Automox Worklets

This worklet will check to see if Box is installed and if it isn’t, will download and install it. See this KB article for how to setup a worklet:https://help.automox.com/hc/en-us/articles/5603324231700-Creating-a-Worklet Evaluation Code:  #!/bin/bashif [ -d "/Applications/Box Sync.app" ]; then exit 0else exit 1fi Remediation Code:  #!/bin/bashecho -e "Downloading Box Sync..."curl -L -o "/tmp/Box Sync Installer.dmg" https://e3.boxcdn.net/box-installers/sync/Sync+4+External/Box%20Sync%20Installer.dmgecho -e "Installing Box Sync..."hdiutil attach "/tmp/Box Sync Installer.dmg" -nobrowseditto "/Volumes/Box Sync Installer/Box Sync.app" "/Applications/Box Sync.app"echo -e "Cleaning up..."hdiutil detach "/Volumes/Box Sync Installer"rm -f "/tmp/Box Sync Installer.dmg"

Fellow Automox, Anyone here had try to deploy and install Sophos Endpoint Agent in MacOS? If yes, can someone share their worklets please? Thanks! U

This worklet can be run against Mac Hosts to standardize hostnames. This is valuable to our org in that we have a hostname standard of username-macbookModel that helps us identify the machine. You can change whatever values you’d like to accomodate your org. Evaluation Code: pro="-MBPro" air="-MBAir" emp=$(stat -f%Su /dev/console) mbpro="${emp}${pro}" mbair="${emp}${air}" if [[ $HOSTNAME = "${mbpro}" ]] || [[ $HOSTNAME = "${mbair}" ]]; then exit 0 else exit 1 fi Remediation code: #!/bin/bash # The script will identify the current logged in user and machine type and it will # run as root and will set hostname to: user-computer type based on the information returned pro="-MBPro" air="-MBAir" model=$(sysctl hw.model | sed 's/[0-9,]//g' | awk '/^[a-zA-Z]/ {print $2}') emp=$(stat -f%Su /dev/console) case "${model}" in "MacBookPro" ) sudo scutil --set ComputerName "${emp}${pro}" sudo scutil --set LocalHostName "${emp}${pro}" sudo scutil --set HostName "${emp}${pro}"

This particular worklet looks for any system set to never run a full scan and changes it to run on Wednesdays. You could obviously alter it to look for a different condition and set it how you wish. For example… You could look for systems not set to do a full scan every day in the evaluation and change it to do so… Evaluation: if ($Preferences.RemediationScheduleDay -ne 0) Remediation: Set-MpPreference -RemediationScheduleDay 0 Or conversely, if you want Defender to never do a full scan… Evaluation: if ($Preferences.RemediationScheduleDay -ne 8) Remediation: Set-MpPreference -RemediationScheduleDay 8 The acceptable values for this parameter are: 0: Everyday 1: Sunday 2: Monday 3: Tuesday 4: Wednesday 5: Thursday 6: Friday 7: Saturday 8: Never Evaluation: # Determine if full Defender scans are set to never run $Preferences = Get-MpPreference if ($Preferences.RemediationScheduleDay -eq 8) { exit 1 } else { exit 0 } Remediation: # Set a full Defender scan to run on Wednesdays

Note: This worklet changes the screensaver setting only for the current signed in user. The way this worklet was written creates a folder to save screensaver images to, and clears out that folder each time the worklet is run so you can add in new pictures if needed. Evaluation: Exit 1 Remediation: #!/bin/sh # Get user logged into console and put into variable "user" user=`ls -l /dev/console | cut -d " " -f 4` #Creates a /Library/Backgrounds folder if there is not one already mkdir -p /Library/Backgrounds # Removes the previously saved screensavers in the background folder rm -rf /Library/Backgrounds/* # This is where the new screensavers are referenced, add/remove as necessary # Each image lasts for 5 seconds, so for a longer time, copy the image a few times scp screensaver1.png "/Library/Backgrounds/" scp screensaver2.png "/Library/Backgrounds/" scp screensaver3.png "/Library/Backgrounds/" scp screensaver4.png "/Library/Backgrounds/" scp screensaver5.png "/Library/Backgrounds/" sc

