Find & Share Worklets

For detailed steps on creating and scheduling a Worklet, please see this article: Creating a Worklet  For an overview on Worklets, see this article:  How to Use Worklets  The Worklets  The following Evaluation and Remediation worklets can be used to enforce BitLocker encryption.  Evaluation Code  # PowerShell 4.0 and Above# Windows 8 and later#Get BitLocker status for All Drivestry { $encryption = Get-BitLockerVolume -ErrorAction Stop }catch { Write-Output "Unable to determine BitLocker status" }# Count Drives and initialize lists for later output$numDrives = $encryption.Count$encCount = 0$encrypted = @()$unencrypted = @()# Loop through each drive and see if it is Protected or Note# Add to the appropriate list, Encrypted or Unencryptedforeach ($drive in $encryption) { $encStatus = $drive.ProtectionStatus $encInProgress = $drive.VolumeStatus if ( ($encStatus -match 'On') -or ($encInProgress -match "EncryptionInProgress") ) { $encrypted += $drive.MountPoint $encCou

Dell BIOS driver privilege flaws have been recently uncovered. They affect many different models of Dell on Windows 7 through Windows 10. More detail here: SentinelLabs – 4 May 21 CVE-2021-21551- Hundreds Of Millions Of Dell Computers At Risk Due to... Update your Dell devices now! SentinelLabs discover five high severity flaws in Dell firmware update driver impacting desktops, laptops, notebooks and more. Est. reading time: 9 minutes This worklet will band-aid the issue by removing the dbutil_2_3.sys file until you can update any affected Dell systems to the latest firmware as detailed here (minimum firmware version for each model recommended is at the bottom of the page): https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerability It appears that reintroduction of the dbutil_2_3.sys to affected systems is a possibility, so

Hi Guys, i´m testing the Worklet to " Uninstall Specific App by Name", I test uninstalling Ccleaner and Winrar in a machine, the policy for Ccleaner looks like do the job, Ccleaner was uninstalled and i get this message from the Activity report: Uninstalled the following key: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CCleaner Uninstall Successful All good with Ccleaner, but with the policy for WinRar the result was : COMMAND TIMED OUT error, and with others Samsung apps that i try to uninstall with the policy andof course the Apps weren´t uninstalled. Event viewer not show any related to that error, how we can see what happend, what that “COMMAND TIME OUT” means

Hi all, in response to a users query on here I thought I’d post a quick and easy way to update your primary and secondary DNS entries on your devices. Be sure to amend the “Ethernet*” in -InterfaceAlias to target your desired network adapters and edit the “8.8.8.8”,“1.1.1.1” to your specified DNS servers Be sure to test first, this will also output those amended network adapters to your Reports > Activity log Evaluation: Exit 0 Remediation: Set-DnsClientServerAddress -InterfaceAlias "Ethernet*" -ServerAddresses @("8.8.8.8","1.1.1.1") Get-DnsClientServerAddress -InterfaceAlias "Ethernet*" | Select InterfaceAlias,ServerAddresses

Following on from the first deep dive interview with @Mrichards, we have @jesumyip this time to tell us more about the creation process for his scheduled task worklet. Nic: What was the impetus for creating this worklet? Je Sum: I wanted to duplicate GPO behaviour. My goal was to eventually replace GPO in my organization with Automox. And one of the most troublesome behaviour to remove is when a group policy runs in the user context. It is difficult (not impossible, but a lot of code is required in the worklet) for the Automox agent to duplicate that behavior given that it runs in the SYSTEM context. Nic: What difficulties or obstacles did you run into? Je Sum: Trying to figure out how to work this using 100% Powershell only. I eventually realized it cannot be done - you need access to COM to complete the task. Nic: What sorts of scheduled tasks are you automating using this worklet? Je Sum: It is mostly registry changes now - for example, disabling macros in Office to avoid macro-rela

