Find & Share Worklets

Bluetooth is a short-range, low-power wireless technology commonly integrated into portable computing and communication devices and peripherals. Bluetooth is best used in a secure environment where unauthorized users have no physical access near the Mac. If Bluetooth is used, it should be secured properly. Bluetooth is particularly susceptible to a diverse set of security vulnerabilities involving identity detection, location tracking, denial of service, unintended control and access of data and voice channels, and unauthorized device control and data access. It is recommended by the Center of Internet Security to disable bluetooth when connectable but not is use. This Worklet is designed to disable bluetooth if the following criteria is met on end endpoint: Bluetooth is enabled and connectable No Peripheral are connected Evaluation: #!/bin/bash brt=$(system_profiler SPBluetoothDataType 2>/tmp/log.txt | grep "Bluetooth:" -A 20 | grep Connectable | tr -d "[:space:]") brtmatch="

This will force local users (non-AD) to change their password the next time they login. Note that this script will apply this setting to all local users on the Windows machine. It assumes they have the permissions to change their own passwords, but it does make sure that the passwords aren’t set to never expire. If the password is set to never expire then the command to force a password change won’t succeed. Evaluation code: Exit 1 The evaluation code just returns an exit code of 1 to make the remediation code run. The assumption is that you’ll use the worklet scheduler to run this code whenever you want to force a local password change. Remediation code: $usrs = Get-WMIObject win32_useraccount Foreach ($user in $usrs) { Set-LocalUser -Name $user.name -PasswordNeverExpires:$false net user $user.name /LogonPasswordChg:yes } The remediation code loops through all the local users and makes sure that the password isn’t set to never expire. Then it sets the LogonPasswordChg to yes, w

I'm exploring a custom worklet to create a new user. So far this has been successful creating the user. However when trying to login, the password does not work. Please help if you think of a way around this. #!/bin/bash sudo ddcl . -create /Users/automox sudo dscl . -create /Users/automox UserShell /bin/bash sudo dscl . -create /Users/automox RealName Automox sudo dscl . -create /Users/automox UniqueID 9999 sudo dscl . -create /Users/automox NFSHomeDirectory /Local/Users/automox sudo dscl . -passwd /Users/automox password123 sudo dscl . -append /Groups/admin GroupMembership automox ps - Don’t use password123… I’m sure that goes without saying 🙂 Also there’s better ways to make users, but we’re trying to conjure this up for a specific use case.

Windows 10 includes Windows PowerShell 5.0 by default that has some great new features that enhance security including enhanced transcription logging and AMSI protection. However, the Windows PowerShell 2.0 engine is still enabled and is now recognized as a security risk that can be used to run malicious scripts. Evaluation: $App = Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2 | Select-Object Status if ( $App -eq ‘Disabled’ ) { Exit 0 } else { Exit 1 } And then fix. Remediation Code to Disable the PS v. engine Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root You can recheck remotely with command: $computer => Name of the host you trying to check invoke-command -computername $computer {Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2 } Cheers, -Roman

You may have already seen it, but if not, Automox just introduced Worklets! Replacing Custom Policies, Worklets allow you to automate and enforce any scriptable action on your devices, no matter their location or OS. More exciting changes are coming this year to Worklets to make them easier to use, share, and add to your environment. Think fun things like sharing Worklets to the Automox community, tons of new pre-packaged Worklets, and reports on Worklet success/failure.  In the meantime, your existing Custom Policies will continue to work as before, and no changes will need to be made. To create a new policy, just select Worklets and your OS. You can learn more about the future of Worklets and see how others are using them on our Worklets page. We also have a section of the community just for sharing and discussing Worklets!  Share which Worklets or Worklet-related features you want to see in Automox, and I’ll bake them into our roadmap. 

