Community Worklets

Automate and enforce any scriptable action on endpoints

  • 442 Topics
  • 1,103 Replies

442 Topics

AdamW-Automox
AdamW-AutomoxAutomox Employee
posted in Community Worklets

Worklet: Disabling Bluetooth on MacOS Endpoints IF No Connected Devices or Peripherals

Bluetooth is a short-range, low-power wireless technology commonly integrated into portable computing and communication devices and peripherals. Bluetooth is best used in a secure environment where unauthorized users have no physical access near the Mac. If Bluetooth is used, it should be secured properly. Bluetooth is particularly susceptible to a diverse set of security vulnerabilities involving identity detection, location tracking, denial of service, unintended control and access of data and voice channels, and unauthorized device control and data access. It is recommended by the Center of Internet Security to disable bluetooth when connectable but not is use. This Worklet is designed to disable bluetooth if the following criteria is met on end endpoint: Bluetooth is enabled and connectable No Peripheral are connected Evaluation: #!/bin/bash brt=$(system_profiler SPBluetoothDataType 2>/tmp/log.txt | grep "Bluetooth:" -A 20 | grep Connectable | tr -d "[:space:]") brtmatch="

0
AdamW-Automox
3 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Community Worklets

Worklet: Force password reset Windows

This will force local users (non-AD) to change their password the next time they login. Note that this script will apply this setting to all local users on the Windows machine. It assumes they have the permissions to change their own passwords, but it does make sure that the passwords aren’t set to never expire. If the password is set to never expire then the command to force a password change won’t succeed. Evaluation code: Exit 1 The evaluation code just returns an exit code of 1 to make the remediation code run. The assumption is that you’ll use the worklet scheduler to run this code whenever you want to force a local password change. Remediation code: $usrs = Get-WMIObject win32_useraccount Foreach ($user in $usrs) { Set-LocalUser -Name $user.name -PasswordNeverExpires:$false net user $user.name /LogonPasswordChg:yes } The remediation code loops through all the local users and makes sure that the password isn’t set to never expire. Then it sets the LogonPasswordChg to yes, w

3
AdamW-Automox
3 years ago
cfrieberg
cfriebergNovice
posted in Community Worklets

(macOS) Create a new user worklet

I'm exploring a custom worklet to create a new user. So far this has been successful creating the user. However when trying to login, the password does not work. Please help if you think of a way around this. #!/bin/bash sudo ddcl . -create /Users/automox sudo dscl . -create /Users/automox UserShell /bin/bash sudo dscl . -create /Users/automox RealName Automox sudo dscl . -create /Users/automox UniqueID 9999 sudo dscl . -create /Users/automox NFSHomeDirectory /Local/Users/automox sudo dscl . -passwd /Users/automox password123 sudo dscl . -append /Groups/admin GroupMembership automox ps - Don’t use password123… I’m sure that goes without saying 🙂 Also there’s better ways to make users, but we’re trying to conjure this up for a specific use case.

3
PaulB-Automox
3 years ago
owl-IT
owl-ITPower User
posted in Community Worklets

Worklet - Disable PowerShell v2.0 on Windows 10

Windows 10 includes Windows PowerShell 5.0 by default that has some great new features that enhance security including enhanced transcription logging and AMSI protection. However, the Windows PowerShell 2.0 engine is still enabled and is now recognized as a security risk that can be used to run malicious scripts. Evaluation: $App = Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2 | Select-Object Status if ( $App -eq ‘Disabled’ ) { Exit 0 } else { Exit 1 } And then fix. Remediation Code to Disable the PS v. engine Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root You can recheck remotely with command: $computer => Name of the host you trying to check invoke-command -computername $computer {Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2 } Cheers, -Roman

2
Nic-Automox
3 years ago
ZachF-Automox
ZachF-AutomoxFormer Automox Employee
posted in Community Worklets

Worklet: Enable Gatekeeper on macOS

Gatekeeper is a built-in security feature of macOS—originally introduced in Mac OS X Lion (10.7.3)—that enforces code signing and verifies downloaded applications before allowing them to run. This worklet ensures that Gatekeeper is always enabled on a macOS system. Evaluation: #!/bin/bash # helper function to check if a command exists function command_exists { type "$1" &> /dev/null } # only evaluate if the spctl command is available if command_exists spctl; then # check if gatekeeper is enabled spctl --status | grep -q "assessments enabled" # yay? or nay? exit $? fi # spctl command not available, move along exit 0 Remediation: #!/bin/bash # enable gatekeeper for all users spctl --master-enable # did we succeed? exit $?