Hi all, here’s a Worklet to uninstall Notepad++ (we now use Visual Studio Code) Evaluation: if (Test-Path -Path "C:\Program Files\Notepad++") { Write-Output "Notepad++ not installed, skipping" exit 0 } else { Write-Output "Notepad++ installed, we will uninstall" Exit 1 } Remediation: Write-Output "Notepad++ installed, now removing" Start-Process -FilePath "C:\program files\notepad++\uninstall.exe" -ArgumentList "/S" -WindowStyle Hidden -Verbose Remove-Item "C:\program files\notepad++" -Confirm:$false -Verbose Write-Output "Notepad++ uninstalled"

Hey Guys, This is one I’ve been thinking about how best to write for a bit. It took some consideration on how to handle the 64-bit scenario because the Automox Agent is a 32-bit process. The ScriptBlock method I used here worked wonders–and can be re-purposed for anything that needs a 64-bit shell. So all you have to do here is define $appName in both blocks (make sure they match!). If it finds any matches, the Evaluation returns as Non-Compliant (since uninstalled is the desired state). It uses similar detection in the Remediation to find the applications “UninstallString” which can be used to run an uninstall–but adding parameters/arguments for silent execution. Since EXE arguments are non-standard, you may need to customize that bit, but /S works for most of them. There are a ton of comments inside to make it clear what’s happening, but feel free to ask any questions that might come up. Evaluation <# .SYNOPSIS Check for presence of specified application on the target device .D

Delete Skype Run at Startup Registry Key Value Under HKEY_USERS (HKCU Workaround) It has come up more than a few times that modifying HKCU in a worklet doesn’t behave as expected. This is because the process is running under the SYSTEM account. So only the keys under the SYSTEM SID (S-1-5-18) will be modified if you point to HKCU:\ . This worklet deletes the desired value for every local user account tied to that device. It is based on @rich’s original HKCU workaround: Modify registry key/value under HKEY_USERS (HKCU Workaround) NOTE: Because of using Get-CimInstance, this worklet will only work on Windows 10, Server 2016+, or systems upgraded to at least PowerShell 5. This particular worklet removes a Skype (Lync) registry value located in the “Run” container which runs it at each user’s startup. It also deletes some Skype start-menu shortcuts at the end. The purpose of using it is because the customer’s Skype was integrated with MS Office and couldn’t be individually uninstalled.

Hi all, We disable IPv6 in our environment and thought I’d share a quick worklet to disable this. Evaulation: exit 1 Remediation: Get-NetAdapter | foreach { Disable-NetAdapterBinding -InterfaceAlias $_.Name -ComponentID ms_tcpip6 } Write-Output "Disabled IPv6, running check to report new status" Get-NetAdapterBinding -ComponentID ms_tcpip6 | select-object Enabled

Hi there, Here is a quick Worklet to disable NetBIOS for all adapters as part of a past pen test remediation Evaluation: exit 1 Remediation: $adapters=(gwmi win32_networkadapterconfiguration ) ForEach ($adapter in $adapters) { Write-Host $adapter $adapter.settcpipnetbios(2) }

As written, this manually run worklet will return the last five reboots of a device with the date & user. If you wish to see further detail, you can add any of the following to the Select-Object at the end of the remediation: Process, Action, Reason, ReasonCode, Comment. You can also modify the -First number if you need to see more than the last five reboots. Evaluation: Exit 0 Remediation: Get-WinEvent -FilterHashtable @{logname='System'; id=1074} | ForEach-Object { $rv = New-Object PSObject | Select-Object Date, User, Action, Process, Reason, ReasonCode, Comment $rv.Date = $_.TimeCreated $rv.User = $_.Properties[6].Value $rv.Process = $_.Properties[0].Value $rv.Action = $_.Properties[4].Value $rv.Reason = $_.Properties[2].Value $rv.ReasonCode = $_.Properties[3].Value $rv.Comment = $_.Properties[5].Value $rv } | Select-Object Date, User -First 5 # Edit above Select-Object line to see additional fields from the first Select-Object stat

