Find & Share Worklets

Its important that Windows devices are abiding by endpoint protection schemes now that so many more people are working remotely. It can also be hard to enforce standards around removable devices. That’s why we use the following to ensure the proper configurations are in place for Windows Defender (see comments for details on each item): #To enable real-time monitoring: Set-MpPreference -DisableRealtimeMonitoring $false #Making sure to catch removable USB drives as scan-able: Set-MpPreference -DisableRemovableDriveScanning $false #Making sure that email scanning (attachments) is enabled Set-MpPreference -DisableEmailScanning $false #Disable the scan of network files, which can cause issues remotely Set-MpPreference -DisableScanningNetworkFiles $false #Making sure to scan scripts as well Set-MpPreference -DisableScriptScanning $false #Make it so that before a scan runs Defender checks for new/the latest threat signatures Set-MpPreference -CheckForSignaturesBeforeRunningScan $true F

@aescolastico wrote an amazing Windows 10 feature update script and kindly shared it with us a while back. Here is the link to his solution:Worklet: Automox OS Upgrade to Latest Windows10 OS version One of our customers was presented with a content download issue. Their devices were all in their offices, and all contain the same OS (same SKU, Language, architecture). @aescolastico’s solution does a fantastic job of determining what iso to download… due to this specific scenario, they preferred to download once, and use that ISO specifically for upgrades. With the environment and OS specifics already determined, I turned @aescolastico’s Ferrari of a script into a Moped to reduce the needed internet bandwidth and download time. A highbred of the two scripts is quite possible (example, check OS specs and download if it doesn’t match one you’ve placed in a local repository). Anywho, here it is :). How to use a Worklet to upgrade Windows 10 from a local network share: <# .SYNOPSIS

Have you helped to build and share Automox worklets on this community? If so, fantastic. If not, how can we help you get started? If you need to know more about what Automox worklets can do, check out our latest blog post on the topic: Building and Sharing Automox Worklets on the Automox Alive Community.

This script will completely reset the Windows Update client settings. It has been tested on Windows 7, 8, 10, and Server 2008 R2, 2012 R2, 2016. It will configure the services and registry keys related to Windows Update for default settings. It will also clean up files related to Windows Update. This worklet can either be run manually, or you can put in an evaluation code of: Exit 1 if you want to always run the worklet on a set schedule. <# .SYNOPSIS Resets the Windows Update components .DESCRIPTION This script will reset all of the Windows Updates components to DEFAULT SETTINGS, clean-up some files related to Windows Update, and notify the user that a reboot will occur in 15 minutes (which can be modified) giving them a second warning at 5 minutes. .OUTPUTS Results are output to the Activity Log. #> $arch = Get-WMIObject -Class Win32_Processor -ComputerName LocalHost | Select-Object AddressWidth Write-Host "1. Stopping Windows Update Services..." Stop-Service -Name BI

Hi, all, In our environment, we use a customized MS Word Template that is updated every few months. Is it possible to use a worklet/required software to either: Create the %appdata%\Roaming\Microsoft\Templates\ directory and copy the Normal.dotm in there? If it exists, compare file hashes and, if different, copy the newer version into that appdata directory? I can certainly do this programmatically on my PC, but it requires SMB access that the agent won’t have, as it runs as system. Can I upload the Normal.dotm as the “Installer Files” then access it somehow via the c:\ProgramData\amagent folder? Or, am I going about this all wrong? I am very new to Automox and am, honestly, still in my trial! Hope this make sense!

Here’s an example of a worklet we recently created in response to managing updates for the BlueKeep vulnerability: Introducing the Automox Worklet To enable your ability to configure and update systems using the Automox platform, we’ve created an endpoint hardening worklet that disables the remote desktop protocol connection. An Automox worklet is an open extensible automation architecture that allows IT operations to create any custom task that they can imagine. Our tool consumes and contains these worklets within a policy that can be automated and maintained across all devices with the Automox sensor installed. These reusable units of work can be applied across any supported operating system (including Windows, Linux, and OSX) and are powered by PowerShell and Bash scripting. How to Disable Remote Desktop Services Worklet If a machine is unpatchable, security administrators can use this worklet as a mitigating control to protect impacted Windows systems from the BlueKeep vulnerabilit