1
ChristianB-Automox
3 years ago
AdamW-Automox
AdamW-AutomoxAutomox Employee
posted in Community Worklets

Worklet: Installing Carbon Black on MacOS

Hey Y’all As an IT administrator one of the first things you’ll find yourself doing is installing an endpoint security tool, which can be very difficult to automate across hundreds, if not thousands of devices. Not with Automox. Automox Worklets gives you the power to deploy endpoint security tools to newly added endpoints as well as enforce installation on existing devices, so you always know that your endpoints are running the security tools necessary to protect your IT environment. The below Worklet is designed to deploy Carbon Black Defense to macOS endpoints. The instructions include creating and deploying a .zip files that contains the install .sh script as well as the .pkg required by the .sh to perform the install. If everything works as designed, you should be able to run the Worklet and see the endpoint(s) appear in the Cb console. You need to make sure that the Carbon Black application is whitelisted for the devices so the KEXT does not prevent the installation. Otherw

0
AdamW-Automox
3 years ago
ChristianB-Automox
ChristianB-AutomoxFormer Automox Employee
posted in Community Worklets

Worklet: (macOS) enforce password policy for all users and not for exempt users

Here is a worklet for enforcing password policies for macOS for all users (as well as setting exempt users). This code is test on macOS mojave. The defaults are provided for example only. Check script. #!/usr/bin/env bash set -e -o pipefail ###################################################################### # Enforcing a password policy is good practice for all users # Using the variables below you can check the password policy for all # logged in users. # the default variables provided in the main clause are provided for EXAMPLE ONLY ###################################################################### ###################################################################### # get_logged_in_users # Retrieves the logged in users. Does deduplication to make sure that we only # apply policies to # # Note: if there are service users it will find them too # # Globals: # # Arguments: # None # Returns: # A space delimited string of unique users logged in #########################

0
ChristianB-Automox
3 years ago
JasonG-Automox
JasonG-AutomoxAutomox Employee
posted in Community Worklets

Less intense resetting of the Windows Update client

The Invoke-TroubleshootingPack cmdlet runs a troubleshooting pack in either interactive or unattended mode. A troubleshooting pack determines the root causes of issues, resolves the issues, and verifies that the issues were resolved. Eval If (Test-Path "$env:allusersprofile\SoftwareDistribution") { Exit 0 } Else { Exit 1 } Remediatrion #Stripped down very low level reset of windows update components Get-TroubleshootingPack -Path $env:systemroot\diagnostics\system\WindowsUpdate | Invoke-TroubleshootingPack -Unattended

0
JasonG-Automox
3 years ago
AdamW-Automox
AdamW-AutomoxAutomox Employee
posted in Community Worklets

Worklet: Uninstalling Applications on MacOS

Hey Y’all! IT Admins often find themselves having to uninstall certain softwares off their macOS devices they manage. This can be a very daunting, time consuming task, especially if you are managing 1000’s of devices that span across several different subnets in different geographic locations. Also, if zero-day vulnerabilities are found to be exploited through one of these applications the speed at which they are uninstalled could mean the difference between you being exploited by an attacker or not. With Automox Worklets we make this task effortless, and remediated within seconds, even across 1000’s of devices in different locations all in the cloud from a single pane of glass. The Worklet example below is designed to evaluate if an applications you specify exists on you macOS devices and uninstall them. Evaluation: #!/bin/bash #The evaluation piece of this worklet is designed to identifying if an application exists on a device. #Designate the application you wish to remove fro

5
AdamW-Automox
3 years ago
ZachF-Automox
ZachF-AutomoxFormer Automox Employee
posted in Community Worklets

Worklet: Auto-Update Stale Docker Containers

Keeping running Docker containers up-to-date is a challenge that can become pretty unwieldy as the amount of infrastructure you manage grows. Thanks to Watchtower, a Docker image that can update other Docker images in a system, updates can be handled in a safe and—more importantly—scalable way. This worklet will check for any Docker running containers on an endpoint with available updates and, if the container has the com.centurylinklabs.watchtower.enable label set to true, will mark those containers for update. Evaluation: #!/bin/bash # helper function to check if a command exists function command_exists { type "$1" &> /dev/null } # only evaluate if docker is available if command_exists docker; then # check for docker containers with available updates # # NOTE: this check only applies to containers where # the com.centurylinklabs.watchtower.enable label # is set to "true" docker run --rm -v /var/run/docker.sock:/var/run/docker.sock cont

0
ZachF-Automox
3 years ago
ZachF-Automox
ZachF-AutomoxFormer Automox Employee
posted in Community Worklets

Worklet: Enable Firewall on macOS

Originally introduced in Mac OS X Leopard (10.5.1), the built-in macOS Firewall limits incoming connections on a per-application basis (as opposed to a per-port basis). Disabled by default, this worklet enables the macOS firewall. Evaluation: #!/bin/bash # helper function to check if a command exists function command_exists { type "$1" &> /dev/null } # only evaluate if the socketfilterfw command is available if command_exists /usr/libexec/ApplicationFirewall/socketfilterfw; then # check if the firewall is enabled /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate | grep -q 'enabled' # yes? no? exit $? fi # socketfilterfw command is not available, move along exit 0 Remediation: #!/bin/bash # turn the firewall on /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on # how did we do? exit $?

