Find & Share Worklets

Microsoft has released an update for a bug which disrupted Internet connections on certain Windows 10 devices. This bug prevents many Microsoft products, such as Office365, Internet Explorer/Edge, and Outlook from being able to communicate out to the internet when using a VPN. Coming at the absolute wrong time for remote users to lose connectivity to enterprise applications, Microsoft has reacted quickly with this patch. You can find more information about this bug by clicking here. The patch is currently only available as an out-of-band update on the Microsoft Update Catalog and not within Windows Update itself. With that said, this will not be supported by traditional patching methods. I have created a Worklet that will check to see if the hotfix is installed for all of your Windows devices. If the hotfix is not installed, it will download and install it. This will ensure all of your Windows devices have this patch applied no matter what OS version, or architecture your device is ru

as i am learning this platform, i have a few items in my environment to fix. today, i wanna knock out getting CylancePROTECT installed globally and rollout CylanceOPTICS. i have looked at the required app policy (in fact, i am using this to push a few other apps). i think this would work for most required apps. three small items prove challenging for me: i would like to install multiple apps under one policy (prolly just over complicating things??). this would be a nifty concept for PC Imaging or Day 1 Patching kinda workflows. i am not sure i understand how to best leverage the version field. in my small mind, if i insert a version number in the required app versioning field, the policy would run if the version number of the installed app is lower than the defined version number - OR if the application is not installed, at all. what if i i want to install an app ONLY if it is not present, could i set this value to 0.001? would the value of 0.001 fundamentally function as an “i

There’s a buffer overflow vulnerability in SMBv3. Currently no patch exists, so Microsoft recommends turning off SMBv3 compression on your Windows 2019 servers. There’s not yet a known exploit in the wild for this vulnerability. The following code will turn off compression on Windows Server 2019. Evaluation code: Exit 1 Remediation code: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force This will protect servers from being exploited, but does not protect Windows 10 SMBv3 clients. To stop any Windows 10 clients in your environment being exploited, Microsoft recommends blocking port 445 on your external firewalls. However, if an attacker has already infiltrated your network then they’ll still be able to exploit Windows 10 clients if they can trick a user into connecting to an SMBv3 share. References: Ars Technica Windows has a new wormable vulnerability, and there’s n

Hi there. I would like to deploy icons on the current user’s desktop. This is currently being done using group policy as part of the user’s logon. Is there a way to achieve this using Worklets? Is there an evaluation script I can run to figureout the currently logged on user? Then a remediation script to run that will create the icons on the current logged on user’s desktop?

While putting together a few Automox Worklets, I found I wanted a quick way to tell whether a worklet had been processed by a remote agent (vs. combing through logs 😇). I cobbled together a hasty email snippet to drop into the Evaluation Code window (this prolly should be placed before any real evaluation code block to ensure exit codes don’t overstep this snippet). 🙈🙉🙊 Example email: Evaluation code: <# Grab some system variables to pump into the email alert (as an example). #> $Hostname = $env:COMPUTERNAME.ToUpper() $HostDomain = $env:USERDOMAIN.ToUpper() $HostWindowsVersion = (Get-WmiObject -class Win32_OperatingSystem).Caption.ToUpper() $HostWindowsBuild = (Get-WmiObject -class Win32_OperatingSystem).Version.ToUpper() <# Build a message body. #> $smtpHTMLBody = @" <!doctype html> <html lang="en"> <head> <meta charset="utf-8"> <style> table { font-family: "Trebuchet MS", Arial, Helvetica, sans-ser

Only works on Windows 7 and prior. Evaluation code: #REQUIRES -Version 2.0 <# .SYNOPSIS This script tests to see if the Screen saver remediation script has been run. .DESCRIPTION This script checks the screen saver reg keys of the current user, if the remediation script has been run, these value will match. If the values are different then those in in this script, it will return a 1. if the settings match it will return a 0. .NOTES File Name :ScreenSaverSettings.ps1 Author :Automox Prerequisite :PowerShell V2 over win7 and upper #> #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function ScreenSaverTest { #############These settings must match those in the Remediation file####################### $ScreenSaveActive = 0 $SCRNSAVEEXE="C:\Windows\system32\Bubbles.scr" #Which screen saver to use. EX: C:\Windows\system32\Bubbles.scr $ScreenSaverIsSecure= 0 #password needed on wake up $ScreenS

