Find & Share Worklets

I have been trying to figure out a way to remove local admin rights from users on domain joined devices with an Automox worklet but haven't made any progress.  The closest I got was with a worklet that would check to see if the current signed in user is a member of the local administrator's group, and if so, add them to the local Users group and delete them from the local administrator's group, but it always tries to move the NT AUTHORITY\SYSTEM account.  I need to do this on a large scale, so having to specify the account to move isn't viable.  Has anyone tried to do something like this before?  Any hints or suggestions? The only domain account that should be in the local administrator's group would be “[Domain]\Domain Admins“ This is what I tried:# Get the current logged-in user$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent()$userName = $currentUser.Name

I am trying to create a worklet that will enable  Wake-on-LAN on every network adapter on Windows 11.  Here is the script.# Enable Wake-on-LAN on all network interfaces# Function to enable WoLFunction Enable-WakeOnLAN { # Get all network adapters $adapters = Get-NetAdapter -Physical | Where-Object { $_.Status -eq "Up" } foreach ($adapter in $adapters) { Write-Host "Configuring adapter: $($adapter.Name)" -ForegroundColor Green try { # Enable "Wake on Magic Packet" Set-NetAdapterAdvancedProperty -Name $adapter.Name -RegistryKeyword "WakeOnMagicPacket" -RegistryValue 1 -ErrorAction Stop # Enable "Wake on Pattern Match" (optional, depending on requirements) Set-NetAdapterAdvancedProperty -Name $adapter.Name -RegistryKeyword "WakeOnPattern" -RegistryValue 1 -ErrorAction Stop # Ensure the "Shutdow

Yup. Another Toast Notification post :-) What makes this one unique is how customizable it can be with company branding and links to internal sites, interactive buttons and so on. Once you get the hang of this one you can apply this to multiple scenarios that fit your needs.Really need to read Martin Bengtsson blog before you get started. https://www.imab.dk/windows-10-toast-notification-script/  Download the scripts here https://github.com/imabdk/Toast-Notification-Script Edit config-toast.xml to your satisfaction or desired outcome. Create a new worklet and associate to the right groups Set the Evaluation Code to whatever you want exit 1

Hello,As the .NET installers are as yet unsupported on Automox, I’ve been working on a script that’ll update/remove versions via Automox.  I’ve had varying levels of success, but it seems that attempting to run the .NET Uninstaller Tool from within an Automox worklet results in failure.  My assumption is that this is because Automox runs as SYSTEM.Happy for anyone to prove me wrong!Cheers,Mark

Hi Automoxers!  We recently had a requirement to automatically disable the requirement for remote control consent based on device group. With this in mind, I wanted to share a script for automating the disabling of remote control consent via the API.  How the script worksThe script runs two API calls. The first one gets all device UUIDs based on a group ID. (For us, we only allow a single group to be used without consent requirement). These are stored in an array and passed to the second API call which sets the config to disable remote control consent.  Why use a scriptThe reason that we’re using a script is twofold. First, this means that we don’t need to grant excessive members of staff a high privilege role, and instead we can automate this using an API token. The second is so that any changes made to the group can be reversed to return the group to a standard set configurat

Good Morning, I’m experiencing a lot of unexpected trouble with what should be a simple Windows program install. The program in question is called ElevateUC. installer is 32bit and does not require any special permissions or license to install.I ran “start-process -filepath "C:\Temp\elevate-uc.exe" -ArgumentList "/S” in a non elevated powershell and it installed in about 30 seconds, but when I try it in Automox it gets stuck at “pending” and eventually times out after about 30 minutes. with this error:Standard Output: Failed to install Elevate UC 2.16.456 version 2.16.456. Please see installation logs if applicable.Standard Error: COMMAND TIMED OUT.I Tried the “EXE Software Installation (System Wide-All Users)“ Worklet and after triple checking the version, display name, etc as well as using wildcards it still does not work, I get variations of the error above based on using wild cards, differe

