Find & Share Worklets

!/bin/bash mkdir /tmp/cylanceinstall scp CylancePROTECT.pkg /tmp/cylanceinstall sleep 3 echo [Copy install token here] > /tmp/cylanceinstall/cyagent_install_token sudo installer -pkg /tmp/cylanceinstall/CylancePROTECT.pkg -target /

#Set-up script to remove apps and enable/disable features. #Creates a logfile in C: Start-Transcript -Path C:\SetupLog.txt -NoClobber #List of apps to remove. May be ammended in the future. #Please Note: Do Not Remove the Windows Store App. This will cause problems. $AppsToRemove = @( “Microsoft3DViewer” “GetHelp” “Getstarted” “OfficeHub” “SolitaireCollection” “MixedReality” “OneNote” “People” “SkypeApp” “Wallet” “Alarms” “windowscommunicationsapps” “FeedbackHub” “Finance” “News” “Sports” “SoundRecorder” “XBox” “YourPhone” “Zune” “LinkedIn” “DellInc” “Watchdog” “Messaging”) #This is the main loop that removes the programs specified. #It removes the apps from the current user and from provisioned packages preventing them from being #installed when a new user profile is created, such as when a domain user logs into a new computer. ForEach($App in $AppsToRemove){ Get-AppxPackage -AllUsers | ? Name -Like “$App” | Remove-AppxPackage Get-AppxProvisionedPackage -Online | ? DisplayName -Like

I wanted to make it easier for folks to install my favorite privacy-focused browser on Linux, so I’m sharing this script. Hope to increase adoption of this great browser!! Evaluation: exit 0 Remediation: sudo apt install apt-transport-https curl curl -s https://brave-browser-apt-release.s3.brave.com/brave-core.asc | sudo apt-key --keyring /etc/apt/trusted.gpg.d/brave-browser-release.gpg add - echo "deb [arch=amd64] https://brave-browser-apt-release.s3.brave.com/ stable main" | sudo tee /etc/apt/sources.list.d/brave-browser-release.list sudo apt update sudo apt install brave-browser

Figured it might be good to clear caches and cookies with a Worklet. Found this script fo target IE, Chrome and Chromimum directories together, and lets you define how old of data you’d like to remove by defining $DaysToDelete. This is written to be run manually. I’m repurposing this script from a script I found online because I’m jealous of the Yeti tumblers and this also seems like a good worklet to have (scanned this script with my sales eyes and it looks legit): Evaluation exit 0 Remediation: $DaysToDelete = 1 ## Set this to the number of days to keep data on the device $temporaryIEDir = "C:\users\*\AppData\Local\Microsoft\Windows\Temporary Internet Files\*" ## Remove all files and folders in user's Temporary Internet Files. $cachesDir = "C:\Users\*\AppData\Local\Microsoft\Windows\Caches" ## Remove all IE caches. $cookiesDir = "C:\Documents and Settings\*\Cookies\*" ## Delets all cookies. $locSetDir = "C:\Documents and Settings\*\Local Settings\Temp\*" ## Delets all local se

robocopy C:\users\zacp\documents f:\mybackup\documents /copyall /e /r:0 /dcopy:t /mir

This worklet will return the recent reboot history for the machine(s) it’s run against. As written it returns the 5 most recent reboots, but you can change that number to your liking. It is also written with what I felt were the most important fields to see, but you can change the last Select-Object statement to include additional fields listed in the first Select-Object statement. This worklet is designed to be run manually. If you schedule it, change the evaluation to “Exit 1”. Evaluation: Exit 0 Remediation: Get-WinEvent -FilterHashtable @{logname='System'; id=1074} | ForEach-Object { $rv = New-Object PSObject | Select-Object Date, User, Action, Process, Reason, ReasonCode, Comment $rv.Date = $_.TimeCreated $rv.User = $_.Properties[6].Value $rv.Process = $_.Properties[0].Value $rv.Action = $_.Properties[4].Value $rv.Reason = $_.Properties[2].Value $rv.ReasonCode = $_.Properties[3].Value $rv.Comment = $_.Properties[5].Value $rv } | Select-Ob

