Agent uninstallation restriction

@Arunchandar N That would be a great idea! Meanwhile you could consider locking down the service to say the NT System account and perhaps a security group for those allowed to manage the service. 

Checkout https://decoder.cloud/2019/02/07/demystifying-windows-service-permissions-configuration/

I’m using two remediation scripts within Intune. One makes sure the service is running (it can occasionally fail) and the other to make sure Automox is installed. Best part of those Intune remediation scripts, you can set the frequency much tighter than an Automox worklet. For example every few hours as opposed to once daily. 

Check Automox Service -- If you suspect end users are disabling the service, I'd add some logic to set the service to automatic.

# Detection

$service = Get-Service amagent

IF($service.Status -ne 'Running'){exit 1}

# Remediation

function Stop-ServiceWithTimeout ([string] $name, [int] $timeoutSeconds) {
        $timespan = New-Object -TypeName System.Timespan -ArgumentList 0,0,$timeoutSeconds
        $svc = Get-Service -Name $name
        if ($svc -eq $null) { return $false }
        if ($svc.Status -eq [ServiceProcess.ServiceControllerStatus]::Stopped) { return $true }
        $svc.Stop()
        try {
            $svc.WaitForStatus([ServiceProcess.ServiceControllerStatus]::Stopped, $timespan)
        }
        catch [ServiceProcess.TimeoutException] {
            Write-Verbose "Timeout stopping service $($svc.Name)"
            return $false
        }
        return $true
}

$service = Get-Service amagent

IF($service.Status -ne 'Running'){
    Write-Output "Detected Automox amagent service running. Stopping service"
    $try = Stop-ServiceWithTimeOut -name amagent -timeoutSeconds 10 -verbose
    $status = Get-WmiObject win32_service | where name -eq amagent
    IF($status.State -ne "stopped")
    {
        taskkill /PID $status.ProcessId /F
    }
    $service = Get-Service amagent
    IF($service.Status -eq 'Stopped'){Write-Output "Service stopped successfully."}
    Write-Output "Starting amagent service"
    Start-Service amagent -Verbose
}else{
    Write-Output "Automox status was $($service.Status). Restarting anyway"
    Restart-Service amagent -Verbose
}

Check if Automox is installed, if not, install.

# Detection

# Check if already installed
$unkeys = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall"
foreach ($key in Get-ChildItem $unkeys -ErrorAction SilentlyContinue | Get-ItemProperty | Where-Object { ($_.DisplayName -like "*Automox*" -and $_.DisplayVersion) })
{
        Write-Output "Automox Agent is already installed"
        $i++
}
$un64keys = "HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall"
foreach ($key in Get-ChildItem $un64keys -ErrorAction SilentlyContinue | Get-ItemProperty | Where-Object { ($_.DisplayName -like "*Automox*" -and $_.DisplayVersion) })
{
        Write-Output "Automox Agent is already installed"
        $i++
}
IF($i -gt 0){exit 0}else{exit 1}

# Remediation

# Access Key
$accesskey = '0000000000000000000000'
# Install
$TLS12Protocol = [System.Net.SecurityProtocolType] 'Ssl3 , Tls12'
[System.Net.ServicePointManager]::SecurityProtocol = $TLS12Protocol
$source = 'https://console.automox.com/installers/Automox_Installer-latest.msi'
$destination = 'C:\Automox_Installer-latest.msi'
$client = (New-Object Net.WebClient)
$client.DownloadFile($source, $destination)
Start-Process msiexec.exe -ArgumentList "/i $destination /qn /norestart ACCESSKEY=$accesskey" -Wait
del $destination

# Check if install worked
$unkeys = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall"
foreach ($key in Get-ChildItem $unkeys -ErrorAction SilentlyContinue | Get-ItemProperty | Where-Object { ($_.DisplayName -like "*Automox*" -and $_.DisplayVersion) })
{
        $installed++
}
$un64keys = "HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall"
foreach ($key in Get-ChildItem $un64keys -ErrorAction SilentlyContinue | Get-ItemProperty | Where-Object { ($_.DisplayName -like "*Automox*" -and $_.DisplayVersion) })
{
        $installed++
}

IF($installed -gt 0)
{
    Write-Output "Automox Agent installed Succesfully"
    exit 0
}else{
    exit 1
}