do not want it touching OneDrive, you’ll want to remark out (or remove) the following lines from the evaluation and remediation code: $ODtargetFolder = “OneDrive\$targetFolder” $folderList += “$profile\$ODtargetFolder” Evaluation: <# .SYNOPSIS Delete Contents of Specified Folder for All Users on a System OS Support: Windows 8 / Server 2008 R2 SP1 and above Powershell: 3.0 and above Run Type: Evaluation .DESCRIPTION This worklet is designed to search for any contents located in $targetFolder & $ODtargetFolder (its' possible location in OneDrive) for each user on a system, and delete the contents. If any contents are found making it non-compliant, the evaluation script will close with an exit code of '1' to trigger remediation. $targetFolder & $ODtargetFolder need to be set the same for evaluati

This worklet will help migrate 32-bit version of Microsoft Office to 64-bit version. Need to download Release history for Office Deployment Tool (ODT) - Office release notes | Microsoft Docs and open to get a copy of setup.exe Next create an XML file called configuration-Ofice365-x64-MigrateArch.xml <Configuration> <Add OfficeClientEdition="64" MigrateArch="TRUE" Channel="Monthly" AllowcdnFallback="TRUE"> <Product ID="O365ProPlusRetail"> <Language ID="en-us" /> </Product> </Add> <Display Level="None" AcceptEULA="TRUE" /> <Logging Level="Standard" Path="C:\windows\temp" /> </Configuration> Upload both setup.exe and configuration-Ofice365-x64-MigrateArch.xml to the worklet. Evaluation $workdir = "C:\ProgramData\Amagent\O365" IF(Test-Path $workdir){ Remove-Item $workdir -recurse -force | out-null } $scriptblock = { Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration -Name Platform

This worklet takes advantage of output from netsh wlan show interfaces. The idea is to start a scheduled task and run that command every 30 minutes for 48 hours. The results are all stored in a CSV file on the drive for review later. #remediation code #Params $TaskName = 'Wi-Fi Analysis 48-Hours' $csv = 'Wi-Fi_Analysis.csv' $workdir = 'C:\ProgramData\company\' $file = $workdir + $csv $repeatmin = 30 #minutes $duration = 48 #hours #cleanup before starting IF(Test-Path $file){Remove-Item $file -Force} $task = schtasks /query /tn "$TaskName" IF($task){schtasks /Delete /TN "$TaskName"} function Build-Scripts{ # Build script that will send message $vbs = @" command = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -File $workdir`Get-wlanInterface.ps1 -Force" set shell = CreateObject("WScript.Shell") shell.Run command,0 "@ New-Item -Path "$workdir" -Name "RunPowerShellScript.vbs" -ItemType "file" -Value $vbs -force | Out-Null $power