This worklet as written checks all drives on non-server Windows devices for BitLocker compliance. You can remark out or alter the first IF statement to account for more types of systems. Compliance consists of full drive encryption AND protection status is on. If you schedule it, it will report to the activity log ONLY the devices that aren’t fully compliant on every drive in the system. If you manually run it (or change the evaluation to just: Exit 1), it will report compliance and non-compliance on ALL devices to the activity log unless you put the $HardwareType check from the evaluation into the remediation to pare down the types of devices checked. Evaluation: # PowerShell 4.0 and Above # Windows 8 and later $HardwareType = (Get-WmiObject -Class Win32_ComputerSystem).PCSystemType # Exit if computer is known type and a server # Remark out this line if you want all hardware checked, or change the if statement to the hardware you want # $HardwareType = 0-Unknown, 1-Desktop, 2-Mobil

Hi everyone As we know, Microsoft is retiring Skype for Business next year from the suite of Office 365 applications. We haven’t found a way to uninstall Skype for Business unless you either Modify the installed O365 package (option to Modify isn’t always available, depending on how you installed it initially), or you completely uninstall the entire suite of Office 365 apps, and reinstall it without Skype for Business (which is a royal pain in the ***!). I’ve opted to do 3 things Stop the Skype for Business auto-start process (this is a registry setting). You can read about it here https://answers.microsoft.com/en-us/msoffice/forum/msoffice_sfb-mso_winother-mso_o365b/stop-skype-for-business-from-starting/44c65b0a-a2b3-4d65-877c-70bfd2adb052. I found out later on Windows 10 that there is a catch to this. You also need to terminate the Skype process otherwise this won’t work. The settings are ignored. Hence do a “Stop-Process lync” to achieve this. You can read about it here https://ans

______ __ ________ ______ _____ __ _ / ____/__ / /_ / _/ __ \/ ____/___ ____ / __(_)___ ___ ___________ _/ /_(_)___ ____ / / __/ _ \/ __/_____ / // /_/ / / / __ \/ __ \/ /_/ / __ `/ / / / ___/ __ `/ __/ / __ \/ __ \ / /_/ / __/ /_/_____// // ____/ /___/ /_/ / / / / __/ / /_/ / /_/ / / / /_/ / /_/ / /_/ / / / / \____/\___/\__/ /___/_/ \____/\____/_/ /_/_/ /_/\__, /\__,_/_/ \__,_/\__/_/\____/_/ /_/ /____/ https://github.com/bragdonjm/PS-Automox-Worklets/blob/main/Worklets/Get-IPConfiguration.ps1 Computer system sprawl is a real thing. Finding specific information about a system in some easy to use automatic method can be tricky. Here is a worklet to grab detailed information about all network interfaces on a remote windows system. Note: - Powershell is only. - Verbose is supported though there is not m

______ __ ______ _ __ ____ / ____/__ / /_ / ____/___ _(_) /__ ____/ / / ____ ____ _____ ____ _____ / / __/ _ \/ __/_____/ /_ / __ `/ / / _ \/ __ / / / __ \/ __ `/ __ \/ __ \/ ___/ / /_/ / __/ /_/_____/ __/ / /_/ / / / __/ /_/ / /___/ /_/ / /_/ / /_/ / / / (__ ) \____/\___/\__/ /_/ \__,_/_/_/\___/\__,_/_____/\____/\__, /\____/_/ /_/____/ /____/ https://github.com/bragdonjm/PS-Automox-Worklets/blob/main/Worklets/Get-FailedLogons.ps1 Computer not connected to Activate Directory can have issues reporting failed login attempts. Through Automox Worklets, you can now query batches of remote Windows computers running Automox for any failed logins attempts. A nicely formated table including the most relevent metadata is returned. Note: - This script must be run as admin. To access the security log, you must run this throu