<# .SYNOPSIS Check for presence of Microsoft Mail App on Managed laptops .DESCRIPTION Exits with 0 for compliance, 1 for Non-Compliance. Non-Compliant devices will run Remediation Code at the Policy's next scheduled date. .NOTES The Mail and Calendar apps help you stay up to date on your email, manage your schedule and stay in touch with people you care about the most. Designed for both work and home, these apps help you communicate quickly and focus on what’s important across all your accounts. Supports Office 365, Exchange, Outlook.com, Gmail, Yahoo! and other popular accounts. .LINK https://www.microsoft.com/en-ca/p/mail-and-calendar/9wzdncrfhvqm?activetab=pivot:overviewtab #> EVALUATION Code $App = Get-AppxPackage Microsoft.windowscommunicationsapps | Select-Object Status if ( $App -eq 'NULL' ) { Exit 0 } else { Exit 1 } REMEDIATION CODE # This code execution will REMOVE the MS Mail app from the managed laptop Get-AppxPackage Microsoft.windowscommunicationsapps | R

This worklet will check to see if LogMeIn is installed and if it isn’t, will download and install it. See this KB article for how to setup a worklet:https://help.automox.com/hc/en-us/articles/5603324231700-Creating-a-Worklet  Evaluation Code:  #!/bin/bashif [ -d "/Applications/LogMeIn Client.app" ]; then exit 0else exit 1fi Remediation Code:  #!/bin/bashecho -e "Downloading LogMeIn Client..."curl -L -o "/tmp/LogMeInClientMac.dmg" https://secure.logmein.com/LogMeInClientMac.dmgecho -e "Installing LogMeIn Client..."hdiutil attach "/tmp/LogMeInClientMac.dmg" -nobrowseditto "/Volumes/LogMeInClient/LogMeIn Client.app" "/Applications/LogMeIn Client.app"echo -e "Cleaning up..."hdiutil detach "/Volumes/LogMeInClient"rm -f "/tmp/LogMeInClientMac.dmg"

I have the following worklet which works fine with the exception it updates the wow64 runonce reg key install of the 64 bit runonce reg key? Anyone have any ideas how to get it to update the 64-bit key? $ScriptBlock = { param($tempDir = 1, $filename = 2) $MSIPath = “$tempDir\SAPGUI_7.6_Patch3.msi” if (-not (Test-Path -Path $MSIPath)) { Copy-Item $filename -Destination $tempDir } Set-ItemProperty -Path ‘HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce’ -Name “UpdateSAPGUI” -Value “C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -command ‘Start-Process -FilePath ‘msiexec.exe’ -ArgumentList (’/qn’, ‘/i’, ‘$tempDir\SAPGUI_7.6_Patch3.msi’) -Wait -Passthru’” } $args=@("$env:windir\Temp", $filename) $returnCode = & “$env:SystemRoot\system32\WindowsPowerShell\v1.0\powershell.exe” -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInteractive -Command $scriptblock -args $args exit $returnCode

This worklet is to remedy CVE-2020-0674, as detailed in this article: BleepingComputer Microsoft Issues Mitigation for Actively Exploited IE Zero-Day Microsoft published a security advisory containing mitigation measures for an actively exploited zero-day remote code execution (RCE) vulnerability impacting Internet Explorer. This is a remote code execution zero-day, affecting users on IE. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. Note: if your windows directory is different from c:\windows then you’ll need to make that change in the remediation code. Evaluation code: exit 1 Remediation code: # Define Full Scriptblock to cover 64-bit scenario $scriptBlock = { takeown /f $env:SystemRoot\syswow64\jscript.dll cacls $env:SystemRoot\syswow64\jscript.dll /E /P everyone:N takeown /f $env:SystemRoot\system32\jscript.dll cacls $env:

This worklet lets you change the power scheme to one of the defaults: Balanced High Performance Power Saver There’s no evaluation code and the remediation code just changes the setting to whatever you specify in the code: $p = gwmi -NS root\cimv2\power -Class win32_PowerPlan -Filter "ElementName ='Power Saver'" $p.Activate() Change ElementName between any of the three built-in defaults: Balanced, High Performance, or Power Saver. If you have any other power schemes saved then you can call them by name as well.

This worklet uses msg.exe to send a notification to the currently logged in user. Once the user dismisses the notification message, a reboot command is immediately issued. Things you can change in the script: Edit the “Message to end user” to put in your custom message, such as “Click OK to reboot now” The time to wait for the scheduled task. In this case we used 30 seconds but you might be able to get away with a shorter time window. In any case, this doesn’t matter to the end user, just to how quickly the task runs after the policy executes. The reboot command - you can make this anything you want, such as a noisy installer that you can’t get to install silently, or an install that will interrupt the user’s work. There’s a couple of tricks that make this worklet function. First is the use of the Task Scheduler to run msg.exe as the currently logged in user (thanks to @rich for showing me this trick) . This does two things: allows msg.exe to run (it has permissions issues whe

IE11 become obsolete as Microsoft released Edge browser that is now supporting modern standards. We do not have any use for IE11 in our org and the app becomes only “patch” problem. We are removing it from our managed laptops. EVALUATION CODE $App = Get-WindowsOptionalFeature -Online -FeatureName Internet-Explorer-Optional-amd64 | Select-Object State if ( $App -eq ‘Disabled’ ) { Exit 0 } else { Exit 1 } REMEDIATION CODE Removal / Disable the IE11 Feature on Windows 10 host

This worklet will install BGinfo on Windows endpoints and run it at startup. Instructions: You’ll need to get the installer file from here: https://docs.microsoft.com/en-us/sysinternals/downloads/bginfo Open up the zip file and grab the Bginfo64.exe file. This is what you’ll use as the Installation File The exe doesn’t technically install, it’s just an executable that you run to set the background image This worklet copies the Bginfo64.exe file to the root c:\ folder. If you want it somewhere else, just change the path in the Evaluation and Remediation code blocks Finally the worklet creates a shortcut in the Startup folder. This shortcut includes the /timer=0 flag so that the exe doesn’t pop up the interactive windows for BGinfo. Evaluation code: if (Test-Path -Path "C:\Bginfo64.exe") { exit 0 } else { Exit 1 } Remediation code: Copy-Item Bginfo64.exe -Destination "c:\Bginfo64.exe" $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut("c:\Progra

Installs Skype on Windows Evaluation code: #REQUIRES -Version 2.0 <# .SYNOPSIS This Test script checks to see if Skype is installed .DESCRIPTION This script queries the installed files for 32 and 64bit software and returns a 0 if product is installed or 1 if not .Notes File Name :Skype_Install_Test.ps1 Author :Automox Prerequisite :PowerShell V2 over win7 and upper #> #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function Skype_Install_Test { <# .SYNOPSIS This function Checks for the Skype is Installed on system or not . .DESCRIPTION After checking the Skype availability, based on the exit code tool will decide to call remediation code or not. .EXAMPLE Skype_Install_Test .NOTES #> # Application Name which is to be installation verified. $appName = 'Skype' # Finding the Systen Directory (system32 Directory). $sysDir = [Environment]::Syste

Sets password policy using SECEDIT. Note that this only works for Windows machines that aren’t in Active Directory. Evaluation code: #REQUIRES -Version 2.0 <# .SYNOPSIS This script tests to see if the remediation script has been run .DESCRIPTION After the remediation script is run there will be a registry key for the template. This script checks to see if that registry key exists and what the value is. If the key and value match the other script this test script returns a 0. otherwise it returns a 1 and the remediation script needs to be ran. .NOTES File Name :Password-policy-Test.ps1 Author :Automox Prerequisite :PowerShell V3 on Win10 #> #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function Policy_check() { $Reg_Val=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SecEdit\' | select-object TemplateUsed -ExpandProperty TemplateUsed | out-string if ($Reg_Val.Trim() -match "Automox_Policy.i

Installs Evernote on Windows Evaluation code: #REQUIRES -Version 2.0 <# .SYNOPSIS This Test script checks to see if Evernote is installed .DESCRIPTION This script queries the installed files for 32 and 64bit software and returns a 0 if product is installed or 1 if not .Notes File Name :Evernote_Install_Test.ps1 Author :Automox Prerequisite :PowerShell V2 over win7 and upper #> #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function Evernote_Install_Test { <# .SYNOPSIS This function Check for the Evernote is available on system or not . .DESCRIPTION After checking the evernote availability, based on the exit code tool will decide to call remediation or not. .EXAMPLE Evernote_Install_Test .NOTES #> # Application Name which is to be installation verified. $appName = 'Evernote' # Finding the Systen Directory (system32 Directory). $sysDir = [Environment]::S

Installs Dropbox client on Windows Evaluation code: #REQUIRES -Version 2.0 <# .SYNOPSIS This Test script checks to see if Dropbox is installed .DESCRIPTION This script queries the installed files for 32 and 64bit software and returns a 0 if product is installed or 1 if not .Notes File Name :Dropbox_Install_Test.ps1 Author :Automox Prerequisite :PowerShell V2 over win7 and upper #> #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function Dropbox_Install_Test { #Get 32 bit software $32BIT=Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName | select-string 'Dropbox' | out-string #check 64 bit $64BIT=Get-ItemProperty HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName | select-string 'Dropbox' | out-string if ($32BIT.Trim() -match "{Displayname=Dropbox}" -Or $64BIT.Trim() -match "{Displayname=Dropbox}")