Hi Folks, Has anyone did this before? We have a need to enforce the windows laptop of user to bitlocker recovery screen.We have tried few scripts however when the machine has customised laptop hostname or netbios name it keeps failing. Can someone help

I’m trying to use automox to reset a local user on a bunch of windows 10 machines. But I keep getting an error.# Define the username and new password$scriptBlock = {$adminUsername = "Local User"$newPassword = "Password"$securePassword = ConvertTo-SecureString -String $newPassword -AsPlainText -ForceSet-LocalUser -Name $adminUsername -Password $securePassword -ErrorAction SilentlyContinue}$exitCode = & "$env:SystemRoot\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInteractive -Command $scriptBlock Anyone been able to make this work? 

So I work with a lot of worklets that check for bits of software that are installed.  Obviously there are some good examples contained within Automox’s Worklet Catalog.  These tend to do the whole search several registry hives for keys containing an application’s display name.Is there a reason why this approach is taken instead of using, say, Get-Package?Cheers,Mark

Hello.  I am trying to use the System Wide EXE Worklet to install the KnowBe4 Phishing Alert Button.  I have the worklet ready but I can not figure out where to input the License key.  Below is what I have entered in the Remediation Worklet but I need to know where and how to put in the license key.####### EDIT WITHIN THIS BLOCK #######$displayName = 'KnowBe4 Phish Alert Button'$displayVersion = '1.10.14.152'$fileName = 'PhishAlertButtonSetup.exe'$arguments = '/S'#######################################Any help would be appreciated on this.

Hello,Can anyone help me to understand why…Start-Process -FilePath "dotnet-hosting-6.0.36-win.exe" -ArgumentList "/install /quiet /norestart" -Wait...does absolutely nothing when Automox runs it, but is fine to use manually at a PowerShell prompt?  I just don’t get it.Cheers,Mark

Here I share this one-line code to install the Automox agent on Windows from a remote shell:[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri "https://console.automox.com/installers/Automox_Installer-latest.msi" -OutFile "./Automox_Installer-latest.msi"; if (Test-Path "./Automox_Installer-latest.msi") { Start-Process -FilePath "./Automox_Installer-latest.msi" -ArgumentList "/quiet", "ACCESSKEY=XXXX " -Wait; Remove-Item -Path "./Automox_Installer-latest.msi" -Force }Don't forget to change XXXX with your access key.

I noticed that this question was brought up in another thread, but was not addressed.I have a computer that verifies that secure token access is enabled, but in the console it still shows as “not-compatible”, citing missing secure token access. I also try using the Automox provided worklet to update the access, and it indicates that the token access is already enabled. I have removed and readded the agent with the same issue. Has anyone been able to resolve this?OS: OS X (13.4.1 (c))CPU: Apple M1 ProRAM 32 GBAgent 1.42.22Thank you

Made this since I couldn’t find anything in the worklets for printers from automox that didn’t need a print server. Great for small-medium business’s that don’t use a print server. This script will allow you to install printers and there drivers without the need for a tech to manually touch and add the printers themselves. I do recommend setting this as a policy on a manual run basis to only install the printers to someone’s computer that is missing them. When creating the export files, I recommend creating them in a virtual machine with all built in printers and as many drivers that you can remove as possible. Create a checkpoint in that VM with the OS as clean as possible so you can restore this OS when you want to create a new file. Create the printers with the specific drivers, and preferences that you want and export them to a “.printerExport” file. Make sure to test your exported file to make sure the file works co

Hello, I am trying to use Automox to uninstall GoToMeeting across our environment but I am failing. Has anyone successfully completed this take with a worklet? 

Looking for a bash script to uninstall Rapid7 agent on Linux/Ubuntu … please :)

Hi All, I was wondering if anybody tried to leverage Automox for pulling hardware hash for windows Autopilot in their company environment. i want to enroll multiple devices to autopilot but still little confused with pulling hardware hash for all devices and manually upload it to Intune which sucks.  Thanks in advance.

Could you please help me implement the worklet for the security vulnerability in OpenSSL (CVE-2024-4741)?