_____ _ ______ _ _ | __ \ | | | _ \(_) | | | | \/ ___ | |_ ______ | | | | _ ___ | | __ ___ _ __ __ _ ___ ___ | | __ / _ \| __||______|| | | || |/ __|| |/ // __|| '_ \ / _` | / __| / _ \ | |_\ \| __/| |_ | |/ / | |\__ \| < \__ \| |_) || (_| || (__ | __/ \____/ \___| \__| |___/ |_||___/|_|\_\|___/| .__/ \__,_| \___| \___| | | |_| https://github.com/bragdonjm/PS-Automox-Worklets/blob/main/Worklets/Get-DiskSpace.ps1 End users calling you day and night complaining about disk space? Need a fast way to check remote disk space? Are you running Automox? You are in luck! Use this script to report back disk space usage and User Folder total usage. Note: - Powershell is only. - Verbose is s

Automox Worklet: Test Website Every find yourself in need of testing a site remotely? Wondering if it is actually up? Want to test it from the eyes of your users? This tool is for you! Can stand alone or as worklet! Examples: .\Test-Website.ps1 –> returns test against automox console by default. { “loadedInSeconds”: 0.175, “statusDescription”: “OK”, “siteTested”: “https://console.automox.com/”, “serverType”: “nginx”, “statusCode”: 200 } .\Test-Website.ps1 -target www.google.com –> Tests a specific target you define. This works from your ps console but most likely will not work for worklets. { “loadedInSeconds”: 0.1323, “statusDescription”: “OK”, “siteTested”: “www.google.com”, “serverType”: “gws”, “statusCode”: 200 } .\Test-Website.psl -verbose Shows the hidden outputs for testing. VERBOSE: Test-Website.ps1 Initial Setup, Started running on 10/02/2020 15:29:49 VERBOSE: GET http://www.google.com/ with 0-byte payload VERBOSE: received -1-byte response of content type text

This worklet can be used to disable USB remote storage devices in Windows. It has only been tested on Windows 10, and because of the default version of PowerShell on Win 7/8 and Server 2012 and older, I don’t believe it will work on those older operating systems without upgrading PowerShell on them - but haven’t tested. I’d be curious to see if it works on any of the older OSs, so let us know what you find. Be sure you’re not using this in an environment where GPOs would be fighting this worklet. It’s preferable if you use GPOs in your environment that you control USB remote storage that way and not with a worklet. The way the worklet is currently written, it will check to see if the USB removable storage policy is disabled (access to the removable drive is permitted) and enables it to lock down the use of USB removable storage. With some tweaking, you can also make it a worklet to reverse the process (disable the policy to allow USB removable storage). You can also tweak it so th

This worklet by default will install the latest, stable version for Windows 64-bit. You can also modify $Channel to install the Dev or Beta instead. Here’s the description of the channels: docs.microsoft.com Microsoft Edge channel overview Microsoft Edge channel overview You can also modify $ProductVersion to specify a particular version you want installed. It has been tested on systems without any version of Edge pre-existing (ie. Win7) and on others that have the original version of Edge (whose end of life is March 9, 2021) such as Win10 v1909 & v2004. Evaluation: $software = "Microsoft Edge"; $installed = (Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where { $_.DisplayName -eq $software }) -ne $null If(-Not $installed) { Exit 1 } else { Exit 0 } Remediation: # Channel options are: Dev, Beta, Stable, EdgeUpdate, Policy $Channel = 'Stable' # Where to download the install file $Folder = "C:\Te

Evaluation code $regkey = "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}" $name = "Version" Get-ItemProperty -Path "$regkey" -Name "$name" -ErrorAction SilentlyContinue If (($exists -ne $null) -and ($exists.Length -ne 0)) { Exit 0 } else { Exit 1 } Remediation code #Set download URLs for the various installers $vcredist_08 = "https://download.microsoft.com/download/5/D/8/5D8C65CB-C849-4025-8E95-C3966CAFD8AE/vcredist_x64.exe" $vcredist_10 = "https://download.microsoft.com/download/1/6/5/165255E7-1014-4D0A-B094-B6A430A6BFFC/vcredist_x64.exe" $vcredist_12 = "https://download.microsoft.com/download/1/6/B/16B06F60-3B20-4FF2-B699-5E9B7962F9AE/VSU_4/vcredist_x64.exe" $vcredist_13 = "https://download.microsoft.com/download/2/E/6/2E61CFA4-993B-4DD4-91DA-3737CD5CD6E3/vcredist_x64.exe" $vcredist_1519 = "https://aka.ms/vs/16/release/vc_redist.x64.exe" #Download the installers Invoke-WebRequest $vcredist_08 -OutFile $env:tem