Hey Guys, Here is a quick worklet I wrote that I’ve been using to fix the MS BSOD error. Please let me know your thoughts, looking to improve my coding skills. Evaluation Code: #KBs that want to query for $kb = '5000802' $kb2 = '5001567' # Checks for installed KB $installed = Get-HotFix -Id "KB$kb" -ErrorAction SilentlyContinue $installed2 = Get-HotFix -ID "KB$kb2" -ErrorAction SilentlyContinue if (( $installed )) { Exit 1 }elseif($installed2){ exit 0 #exits with output in the report write-host = "$kb2 patch Installed" } else { Exit 0 #exits but can view the output via the report. Write-Host = "$kb Not installed" } Remediation Code: $SF = "C:\" $file = 'windows10.0-kb5001567.msu' $kb = '5000802' $installed = Get-HotFix -ID "KB$kb2" -ErrorAction SilentlyContinue if($installed){ Copy-Item .\$file -Destination "$SF\$file" Start-Process -FilePath "wusa.exe" -ArguementList "$SF\$file /quiet /norestart" -wait Remove-Item $SF\$file }Else{ write-host = 'patch

Hi all, here’s a Worklet to install Zoom on MacOS Evaluation: #!/bin/bash #Checks whether zoom.us.app is installed in the /Applications directory, if not, Exit 1 code and goes to next step if [[ -d "/Applications/zoom.us.app" ]]; then echo "Zoom is installed." exit 0 else echo "Zoom is not installed." exit 1 fi Remediation: #!/bin/bash echo -e "Downloading Zoom..." #Downloads Zoom pkg to /tmp/ curl -L -o "/tmp/zoompkg.pkg" https://zoom.us/client/latest/Zoom.pkg echo -e "Installing Zoom..." #Runs the installer sudo installer -pkg /tmp/zoompkg.pkg -target / echo -e "Cleaning up..." rm -f "/tmp/zoompkg.pkg"

Hi all, here’s a Worklet to install Slack on MacOS Evaluation: #!/bin/bash #Checks whether the Slack.app is installed in the /Applications directory, if not, Exit 1 code and goes to next step if [[ -d "/Applications/Slack.app" ]]; then echo "Slack is installed." exit 0 else echo "Slack is not installed." exit 1 fi Remediation: #!/bin/bash echo -e "Downloading Slack..." curl -L -o "/tmp/Slack.dmg" https://slack.com/ssb/download-osx echo -e "Installing Slack..." hdiutil attach "/tmp/Slack.dmg" -nobrowse ditto "/Volumes/Slack.app/Slack.app" "/Applications/Slack.app" echo -e "Cleaning up..." hdiutil detach "/Volumes/Slack.app" rm -f "/tmp/Slack.dmg"

This PowerShell function will help you automate putting Automox clients into Groups. I’m running this during the imaging process so I don’t have to manually move new workstations in a specific group. The example shows parent group. Function Set-AutomoxGroup{ $key = "Your-Orgs-Key" $num = Get-Random -Minimum 1 -Maximum 5 $group = switch ($num) { 1 {'EUS Windows Group 1'} 2 {'EUS Windows Group 2'} 3 {'EUS Windows Group 3'} 4 {'EUS Windows Group 4'} 5 {'EUS Windows Group 5'} Default {'EUS Windows Group 1'} } Start-Process "C:\Program Files (x86)\Automox\amagent.exe" -ArgumentList "--deregister" | Out-Null & "C:\Program Files (x86)\Automox\amagent.exe" --setgrp "Default Group/Workstations/$group" & "C:\Program Files (x86)\Automox\amagent.exe" --setkey $key" Restart-Service amagent Return $group } $grp = Set-AutomoxGroup Write-Output"Set Automox to group $grp" -ForegroundColor Cyan

It’s been a while, but we have a new Worklet Leaderboard coming your way. Things have been shaken up a bit since December’s leaderboard, including a new number one (and a ton of people tied for 5th)! Check out the updated leaderboard: @vienna - 7 @jesumyip - 6 @Maikel - 5 @ncaraway - 4 @VicKhan - 4 @jack.smith - 4 @jbragdon - 4 @Mrichards - 4 If you want to see yourself on the next leaderboard, feel free to submit your own Worklets in the Worklet group here. Plus, you’ll get a free piece of swag for each Worklet you submit 🙂 Thanks to everyone that’s contributed to our Worklet catalog so far!