Hi all. I have a worklet that runs the following code in the remediation section. It doesn’t seem to be working. It works just fine if I run it in a powershell window (that runs as admin). What gives? I’m trying to disable auto-startup of Starleaf. $registryPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder" $registryProperty = "StarLeaf.lnk" $enableValue = ([byte[]](0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00)) $disableValue = ([byte[]](0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00)) Set-ItemProperty -Path $registryPath -Name $registryProperty -Value $disableValue -Type Binary

Hi All, im quite new to Automox and was wondering if you experts already collected best practices for creating worklets. For instance how can i write a proper output message to the activity log based on a step in evaluation or remediation and what things did you come up with when using the worklets? At this point for me anything goes!

Microsoft announced that it will begin depreciating the Disk Cleanup tool starting in Windows 10 v1809, and in its place they are ramping up the built-in Storage sense feature originally released with Windows 10. Storage sense will automatically run cleanups when your disk is low on space, but you can configure it further to run on a schedule. If you have a manageable version of Windows 10 (Pro, Ent, Edu), than you can configure Storage sense through GPO. If your devices are not domain joined (or you prefer not to use GPO to manage storage sense), this Worklet can help enable the feature, and set some of the most common configurations. What are we doing in the settings? Evaluation - The example here is fairly simple. It checks if the primary key exists. The key is only created when GPO settings are applied, or if you manually place them. The idea is, that if this key is already there, it will not run remediation which could change what was applied by GPO. Remediation - Uses group

Here is a worklet to assist with KACE agent uninstallation. The agent installation presents a few challenges, as it is a 32 bit installer, so it can be installed either in program files, or in program files (x86) depending on the OS architecture. In addition based on the Quest installation instructions, it will be created in one of two different sub-directories based on OS version and client version. This worklet is designed to work on either 32-bit or 64-bit Windows devices, and will work as long as the AMPTools.exe file exists in one of the default locations. We have an awesome customer giving this a shot, and I will update the code here if we find anything needs to be changed. Evaluation code borrowed from the Worklet: Enforced Application Uninstall for Windows Evaluation Code: <# .SYNOPSIS Check for presence of specified application on the target device .DESCRIPTION Read 32-bit and 64-bit registry to find matching applications Exits with 0 for compliance, 1 for Non-Com

I threw this together for my org to get some easy remote support tools in place. Just wanted to post it here if someone else found it useful or could do a better job 😉 Evaluation Code: #REQUIRES -Version 2.0 <# .SYNOPSIS This Test script checks to see if Chrome is installed .DESCRIPTION This script queries the installed files for 32 and 64bit software and returns 0 if product is installed or 1 if not .Notes File Name :ChromeRemoteDesktop_Install_Test.ps1 Author :Automox Prerequisite :PowerShell V2 over win7 and upper #> #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function ChromeRemoteDesktop_Install_Test { [array]$key = Get-UninstallRegistryKey -SoftwareName "Chrome Remote Desktop Host" $alreadyInstalled = $false $version = '80.0.3987.18' if ($key.Count -ne 0) { $key | ForEach-Object { if ($_.DisplayVersion -eq $version) { $alreadyInstalled = $true } } } $packageArgs = @{ pa

Attempting to check for the presence of the Microsoft Store App version of Skype. If present, run the Remediation (remove). The Worklet displays an Error status in the Activity Log, but I do not know why, nor how to check the logs/console. Using a modified version of the Skype install script - it does the same 32/64 bit checks, but remediates if Skype was found, rather than not found. At least I think. Eval: #REQUIRES -Version 2.0 <# .SYNOPSIS This Test script checks to see if Skype is installed .DESCRIPTION This script queries the installed files for 32 and 64bit software and returns a 1 if product is installed or 0 if not .Notes File Name :Skype_Uninstall_Test.ps1 Author : Prerequisite :PowerShell V2 over win7 and upper #> #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function Skype_Uninstall_Test { <# .SYNOPSIS This function Checks a Skype installation. .DESCRIPTION After c

I am wondering if anyone has tried using Automox to deploy files to users. We have many remote users and every once in a while we need to deploy a batch file or RDP to their desktop. In the past it was reliant on them connecting with VPN to our site and downloading the appropriate file. I would like to remove the shared folder dependency and upload the file to Automox and deploy directly from there. What i was looking to do was something like Copy-Item -Path ".\file.rdp" -Destination "C:\Users\Public\Desktop" which does work when run in PowerShell from the folder containing the file. It doesn’t need a remediation script just the ability to execute and deploy/overwrite any existing files. Thanks in advance!