Currently, if you have a worklet that you only run manually (never scheduled), you typically would set “Exit 1” for the evaluation so that when it’s executed, it will always run the remediation. The problem is that if you have manual-only worklets assigned to groups, none of the computers in those groups will EVER appear fully compliant since the manual worklet will always appear to be non-compliant, and thus each computer in those groups will NEVER appear as fully compliant. With this trick, you can make manual-only worklets always appear compliant. To do this, just put the following code as your worklet evaluation: Exit 0 The reason you can do this is that if you manually execute a worklet, it executes the remediation no matter what, but the “Exit 0” at least makes it appear as compliant. Remember, if you set a schedule to this worklet, it will never run because it will always get an “Exit 0” response (exit without running remediation). Use this ONLY with manual-run, non-schedu

Hi Guys, My security team was asking us to turn off DNS over HTTPS on our two browsers we support (firefox and chrome). On chrome its quite easy (drop a token that checks in with our enterprise gsuite) but for firefox, you need to drop a json file into the firefox directory. Evaluation: We only want to drop this json file if the box has firefox installed but not the policies.json. So we exit 0 if either both are true, or firefox just doesnt exist. $file = Test-Path 'C:\Program Files\Mozilla Firefox\distribution\policies.json' -PathType Leaf $application = Test-Path 'C:\Program Files\Mozilla Firefox\firefox.exe' -PathType Leaf if ($file -eq $true -And $application -eq $true) {exit 0} if ($application -eq $false) {exit 0} else {exit 1} Remediation: Copy-Item .\policies.json -Destination "C:\ProgramData\amagent" ######### #Copy over json before it gets to 64 bit powershell $scriptblock = { $software = "Mozilla Firefox"; $installed = (Get-ItemProperty HKLM:\Software\Microsoft

This worklet will install the Okta Device Trust app on Windows to ensure that devices authenticating to secure apps (like VPN) are owned and managed by your enterprise. Make sure to grab the latest version of the Okta Device Trust app from your admin console. You can find it on the Downloads page under Settings or https://tenant.okta.com/admin/settings/downloads. After downloading the latest version of the app, upload the installation file to the worklet. As of publishing this, the latest version is 1.3.1.0 but if a newer one exists, change the file name in the remediation code as well as the $oktataskversion variable in the evaluation code. Evaluation Code ## Check to see if Okta Device Registration Task Is Installed ## # Program Name $oktaname = "Okta Device Registration Task " # Task Version Number $oktataskversion = "1.3.1.0"; $program = $oktaname + $oktataskversion # Check Status $status = (Get-ItemProperty HKLM:\Software\Microsoft\Windows\Curr

Just a simple script we use to periodically clear staffs downloads folders as they tend to build up over time. This script will clear downloads for all users. Get-ChildItem C:\Users |%{Remove-Item -Path "C:\Users\$_\Downloads\*" -Force -Recurse}

This script will set the wallpaper for Mac devices to one of your choosing. Just upload the wallpaper and adjust naming as needed. Please note, if a user has not previously allowed Finder in AppleEvents, they may get a prompt to allow. (If they accidently hit no to allow, AppleEvents can be reset using the command “tccutil reset AppleEvents”) #!/bin/bash #copy the .png file to the device scp DesktopWallpaper.png /library/ #Set wallpaper for user currentUser=$(/bin/ls -l /dev/console | /usr/bin/awk '{print $3}') sudo -u "$currentUser" -H osascript -e 'tell application "Finder" to set desktop picture to POSIX file "/library/DesktopWallpaper.png"'

Hi Everyone, The below code will install a custom office template for O365 on Mac’s. All that’s needed is to upload the custom template and change the sampletemplate.dotx references to your own. Confirmed working with Dotx and Potx files. #!/bin/sh scp sampletemplate.dotx /private/tmp/ currentUser=$(/bin/ls -l /dev/console | /usr/bin/awk '{print $3}') sudo -u "$currentUser" cp /private/tmp/sampletemplate.dotx /Users/$currentUser/library/"group containers"/ubf8t346g9.office/"user content.localized"/templates.localized/

To install Huntress on clients, just put in your Account Key and Organization Key in the remediation. Evaluation: $scriptblock = { #Define Registry Location for the 64-bit and 32-bit Uninstall keys $uninstReg = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall','HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall') $appName = 'Huntress Agent' # Get all entries that match our criteria. DisplayName matches $appname $installed = @(Get-ChildItem $uninstReg -ErrorAction SilentlyContinue | Get-ItemProperty | Where-Object { ($_.DisplayName -match $appName) }) # If any matches were present, $installed will be populated. If none, then $installed is NULL and this IF statement will be false. # The return value here is what the ScriptBlock will send back to us after we run it. # 1 for Non-Compliant, 0 for Compliant if ($installed) { return 0 } else { return 1 } } $exitCode = & "$env:SystemRoot\sysnative\WindowsPow

Installing software silently on Macs is always a pain; thankfully Automox makes it much easier. Here is a simple script to check and install an uploaded Cisco Umbrella if it’s not found on the machine. The evaluation simply checks to see if the Cisco Umbrella service is running on the machine. The remediation utilises the uploaded .zip file needed for Cisco Umbrella installs. The zip is downloadable from the Umbrella dashboard and contains both the install package and registration details. Evaluation script: #Checking if Umbrella Service is present sudo launchctl list | grep -i RoamingClientConfigUpdater if [[ $? -eq 0 ]]; then exit 0 else exit 1 fi Remediation: #Copy attached umbrella zip to temp folder scp umbrella.zip /tmp #unzipping zip in temp folder unzip /tmp/umbrella.zip -d /tmp/umbrella #Creating folder for Umbrella sudo mkdir “/Library/Application Support/OpenDNS Roaming Client/” #Copying license info to Umbrella folder sudo cp /tmp/umbrella/OrgInfo.plist “/Library/Applica

Checks for a redistributable and if it is not there installs all the common ones. Especially useful if users do not have local admin Evaluation Code $regkey = "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}" $name = "Version" Get-ItemProperty -Path "$regkey" -Name "$name" -ErrorAction SilentlyContinue If (($exists -ne $null) -and ($exists.Length -ne 0)) { Exit 0 } else { Exit 1 } Remediation Code: #Set download URLs for the various installers $vcredist_08 = "https://download.microsoft.com/download/5/D/8/5D8C65CB-C849-4025-8E95-C3966CAFD8AE/vcredist_x64.exe" $vcredist_10 = "https://download.microsoft.com/download/1/6/5/165255E7-1014-4D0A-B094-B6A430A6BFFC/vcredist_x64.exe" $vcredist_12 = "https://download.microsoft.com/download/1/6/B/16B06F60-3B20-4FF2-B699-5E9B7962F9AE/VSU_4/vcredist_x64.exe" $vcredist_13 = "https://download.microsoft.com/download/2/E/6/2E61CFA4-993B-4DD4-91DA-3737CD5CD6E3/vcredist_x64.exe" $vcred

Here’s a worklet that we use to install printers via Automox: Eval Code: $testFile = "$env:windir\InstalledPrinters.txt" $testFileValue = (Test-Path $testFile) if ($testFileValue -eq $true ) { Exit 0 } else { Exit 1 } Remediation Code: $testServer = "printserver" $testServerValue = (Test-connection -Computername $testServer -BufferSize 16 -Count 1 -Quiet) if ($testServerValue -eq $false ) { Exit 0 Write-Host "printserver not reachable!" } else { Add-Printer -ConnectionName "\\printserver\east-gray" Add-Printer -ConnectionName "\\printserver\west-color" New-Item -ItemType file "$env:windir\InstalledPrinters.txt" }