Gatekeeper is a built-in security feature of macOS—originally introduced in Mac OS X Lion (10.7.3)—that enforces code signing and verifies downloaded applications before allowing them to run. This worklet ensures that Gatekeeper is always enabled on a macOS system. Evaluation: #!/bin/bash # helper function to check if a command exists function command_exists { type "$1" &> /dev/null } # only evaluate if the spctl command is available if command_exists spctl; then # check if gatekeeper is enabled spctl --status | grep -q "assessments enabled" # yay? or nay? exit $? fi # spctl command not available, move along exit 0 Remediation: #!/bin/bash # enable gatekeeper for all users spctl --master-enable # did we succeed? exit $?

Hey Y’all As an IT administrator one of the first things you’ll find yourself doing is installing an endpoint security tool, which can be very difficult to automate across hundreds, if not thousands of devices. Not with Automox. Automox Worklets gives you the power to deploy endpoint security tools to newly added endpoints as well as enforce installation on existing devices, so you always know that your endpoints are running the security tools necessary to protect your IT environment. The below Worklet is designed to deploy Carbon Black Defense to macOS endpoints. The instructions include creating and deploying a .zip files that contains the install .sh script as well as the .pkg required by the .sh to perform the install. If everything works as designed, you should be able to run the Worklet and see the endpoint(s) appear in the Cb console. You need to make sure that the Carbon Black application is whitelisted for the devices so the KEXT does not prevent the installation. Otherw

Here is a worklet for enforcing password policies for macOS for all users (as well as setting exempt users). This code is test on macOS mojave. The defaults are provided for example only. Check script. #!/usr/bin/env bash set -e -o pipefail ###################################################################### # Enforcing a password policy is good practice for all users # Using the variables below you can check the password policy for all # logged in users. # the default variables provided in the main clause are provided for EXAMPLE ONLY ###################################################################### ###################################################################### # get_logged_in_users # Retrieves the logged in users. Does deduplication to make sure that we only # apply policies to # # Note: if there are service users it will find them too # # Globals: # # Arguments: # None # Returns: # A space delimited string of unique users logged in #########################

The Invoke-TroubleshootingPack cmdlet runs a troubleshooting pack in either interactive or unattended mode. A troubleshooting pack determines the root causes of issues, resolves the issues, and verifies that the issues were resolved. Eval If (Test-Path "$env:allusersprofile\SoftwareDistribution") { Exit 0 } Else { Exit 1 } Remediatrion #Stripped down very low level reset of windows update components Get-TroubleshootingPack -Path $env:systemroot\diagnostics\system\WindowsUpdate | Invoke-TroubleshootingPack -Unattended

Hey Y’all! IT Admins often find themselves having to uninstall certain softwares off their macOS devices they manage. This can be a very daunting, time consuming task, especially if you are managing 1000’s of devices that span across several different subnets in different geographic locations. Also, if zero-day vulnerabilities are found to be exploited through one of these applications the speed at which they are uninstalled could mean the difference between you being exploited by an attacker or not. With Automox Worklets we make this task effortless, and remediated within seconds, even across 1000’s of devices in different locations all in the cloud from a single pane of glass. The Worklet example below is designed to evaluate if an applications you specify exists on you macOS devices and uninstall them. Evaluation: #!/bin/bash #The evaluation piece of this worklet is designed to identifying if an application exists on a device. #Designate the application you wish to remove fro

Keeping running Docker containers up-to-date is a challenge that can become pretty unwieldy as the amount of infrastructure you manage grows. Thanks to Watchtower, a Docker image that can update other Docker images in a system, updates can be handled in a safe and—more importantly—scalable way. This worklet will check for any Docker running containers on an endpoint with available updates and, if the container has the com.centurylinklabs.watchtower.enable label set to true, will mark those containers for update. Evaluation: #!/bin/bash # helper function to check if a command exists function command_exists { type "$1" &> /dev/null } # only evaluate if docker is available if command_exists docker; then # check for docker containers with available updates # # NOTE: this check only applies to containers where # the com.centurylinklabs.watchtower.enable label # is set to "true" docker run --rm -v /var/run/docker.sock:/var/run/docker.sock cont

Originally introduced in Mac OS X Leopard (10.5.1), the built-in macOS Firewall limits incoming connections on a per-application basis (as opposed to a per-port basis). Disabled by default, this worklet enables the macOS firewall. Evaluation: #!/bin/bash # helper function to check if a command exists function command_exists { type "$1" &> /dev/null } # only evaluate if the socketfilterfw command is available if command_exists /usr/libexec/ApplicationFirewall/socketfilterfw; then # check if the firewall is enabled /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate | grep -q 'enabled' # yes? no? exit $? fi # socketfilterfw command is not available, move along exit 0 Remediation: #!/bin/bash # turn the firewall on /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on # how did we do? exit $?

This worklet will check to see if Discord is installed and if it isn’t, will download and install it. See this KB article for how to setup a worklet:  https://help.automox.com/hc/en-us/articles/5603324231700-Creating-a-Worklet Evaluation Code:  #!/bin/bashif [ -d "/Applications/Discord.app" ]; then exit 0else exit 1fi Remediation Code:  #!/bin/bashecho -e "Downloading Discord..."curl -L -o "/tmp/Discord.dmg" https://discordapp.com/api/download?platform=osxecho -e "Installing Discord..."hdiutil attach "/tmp/Discord.dmg" -nobrowseditto "/Volumes/Discord/Discord.app" "/Applications/Discord.app"echo -e "Cleaning up..."hdiutil detach "/Volumes/Discord"rm -f "/tmp/Discord.dmg"

This worklet will check to see if Dashlane is installed and if it isn’t, will download and install it. See this KB article for how to setup a worklet:  https://help.automox.com/hc/en-us/articles/5603324231700-Creating-a-Worklet Evaluation Code:  #!/bin/bashif [ -d "/Applications/Dashlane.app" ]; then exit 0else exit 1fi Remediation Code:  #!/bin/bashecho -e "Downloading Dashlane..."curl -L -o "/tmp/Dashlane.dmg" https://www.dashlane.com/directdownload?platform=macecho -e "Installing Dashlane..."hdiutil attach "/tmp/Dashlane.dmg" -nobrowseditto "/Volumes/Dashlane/Dashlane.app" "/Applications/Dashlane.app"echo -e "Cleaning up..."hdiutil detach "/Volumes/Dashlane"rm -f "/tmp/Dashlane.dmg"

I’m looking to create a list of worklet ideas to start implementing. What sorts of things would you like to see in the Worklets category? What problems around patching and automation are you looking to solve? No idea is too big or too small!

This Worklet will let you set a title and message for your users when they login. This can be used as a required legal acceptance of your AUP, or for a critical notification that all users need to see. To remove the security message, edit your script to check for a blank caption and set them both to blank strings. To deploy this endpoint hardening worklet, do the following: Log in to your Automox Console. Browse to the System Management page and click Create Policy . Choose Windows under Worklet. 51%20PM913×682 52 KB Insert the Evaluation and Remediation Code scripts. The evaluation code keeps you apprised of each device’s ongoing compliance, as well as flags the device for remediation. The remediation code enforces this setting on the schedule you define. • Under Evaluation Code: # Define Registry Key and sub-value to evaluate ############################################# $regPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $regPropertyText = "Legal

Check out this video that walks you through the process: https://patch.automox.com/video-automox-product-feature-overview-creating-worklets  

This manual process for deploying an emergency patch will decrease the time it takes to ensure your legacy machines are operating at lower risk to exploit. Note: Automox cannot fully update Windows XP versions due to the lack of support for XP updates by Windows Update. Automox can manage software installation and patching, as well as configuration and security settings. There are 2 minimum requirements that can allow Automox to run on Windows XP: Microsoft .NET Framework 3.5 or higher Windows PowerShell 2.0 or higher Windows XP Required Prerequisites Install .NET Framework 3.5 (or higher) https://www.microsoft.com/en-us/download/details.aspx?id=21 Install PowerShell 2.0 via Windows Management Framework (.NET required first) https://www.microsoft.com/en-us/download/details.aspx?id=16818 Install Automox (with legacy Installer) https://console.automox.com/Automox_Legacy_Installer-latest.msi (Note: GetSystemDetail scan command WILL NOT work, so there are no hardware details and the comp