I have tested variations of required software policy and worklets, but I can not get a .exe agent installer to execute. I have tested with powershell code and can run the .exe locally, but the same script will not work through automox. I have uploaded the file to the worklet, then put the remediation code as: .\filename.exe the worklet status will then display as a checkmark and the agent will not be installed. how can I troubleshoot this?

Server Message Block (SMB) is a network communication protocol used share access to files, printers, etc across devices in a network. SMBv1 was first designed and used 30 years ago and in no longer adequate in providing security in today’s modern network infrastructure, where the complexity is only rivaled by that of the malicious code looking to exploit it. Frankly, using, or having SMB1 enabled is unacceptable in today’s world as you lose key protections offered by later SMB protocol versions Pre-authentication Integrity Secure Dialect Negotiation Encryption Insecure guest auth blocking, Protects against MiTM attacks. Better message signing Additionally, if your clients use SMB1, then a man-in-the-middle can tell your client to ignore all the above . All they need to do is block SMB2+ on themselves and answer to your server’s name or IP Automox recommends that you disable SMB1 across all of your Windows devices. Below is the Worklet code needed to evaluate against if SMB1 is enab

Note: the new version of the Windows 10 upgrade code is now here: Worklet: Automox OS Upgrade to Latest Windows10 OS version Worklets The following Worklet will ensure all of your devices are always on the most current release of Windows 10. Since the current version is 2004, that is the version this Worklet will upgrade you. This Worklet supports multiple languages: DISCLAIMER: THIS WILL AUTOMATICALLY REBOOT THE DEVICE WHEN THE UPGRADE IS COMPLETE Evaluation: $iso = "C:\programdata\amagent\Windows1909OSUpgrade.iso" if ((Test-Path $iso) -eq $true) {Remove-Item $iso } $osversion = (Get-Item "HKLM:SOFTWARE\Microsoft\Wi… It’s a general purpose version that will always take you to the latest version of Windows 10.

I am working on a worklet to report back in the Activity log and then take after if the firewall is enabled on some CentOS boxes. But for some reason I cannot get the echos to appear in the activity log. Below is what I have. #!/bin/bash if [[ `firewall-cmd --state` = running ]] then firewall_state=active else firewall_state=inactive fi echo "Firewall State: $firewall_state" 1>&2 if [[ `systemctl is-enabled firewalld` = enabled ]] then firewall_status=enabled elif [[ `systemctl is-enabled firewalld` = masked ]] then firewall_status=masked elif [[ `systemctl is-enabled firewalld` = disabled ]] then firewall_status=disabled else firewall_status=unknown fi echo "Firewall Status: $firewall_status" 1>&2 if [ "$firewall_state" = "active" ] || [ "firewall_status" = "enabled" ] then exit 1 else exit 0

I wrote this worklet at the request of one of our customers. They want to pop open a browser window to a survey site every morning for their users. To edit this for your use case, all you need to do is replace the URL in the $command variable, and to make sure that Powershell is allowed to run scripts on the endpoint as a user. This is because it’s making use of the scheduled task feature to run the worklet as the logged in user instead of System. To do that, you can run this command (as admin) on the endpoint: `Set-ExecutionPolicy RemoteSigned’ Evaluation code: Exit 1 Remediation code: $time = (Get-Date).AddSeconds(5) $triggerAt = New-ScheduledTaskTrigger -At $time -Once $currentusr = (Get-WmiObject -class win32_process -ComputerName 'localhost' | Where-Object name -Match explorer).getowner().user $command = "start https://www.google.com" New-Item -Path "c:\ProgramData\Amagent" -Name "message.ps1" -ItemType "file" -Value $command $action = New-ScheduledTaskAction -Execute Powe

What would improve your experience with worklets in Automox? It can be worklets you’d like created, ways of making them easier to work with, how you view the results in the console or …??

i want to uninstall MS office 2016 using Automox.