This section contains covers the Worklet that automatically applies the CIS recommendations for (1) Account Policies (1.1) Password Policy. It is highly recommended that all Windows devices adhere to these recommendations and be evaluated frequently to ensure compliance. PLEASE READ: The following sections are broken down below. Most of these are configurable by the preference of the security admin, however, CIS has set recommendations as to how these settings should be configured. Automox has aligned the default settings in the remediation code to match these recommendations 1.1 Password Policies 1.1.1 Ensure ‘Enforce password history’ is set to '24 or more password(s)’ 1.1.2 Ensure ‘Maximum password age’ is set to '60 or fewer days, but not 0’ 1.1.3 Ensure ‘Minimum password age’ is set to '1 or more day(s)’ 1.1.4 Ensure ‘Minimum password length’ is set to '14 or more character(s)’ 1.1.5 Ensure ‘Password must meet complexity requirements’ is set to ‘Enabled’ 1.1.6 Ensure ‘Store passw

RingCentral Phone gets installed in the user space, not in Program Files: C:\Users\[username]\AppData\Local\RingCentral So you can’t uninstall it with a typical uninstall worklet because it’s running as the SYSTEM user. This worklet uses the task scheduler to create the uninstall tasks, do the uninstall, and then delete the tasks. Be sure to set $appName to the name of the app you want uninstalled in both evaluation and remediation code. <# .SYNOPSIS Check for presence of specified application on the target device .DESCRIPTION Read 32-bit and 64-bit registry to find matching applications Exits with 0 for compliance, 1 for Non-Compliance. Non-Compliant devices will run Remediation Code at the Policy's next scheduled date. .NOTES A scriptblock is used to workaround the limitations of 32-bit powershell.exe. This allows us to redirect the operations to a 64-bit powershell.exe and read the 64-bit registry without .NET workarounds. .LINK http://www.automox.com #> #

This Worklet will install Chrome silently on end-user devices. This is helpful if you push extensions and bookmarks via Google Workspace (this requires user signs into Chrome with their work email). Helpful for onboarding if your company prefers Chrome over other browsers. Evaluation code: if [[ -d "/Applications/Google\ Chrome.app" ]]; then exit 1 else exit 0 fi Remediation code: #!/bin/bash temp=$TMPDIR$(uuidgen) mkdir -p ${temp}/mount echo "Downloading Chrome..." if curl https://dl.google.com/chrome/mac/stable/GGRO/googlechrome.dmg > ${temp}/1.dmg; then echo "Downloaded Chrome" else echo "Something went wrong downloading" && exit 1 fi echo "Mounting and installing..." yes | hdiutil attach -noverify -nobrowse -mountpoint ${temp}/mount ${temp}/1.dmg cp -r ${temp}/mount/*.app /Applications echo "Detaching..." hdiutil detach ${temp}/mount echo "Cleaning up..." rm -r ${temp}

Gets the 10 most recent SYSTEM and APPLICATION errors from the Windows Event Viewer logs and outputs them into the Automox Activity Monitor Evaluation Code exit 1 Remediation Code ### Gets the 10 most recent SYSTEM errors from the event viewer logs Write-Host "10 Most Recent SYSTEM Log Errors" $A = Get-EventLog -LogName System -EntryType Error -Newest 10 Foreach ($B in $A){ "`---" $B | Select-Object -Property TimeGenerated, EventID, EntryType, Message, Source } ### Gets the 10 most recent APPLICATION errors from the event viewer logs "`---" Write-Host "10 Most Recent APPLICATION Log Errors" "` " $A = Get-EventLog -LogName Application -EntryType Error -Newest 10 Foreach ($B in $A){ "`---" $B | Select-Object -Property TimeGenerated, EventID, EntryType, Message, Source } From there you can read in the activity monitor, or copy and paste into a text editor and find: --- replace with: --- To get a cleaner view.