This worklet compares a list of currently installed software to a list of approved software. The worklet uses .txt files to store the arrays since that made it easier to test. The Approved.txt file needs to be uploaded to the worklet, and should just be a list of approved software, one per line. Wildcards can be used in the Approved.txt file. Evaluation: Exit 1 Remediation: Get-WmiObject -Class Win32_Product | Sort-Object -Property Name | Select -ExpandProperty Name | Set-Content Installed.txt $Installed = Get-Content Installed.txt $Approved = Get-Content Approved.txt Write-Host "Unapproved Software:" $Installed |Where {$item=$_; -not ($Approved |Where {$item -like $_}) }

Hi all, sharing another worklet we used to uninstall CCleaner, not a common everyday application but might be useful to some. Evaluation: if (Test-Path -Path "C:\Program Files\CCleaner") { Write-Output "CCleaner not installed, skipping" exit 0 } else { Write-Output "CCleaner installed, we will remove" Exit 1 } Remediation: Write-Output "CCleaner installed, now removing" Start-Process -FilePath "c:\program files\ccleaner\uninst.exe" -ArgumentList "/S" -WindowStyle Hidden

Hi Automox Community,We are routinely asked about bandwidth restricted environments and what we can do to avoid saturating internet connections. While there is nothing in the console to limit this, it is possible to govern the endpoints to do this for us. The included Worklet modifies the Windows 10 Bandwidth settings for downloading updates and allows you to specify exactly how much bandwidth a single machine can dedicate to downloading updates.Evaluation: $regPathAU = ‘HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization’if (Test-Path -Path $regPathAU) {exit 0} else {exit 1}Remediation: ##############################################path$regPathAU = ‘HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization’#Test AU path, if path exists then create keys, else create path then create keys#Bandwidth in Hexadecimal KiloBYTES (64 = Decimal 100KB = .8Mbps)if (Test-Path -Path $regPathAU) {‘Name,Value,TypeDOMaxBackgroundDownloadBandwidth,64,DWORD’ |ConvertFrom-Csv |Set-ItemPro

The following Worklet will ensure all of your devices are always on the most current release of Windows 10. Since the current version is 2004, that is the version this Worklet will upgrade you. This Worklet supports multiple languages:  DISCLAIMER: THIS WILL AUTOMATICALLY REBOOT THE DEVICE WHEN THE UPGRADE IS COMPLETE WITHOUT USER NOTIFICATION  Thanks to @aescolastico for creating this!  Evaluation:  if ((Test-Path $iso) -eq $true) {Remove-Item $iso}$osversion = (Get-Item "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion").GetValue('ReleaseID')if (($osversion -lt "2004")) {exit 1 }else {exit 0 } Remediation:  function Get-Win10ISOLink { <# .SYNOPSIS This function generates a fresh download link for a Windows 10 ISO .NOTES Version: 1.6 Author: Andy Escolastico Creation Date: 10/11/2019 #> [CmdletBinding()] param ( [Parameter(Mandatory=$false)] [ValidateSet("64-bit", "32-bit")] [String] $Arc

As of right now, here’s the current issue: When users of Kyocera, Ricoh, Zebra printers (among others) attempt to print, they are instead presented with an irritating Blue Screen of Death (BSOD). https://hothardware.com/news/this-windows-10-update-is-causing-bsod-crashes-simply-by-printing If you wish to remove these from your environment, and keep them out: First, go to the Automox software page, search for each KB, then click on the Actions button and choose Ignore for each result. This should keep them from getting re-installed again. Second, run this worklet on them. Evaluation: # Look for the following KBs. If found, Exit 1 remediate $UpdateArray = @('KB5000802','KB5000808') foreach ($UpdateVersion in $UpdateArray) { $SearchUpdates = Get-HotFix -Id "$UpdateVersion" -ErrorAction SilentlyContinue if ($SearchUpdates) { Exit 1 } } # KBs not found Exit 0 Remediation: # "19041.867.1.8" = KB5000802 # "18362.1440.1.7" = KB5000808 $UpdateArray = @("19041.867.1.8"