Noticed that Windows 7 devices (with the extended support update) weren’t showing software inventory in Automox. After working with Automox support, they discovered that Windows 7 devices need Powershell 5 (supposedly they’ll have a fix for Windows 7 devices soon). I attempted to use the Microsoft provided powershell script to install Windows Management Framework 5.1 (KB3191566) (which installs powershell 5 on Windows 7), but couldn’t get it to run consistently. Tried installing chocolatey and then running ‘choco install powershell’ and it worked consistently. So that’s what this script does: installs chocolatey offline and then runs ‘choco install powershell’ on Windows 7 machines. It isn’t pretty, but it works. Would appreciate someone with actual Powershell experience/skills to clean up. Evaluation [string]$ThisPackagePSHVersion = '5.1.14409.1005' if ($PSVersionTable -and ($PSVersionTable.PSVersion -ge [Version]$ThisPackagePSHVersion)) { Write-Warning "PowerShell version, $($PS

I am trying to push the installation using the instructions found on the splashtop help page: Splashtop Business - Support Command-line parameters to silently install your deployable Splashtop Streamer Note: Deployable Streamer is a feature available only to Splashtop Business Access and Splashtop Remote Support users. Download your deployable Streamer by logging into my.splashtop.com and clickin... should be simple: two files: deploy_splashtop_streamer.sh Splashtop_Streamer.dmg and execute command: sudo ./deploy_splashtop_streamer.sh -i Splashtop_Streamer.dmg -d REG-CODE -w 0 -s 0 -v 0 Initially I was receiving errors. changed it to: sh ./deploy_splashtop_streamer.sh -i Splashtop_Streamer.dmg -d REG-CODE -w 0 -s 0 -v 0 using sh to execute the command fixed it. Just in case someone else needs help to deploy it.

This worklet will evaluate Mac devices to ensure the latest version of Firefox is installed. If the worklet finds the Firefox applications is not installed, the remediation code will install it on the device. Evaluation: #!/bin/bash #example script for installing Firefox on Mac devices #evaluate the device to see if Firefox is currently installed. if [ -d "/Applications/firefox.app" ]; then exit 0 else exit 1 fi Remediation: #!/bin/bash #example script for installing Firefox on Mac devices #create a temporary directory to download Firefox install file set -e tempfile=$(mktemp) #download the latest version of Firefox to the temp file echo "Downloading Firefox..." curl -L "https://download.mozilla.org/?product=firefox-latest&os=osx&lang=en-US" -o "$tempfile" echo "Installing Firefox..." #mount the firefox dmg file to a volume hdiutil attach /tmp/Firefox.dmg #copy the firefox app to the devices applications cp -R /Volumes/Firefox/Firefox.app/ /Applicatio

Big shoutout to @aescolastico and @Gen123 for contributing to my previous 1903 OS Upgrade Worklet that made this new automatic 1903 feature update possible! Automox has the functionality to upgrade Windows OS versions natively through any patch policy. Due to some recent changes made by Microsoft, Automox is unable to discover the Windows 10 version 1903 OS upgrade advertised through Windows Update. Automox engineering is working directly with Microsoft to rectify this issue and expect to support this upgrade natively soon. It is a one-click automatic upgrade without needing to pre-deploy the 1903 .iso image to your devices. This Worklet will automatically build out the download link for 1903 based on your OS’s architecture, download the .iso image to you local system, mount the .iso to a disk drive, and then automatically run the download setup all silently without any user interaction. The Evaluation and Remediation code for the Worklet is as follows: Evaluation: $iso = "C:\programda

macOS Catalina has arrived and as you may know, Apple sends upgrade notifications to all macOS devices soon after release. While Automox will be compatible with macOS Catalina shortly after it’s public release, you may not be. Apple installs this upgrade notifier via Apple Software Update. If you are using an internal Software Update Server, you can remove the update macOSInstallerNotification_GM and ‘macOS Catalina’ from scope, if not you can tell your macOS devices to ignore this update. If you’re reading this too late and the update has already installed, this script will still remove the notifier bundle. Check script: #!/bin/bash set -e ############################################################################ # suppress_macOS_upgrade_notifications_check # # exit 0 = upgrade notifier is not installed AND is not pending installation # exit 1 = upgrade notifier is installed OR pending installation ############################################################################ #