Hello, I want to start with how much I have enjoyed working with the patching portion of Automox, works amazingly well. I am no expert in Powershell so please forgive my ignorance if any of the feedback is not valid. Here are the difficulties and or suggestions I have found for Worklets. There are two windows to place code, can we have the option of just having one? I can’t understand the purpose of there being two. We need the ability to deploy the Worklets manually so that you can test the outcome or if you added a new PC and want to deploy software to it. If you could see the code execute line by line troubleshooting would be greatly enhanced. Currently I have to build a PS script outside of Automox in order to troubleshoot and then adopt it to fit the criteria of the Worklet interface. There should be a log feature that we could turn on for verification of the worklets behavior. Unless I am mistaken you can only work with one file per worklet. This greatly limits the ability to i

Invokes Microsoft’s builting search repairs • Under Evaluation Code: If (Test-Path "$env:systemroot\SoftwareDistribution") { Exit 0 } Else { Exit 1 } • Under Remediation Code: $logfile = "C:\Temp\" Get-TroubleshootingPack -path "C:\Windows\Diagnostics\System\Search" | Invoke-TroubleshootingPack -Unattended -Result "$logfile"

Invokes Microsoft’s builtin network repairs. Edit the variable $logfile to set a custom log file locatiom. Only run manually and test thoroughly beforehand. • Under Evaluation Code: If (Test-Path "$env:allusersprofile\SoftwareDistribution") { Exit 0 } Else { Exit 1 } • Under Remediation Code: $logfile = "C:\Temp\" Get-TroubleshootingPack -path "C:\Windows\Diagnostics\System\networking" | Invoke-TroubleshootingPack -Unattended -Result "$logfile"

Invokes Microsofts builtin repairs for the bluetooth service. I also added a restart of the bluetooth service. Only run this manually • Under Evaluation Code: If (Test-Path "$env:allusersprofile\SoftwareDistribution") { Exit 0 } Else { Exit 1 } • Under Remediation Code: $logfile = "C:\Temp\" Get-Service -name bthserv | Restart-Service -Force $service = (Get-Service -name bthserv).name #check the status of the service to make sure it's started $service_status = (Get-Service -name $service).Status #if service is running if ($service_status -eq 'Stopped') { #start service again Start-Service -Name $service Start-Sleep -seconds 5 } #check if service is running again if (((Get-Service -name $service).Status) -eq 'Running') { } Else { Echo 1 } Get-TroubleshootingPack -path "C:\Windows\Diagnostics\System\bluetooth" | Invoke-TroubleshootingPack -Unattended -Result $logfile

• Under Evaluation Code: If (Test-Path "$env:allusersprofile\SoftwareDistribution") { Exit 0 } Else { Exit 1 } • Under Remediation Code: #Edit this logfile variable if you want the log files written to another location $logfile = "C:\Temp\" #Invokes Microsoft's builtin troubleshooting pack to run through some automated repairs Get-TroubleshootingPack -path "C:\Windows\Diagnostics\System\audio" | Invoke-TroubleshootingPack -Unattended -Result "$logfile"

This will allow you to run a Windows Defender scan on any or all of your machines at anytime. Only run this manually • Under Evaluation Code: If (Test-Path "$env:allusersprofile\SoftwareDistribution") { Exit 0 } Else { Exit 1 } • Under Remediation Code: <# NAME Start-MpScan DESCRIPTION The Start-MpScan cmdlet starts a scan on a computer. The cmdlet performs scans for the path you specify. SYNOPSIS Starts a scan on a computer. -ScanType [<ScanType>] Specifies the type of scan. The acceptable values for this parameter are: -- FullScan -- QuickScan Uncomment only one variable for scan to run either a fullscan or quickscan This will not work if you have Windows Defender disabled #> $Scan = 'QuickScan' #$Scan = 'FullScan' Start-MpScan -Scantype $Scan

This will disable or enable Windows Defender as easily as uncommenting the correct command and commenting out the opposite. • Under Evaluation Code: If (Test-Path "$env:allusersprofile\SoftwareDistribution") { Exit 0 } Else { Exit 1 } • Under Remediation Code: #To disable real-time monitoring of Windows Defender, run the following command: Set-MpPreference -DisableRealtimeMonitoring $true #To enable real-time monitoring, comment out the $true statement above then uncomment and run the following command: #Set-MpPreference -DisableRealtimeMonitoring $false