Hi all, Here is a method to install Microsoft Office 365 via a Worklet. Basically it checks whether Word, Excel, PowerPoint and Outlook are installed, if not, it then downloads the pkg for MS Office which I got from https://macadmins.software/ and then installs from the /tmp/ directory, then removes the installer. You may want to change the download link if it expires or doesn’t work. Evaluation: #!/bin/bash #Checks whether these .apps are installed in the /Applications directory, if not, Exit 1 code and goes to next step if [[ -d /Applications/Microsoft\ Word.app && -d /Applications/Microsoft\ Excel.app && -d /Applications/Microsoft\ PowerPoint.app && -d /Applications/Microsoft\ Outlook.app ]]; then echo "Microsoft Office is installed." exit 0 else echo "Microsoft Office is not installed." exit 1 fi Remediation: #!/bin/bash echo -e "Downloading Microsoft Office..." #Downloads MS Office pkg to /tmp/ curl -L -o "/tmp/mspkg.pk

Hi Guys, I was tasked to develop a network health check due to a ton of our employees reporting network issues while WFH. Our theory was users we’re either using 10 year old modem/router combos or trying to work poolside outside their wifi range. Evaluation: exit 0 We just run this script without eval codes on all machines, exiting 0 will make sure our devices are seen as “compliant” So I broke this out into different functions, this all will report back into activity log, where you can export as CSV and do some excel number crunching on it Wifi strength, this will pull all wifi adapters and get their signal strength in a percentage. put it into the array $wifi and report back after 10 seconds Ping test, will ping 8.8.8.8 10 times and look for packet timeout/delay. Then we just cut the fat to save us some keystrokes in activity log Traceroute out to 8.8.8.8 again, but dont report back any routes that are less than 10ms in delay, again saving us on keystrokes in the activity log.

Hi all, Just posting my method of installing Firefox (I know you can use a Required Software policy but that wasn’t going to work for us) Simply if you download the Firefox MSI via https://www.mozilla.org/en-GB/firefox/all/#product-desktop-release and then upload it, once uploaded, make sure the file name matches in the remediation script. This then checks whether a temp folder on c:\ exists, if so, skips, if not, creates, then checks if Mozilla Firefox exists in Program Files, if not, it installs it. Evaluation if (Test-Path -Path "C:\Program Files\Mozilla Firefox") { exit 0 } else { Exit 1 } Remediation $path = "C:\temp\" if(!(Test-Path -path $path)) { New-Item -ItemType directory -Path $path -Verbose Write-Output "The folder path has been created successfully at $path" } else { Write-Output "The folder $path already exists" } Start-Transcript -Verbose -Path "c:\temp\firefox.log" Copy-Item "firefox_setup_86.msi" -Destination "C:\temp\firefox_setup_86.ms

This worklet will check to see if Box is installed and if it isn’t, will download and install it. See this KB article for how to setup a worklet:https://help.automox.com/hc/en-us/articles/5603324231700-Creating-a-Worklet Evaluation Code:  #!/bin/bashif [ -d "/Applications/Box Sync.app" ]; then exit 0else exit 1fi Remediation Code:  #!/bin/bashecho -e "Downloading Box Sync..."curl -L -o "/tmp/Box Sync Installer.dmg" https://e3.boxcdn.net/box-installers/sync/Sync+4+External/Box%20Sync%20Installer.dmgecho -e "Installing Box Sync..."hdiutil attach "/tmp/Box Sync Installer.dmg" -nobrowseditto "/Volumes/Box Sync Installer/Box Sync.app" "/Applications/Box Sync.app"echo -e "Cleaning up..."hdiutil detach "/Volumes/Box Sync Installer"rm -f "/tmp/Box Sync Installer.dmg"