0
ZachF-Automox
3 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Community Worklets

Worklet: Install Discord client on Mac

This worklet will check to see if Discord is installed and if it isn’t, will download and install it. See this KB article for how to setup a worklet:  https://help.automox.com/hc/en-us/articles/5603324231700-Creating-a-Worklet Evaluation Code:  #!/bin/bashif [ -d "/Applications/Discord.app" ]; then exit 0else exit 1fi Remediation Code:  #!/bin/bashecho -e "Downloading Discord..."curl -L -o "/tmp/Discord.dmg" https://discordapp.com/api/download?platform=osxecho -e "Installing Discord..."hdiutil attach "/tmp/Discord.dmg" -nobrowseditto "/Volumes/Discord/Discord.app" "/Applications/Discord.app"echo -e "Cleaning up..."hdiutil detach "/Volumes/Discord"rm -f "/tmp/Discord.dmg"

0
Nic-Automox
3 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Community Worklets

Worklet: Install Dashlane client on Mac

This worklet will check to see if Dashlane is installed and if it isn’t, will download and install it. See this KB article for how to setup a worklet:  https://help.automox.com/hc/en-us/articles/5603324231700-Creating-a-Worklet Evaluation Code:  #!/bin/bashif [ -d "/Applications/Dashlane.app" ]; then exit 0else exit 1fi Remediation Code:  #!/bin/bashecho -e "Downloading Dashlane..."curl -L -o "/tmp/Dashlane.dmg" https://www.dashlane.com/directdownload?platform=macecho -e "Installing Dashlane..."hdiutil attach "/tmp/Dashlane.dmg" -nobrowseditto "/Volumes/Dashlane/Dashlane.app" "/Applications/Dashlane.app"echo -e "Cleaning up..."hdiutil detach "/Volumes/Dashlane"rm -f "/tmp/Dashlane.dmg"

0
Nic-Automox
3 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Community Worklets

Worklet: Legal Acknowledgement at Login

This Worklet will let you set a title and message for your users when they login. This can be used as a required legal acceptance of your AUP, or for a critical notification that all users need to see. To remove the security message, edit your script to check for a blank caption and set them both to blank strings. To deploy this endpoint hardening worklet, do the following: Log in to your Automox Console. Browse to the System Management page and click Create Policy . Choose Windows under Worklet. 51%20PM913×682 52 KB Insert the Evaluation and Remediation Code scripts. The evaluation code keeps you apprised of each device’s ongoing compliance, as well as flags the device for remediation. The remediation code enforces this setting on the schedule you define. • Under Evaluation Code: # Define Registry Key and sub-value to evaluate ############################################# $regPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $regPropertyText = "Legal

0
Nic-Automox
3 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Community Worklets

Video: How to install a worklet

Check out this video that walks you through the process: https://patch.automox.com/video-automox-product-feature-overview-creating-worklets  

0
Nic-Automox
3 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Community Worklets

Worklet: XP Patching

This manual process for deploying an emergency patch will decrease the time it takes to ensure your legacy machines are operating at lower risk to exploit. Note: Automox cannot fully update Windows XP versions due to the lack of support for XP updates by Windows Update. Automox can manage software installation and patching, as well as configuration and security settings. There are 2 minimum requirements that can allow Automox to run on Windows XP: Microsoft .NET Framework 3.5 or higher Windows PowerShell 2.0 or higher Windows XP Required Prerequisites Install .NET Framework 3.5 (or higher) https://www.microsoft.com/en-us/download/details.aspx?id=21 Install PowerShell 2.0 via Windows Management Framework (.NET required first) https://www.microsoft.com/en-us/download/details.aspx?id=16818 Install Automox (with legacy Installer) https://console.automox.com/Automox_Legacy_Installer-latest.msi (Note: GetSystemDetail scan command WILL NOT work, so there are no hardware details and the comp

0
Nic-Automox
3 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Community Worklets

About the Worklets category

Automate and enforce any scriptable action on endpoints.

0
Nic-Automox
3 years ago

Badge winners

  • Conversation Starter
    schweeeeethas earned the badge Conversation Starter
  • Conversation Starter
    Tom.Arilhas earned the badge Conversation Starter
  • Conversation Starter
    AdamW-Automoxhas earned the badge Conversation Starter
  • Conversation Starter
    randygarlandhas earned the badge Conversation Starter
  • Conversation Starter
    dylanhas earned the badge Conversation Starter
Show all badges
Terms & ConditionsCookie settings