Hello Automox Community! If you joined us for today’s webinar, I first would like to thank you for your participation and also congratulate our lucky trivia winner who will be receiving a brand new Raspberry Pi! If you weren’t able to make it, please see our webinar syndication page at your leisure and sign up for our next adventure! This Patch Tuesday two key critical remote code execution vulnerabilities affecting IPv4 and IPv6 were disclosed that have workarounds. Automox has turned these workarounds into Worklets for your convenience. NOTE: It’s important to keep in mind that workarounds can have unforeseen consequences. Given the impact of the disclosures, Automox does recommend taking action sooner rather than later. First up is Windows TCP/IP Remote Code Execution Vulnerability (CVE-2021-24074) which affects IPv4 source routing. Evaluation - IPv4 # Evaluation - Windows TCP/IP Remote Code Execution Vulnerability (CVE-2021-24074) # > Link: https://msrc.microsoft.com/update-guid

Hi Automox Alive Community! Previously, I added a worklet for addressing LLMNR security risk for Windows, and now I’m adding the same for Linux considerations. If you are unfamiliar, LLMNR stands for Link-Local Multicast Name Resolution and is a favorite vector among pen-testers and malicious threat actors for conducting man-in-the-middle attacks. Evaluation: #!/bin/bash # LLMNR - Evaluation : This will check whether LLMNR has been disabled. test_val='^LLMNR=no' test_cfg='/etc/systemd/resolved.conf' # Case-insensitvely check for value if ($(grep -qi "$test_val" $test_cfg)); then # Compliant exit 0 else # Non-Compliant exit 1 fi Remediation: #!/bin/bash # LLMNR - Remediation : This will disable LLMNR. (restart required) test_val='^LLMNR=no' test_cfg='/etc/systemd/resolved.conf' sed -i 's/.*LLMNR=.*/LLMNR=no/g' $test_cfg # Case-insensitvely check for value if ($(grep -qi "$test_val" $test_cfg)); then # Compliant exit 0 else # Non-Compliant echo "LLMNR could not b

This worklet looks at the Registry Key that Citrix uses when it is installed. This is the newest version that was released in Feb but can be changed accordingly. This does require the installation file to be uploaded to the policy but this is used to keep everyone on the same version. The evaluation code: #Current version of Citrix can be modified. $Version = "21.2.0.17" If((Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Wow6432Node\Citrix\Dazzle" -Name "Version") -eq $Version) { write-output = "Version is up to date" Exit 0 }else{ write-output = "Running Update" exit 30 The Remediation Code:#installs silently, disables the server question as well as autoupdate policy if((test-path -Path "c:\Citrix\CitrixWorkspaceApp2102.exe") -eq $false) { md c:\Citrix Copy-Item .\CitrixWorkspaceApp2102.exe -Destination "c:\Citrix\CitrixWorkspaceApp2102.exe" Write-Output = "File copied" }else { Write-Output = "File already copied" } Start-Process -FilePath "c:\Citrix\CitrixWorkspaceApp2102.exe

If you have Windows systems that you can’t afford to have rebooting outside of a certain time-frame, you can use this to restrict when a system that needs a reboot is allowed to reboot. Customer’s scenario: “Outages of more than 1 minute are not acceptable. Because of the possibility patching itself running long (100+ servers patching at the same time in the same tower) we cannot tie a reboot to the policy doing the patching and would like to start patching before the maintenance window to mitigate that and force a reboot at the time of the maintenance window with a reboot worklet. There is a risk that patching will not only go really long but it could go past the entire maintenance window. With a check of system time in the remediation, if patching ran exceptionally long and the worklet queued up and ran after the scheduled time, the worklet would quit out with no reboot and we could reboot manually with approval from our customers.” The systems will obviously need to not have any p

Hey All, I recently switched to Automox from Manage Engine’s Patch Manager and wanted an easy way to remove the Manage Engine agent from my systems. In talking with Nic, I found out this would be a perfect job for a worklet. So here’s my first Worklet 😃 Evaluation Code: Keeping this one super simple as I don’t need it to check if it’s already there since the MSI command for remediation will do that and remove it. exit 1 Remediation Code: This works on Windows systems and checks if Manage Engine’s Agent is already installed and then calls the uninstall by the ID since an option exists to hide the program from the Uninstall Programs list. Start-Process -FilePath "$env:systemroot\system32\msiexec.exe" -ArgumentList '/x{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}', 'MSIRESTARTMANAGERCONTROL=Disable', 'REBOOT="ReallySuppress"', '/qn' -Wait -NoNewWindow If anyone else has improvements for this, please feel free to add them, but after testing this on my system it works just fine as-is.

UPDATE: January 8, 2021 Windows 10 Feature Updates can be finalized by using the Automox Reboot process. All Feature Update versions released to date are supported. As older versions of Windows 10 are retired, upgrades to newer versions of Windows 10 begin to become available through Windows Update, and you can deploy them through patch policies to your devices. Please review our best practice policy for a Feature Update Policy guide: https://support.automox.com/help/what-are-the-recommended-best-practices-for-patching-in-automox NOTE: This is one of the few places I suggest switching on the “Install Optional and Recommended Windows Updates” option. Automox natively handles the finalization of feature updates within the reboot functionality. That reboot could either be triggered by a policy, or from the console… in either case it send down a command to finalize the upgrade, and the device complete the upgrade as part of the process. This Worklet will finalize Windows 10 Feature Up

I have been having issues with a script I found and even after modifying it I am unable to make it work. Could someone take a look and see if there’s an issue that I’m missing? The idea is to get the services before, then after a reboot. It works fine when running as system in powershell ise so I’m unsure what issue I’m running into. I will say this is running on 2012r2 via the automox agent under remediation with exit 1. Check Script: Exit 1 Remediation Script: Write-Output "Beginning Scan" [string]$myorg = "Org1" [string]$groupname = "Group_01" <# $myorg = "Org1" $groupname = "Patching_Group_01" #> [string]$ComputerName = "localhost" [string]$Search = "zzzz" [string]$Search2 = "zzzz" $DirPath = "C:\temp\AmoxPatching\$myorg\$groupname\Services" $DirPathCheck = Test-Path -Path $DirPath If (!($DirPathCheck)) { Try { #If not present then create the dir New-Item -ItemType Directory $Di

Automox provides some great insight around patch installations triggered by Automox. You can find those details in the Activity Log report, and you can see patches are Installed or Awaiting Update in the console. Well, what do we know about patching details outside of the Automox policies? There are times we want more detail around patches that are installed manually, or through another method. Here is a Worklet that will collect Events generated by the Windows update client. Centralizing this information into the Activity log can save a good amount of time as you will not have to connect to different devices to see the details. Currently you can define the timeframe and eventIDs to include. I would love feedback to see what else everyone else would like to include. Remediation Code: ######Modify values to fit your needs###### $WUeventIDs = 19,20,21,43 $DaysOfLogs = 1 ########################################### #Collect Events and write output to Activity Log $timeSpan = (Get-Date

Brittany here again for another Worklet update! It’s mid-month, which means we are refreshing our swag item. For submitting a Worklet to the Automox Alive community, we’ll send you our exclusive Automox Yeti mug. There are three colors available (Black, Navy, and Seafoam Green) so you have plenty of opportunities to restock your mug collection - And if you post any additional Worklets in the community and have too many mugs to handle, we can send you an equivalent piece of swag in its place! Last, here’s our monthly Worklet highlight to help you patch Office for Mac - Office for Mac Update Package Thanks for all of the Worklets so far - keep them coming! EDIT: Edited to include the Yeti mug as the monthly swag item instead of the t-shirt.

Hi all, Has anyone used Automox to update or push out a hosts file? Thank you, Chris.

When we first deployed Automox, we decided to create our first Worklet to remove our old patch solution Ivanti Landesk as a way to learn how to use Worklets. Don’t forget to upload the uninstall file UninstallWinClient.exe Evaluation Code: $exe = 'UninstallWinClient.exe' if ((Test-Path $exe) -eq $true) {Remove-Item $exe } #Remove-Item UninstallWinClient.exe $FilePath = 'C:\Program Files (x86)\LANDesk\LDClient\vulscan.exe' $eval = test-path -Path $FilePath if ( $eval -eq $true ) {exit 1 } else {exit 0 } Remediation code: .\UninstallWinClient.exe /NOREBOOT #-Wait -Passthru .ExitCode

Hey Y’all! As an IT administrator one of the first things you’ll find yourself doing is installing an endpoint security tool, which can be very difficult to automate across hundreds, if not thousands of devices. Not with Automox. Automox Worklets gives you the power to deploy endpoint security tools to newly added endpoints as well as enforce installation on existing endpoint,s so you always know that your endpoints are running the security tools necessary to protect your IT environment. The below Worklet is designed to deploy CrowdStrike Falcon Sensors to macOS endpoints. The Worklet will copy down the .pkg file to the endpoint and run the install if the Worklet determines if CrowdStrike is not installed. Some things to remember when using this Worklet to install CrowdStrike Falcon: You need to make sure that the CrowdStrike Falcon application is whitelisted for the devices so the KEXT does not prevent the installation. Otherwise, this Worklet will not install the app. Be sure to

Sometimes Microsoft Autoupdate is not recognize when office Office for Mac is not patched. This worklet is more of a work around than a solution, so take it for what its worth. This does require someone to update the version and link each new Office for Mac release to match this site https://docs.microsoft.com/en-us/officeupdates/update-history-office-for-mac The worklet will detect when Office for Mac is not at the desired version and then download the patch from Microsoft and install. Evaluation Code #!/bin/bash ver="$(mdls '/Applications/Microsoft Excel.app' | grep Version | sed -e 's/[[:alpha:]([:space:],",:,=,^-]//g')" if [[ $ver == "16.44" ]];then echo "Complaint $ver detected" exit 0 else echo "Non-Compliant $ver detected" exit 1 fi Remediation Code ver="$(mdls '/Applications/Microsoft Excel.app' | grep Version | sed -e 's/[[:alpha:]([:space:],",:,=,^-]//g')" echo "$ver detected. Attempting to run installer." curl -o /tmp/Microsoft_Excel.pkg 'https://officecdn.microso

Hi Automox Alive Community! LLMNR stands for Link-Local Multicast Name Resolution and is a favorite vector among pen-testers and malicious threat actors for conducting man-in-the-middle attacks. Don’t take my word for it though, a quick google shows the prevalence of articles discussing the impact and risk associated. As a result, I’ve decided to create a worklet for state toggle concerning this issue for Windows. Evaluation: ############################################# $regPath = "HKLM:\Software\policies\Microsoft\Windows NT\DNSClient" $regProperty = "EnableMulticast" $desiredValue = '0' ############################################# # Compare current with desired and exit accordingly. # 1 for Compliant, 0 for Non-Compliant try { # Retrieve current value for comparison $currentValue = (Get-ItemProperty -Path $regPath -Name $regProperty -ErrorAction Stop).$regProperty } catch [Exception]{ write-output "$_.Exception.Message" exit 1 } if ($currentValue -eq $desiredValue) { # al

This is a remediation for CVE-2018-8581 per this article: https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2018-8581 The workaround is to remove a specific registry entry, which this worklet does: Evaluation code: Exit 1 Remediation code: reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa /v DisableLoopbackCheck /f Note that the above code is the CMD syntax and not Powershell, but that should run fine. If you run into any problems you can convert the above line into Powershell pretty easily.

Evaluation Code: if(test-path -Path "%APPDATA%/Zoom"){Exit 1} Remediation Code: $process = Start-Process -File-Path "%APPDATA%\Zoom\Zoom\uninstall\Installer.exe" -ArgumentList "/uninstall" -PassThru Exit $process.ExitCode