Hey All, Is there a way we can restrict users from wiping their laptops? Does anyone has prevented this with worklets?

I’ve been running a worklet to detect reboots based onWindows Update Pending Uptime exceeds 28 daysStarted noticing many workstations pending a reboot were not triggering on the evaluation code. $sysInfo = New-Object -ComObject "Microsoft.Update.SystemInfo" While there is a way to likely tune above, I’ve opted to add another strategy. This includes a registry lookup using 32-bit Powershell as this key will need it.# Query WMI for LastBootUpTIme$uptime = (get-date) - (gcim Win32_OperatingSystem).LastBootUpTime# Check Registry for Windows Update Pending Update$scriptblock = { function Get-WUAURebootReq { ## Making registry connection to the local/remote computer $HKLM = [UInt32] "0x80000002" $WMI_Reg = [WMIClass] "\\$ENV:COMPUTERNAME\root\default:StdRegProv" ## Query WUAU fr

All Windows 10 WorkstationsI tried 1 of the Dell Command Update Worklets and get this error on some workstations:Start-Process : This command cannot be run due to the error: The system cannot find the file specified.At C:\Program Files (x86)\Automox\execDir2926109883\execcmd3901365964.ps1:59 char:16+ ...      [void](Start-Process -FilePath $exe -ArgumentList "/s /l='$log'" ...+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~    + CategoryInfo          : InvalidOperation: (:) [Start-Process], InvalidOperationException    + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.Commands.StartProcessCommand COMMAND TIMED OUT. I’m looking to either find out why this error is happening or get a worklet with evaluation and  remediation code that can be used to successfully check which patches are needed and then install them and let me know which ones get installed. 

This worklet will search for Windows Unquoted Search Path under uninstall and services in registry and add quotes. This addresses a vulnerability detected by some tools like Rapid7 or Nessus. All changes made by the script are logged under C:\windows\temp\unquoted-search-path-changes.csv. #Evaluation Code $i = 0 $BaseKeys = "HKLM:\System\CurrentControlSet\Services", #Services "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall", #32bit Uninstalls "HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" #64bit Uninstalls #Blacklist for keys to ignore $BlackList = $Null #Create an ArrayList to store results in $Values = New-Object System.Collections.ArrayList #Discovers all registry keys under the base keys $DiscKeys = Get-ChildItem -Recurse -Directory $BaseKeys -Exclude $BlackList -ErrorAction SilentlyContinue | Select-Object

I have been working on a script that will set DCU to download, install and verify no matter  what the current setting is. In the update settings, a few behaviors are observed:Notify: Deletes AutomationMode if present Download updates: Creates AutomationMode with a value of ScanDownloadNotify Download and install updates: Creates AutomationMode with a value of ScanDownloadApplyNotifyLocation of the key:HKLM:\SOFTWARE\DELL\UpdateService\Clients\CommandUpdate\Preferences\Settings\Schedule\AutomationModeThe remediation code works perfect in Visual Studio Code. However, the evaluation code will only show the write-output and not push to the remediation code. Could someone shine some light on this?  Evaluation Code

Hello,I have deployed and create some (personal) worklets on one zone, and I am searching a way to easily duplicate them to anoter zone we have on our account.I see it’s possible for policy, but I don’t find the same “clone” function for worklet. Maybe there is another way to allow worklets to be applied on several zones ? Thanks in advance 

This is to deploy the CrowdStrike Windows agent in your environment. You’ll need the CrowdStrike installer, WindowsSensor.exe, which you can download from your CrowdStrike console. You’ll also need your Customer ID from the console. Remediation code: .\WindowsSensor.exe /install /quiet /norestart CID=<checksummed customer ID> Upload the WindowsSensor.exe file to the worklet, and put your CID in the CID flag section. If you have any issues getting the installer to work, you can add the flag ProvNoWait=1 which skips the requirement for the agent to make contact with the CrowdStrike console within 10 minutes, after which time the agent removes itself if it fails to make contact. Note that installing CrowdStrike over the top of another AV requires some extra steps as detailed in this article: