This worklet will install Cisco Umbrella with certificate and config files. This also checks for the OpenDNS agent and removes as well.
Evaluation
- Paramaters
- Thumbprint ID of the root certificate used by your own SWG deployment
- If any of the services don’t exist, run remediation
- csc_vpnagent
- csc_swgagent
- csc_umbrellagent
- If running an older version of the service Umbrella_RC, run remediation
- If the Root Certificate is missing, run remediation
- If OrgInfo.json is not in place, run remediation
#params
$thumbprint = "<your-org-thumbprint>"
# Cisco AnyConnect VPN Module
$service = Get-Service csc_vpnagent -ErrorAction SilentlyContinue
IF(!$service)
{
exit 1
}
# Cisco AnyConnect Diagnostics and Reporting Tool
$service = Get-Service csc_swgagent -ErrorAction SilentlyContinue
IF(!$service)
{
exit 1
}
# Cisco AnyConnect Umbrella Roaming Security Agent
$service = Get-Service csc_umbrellaagent -ErrorAction SilentlyContinue
IF(!$service)
{
exit 1
}
# Root Certificate used to inpsect HTTPS traffic
$cert = Get-ChildItem Cert:\LocalMachine\Root | Where-Object Thumbprint -eq $thumbprint
IF(!$cert)
{
exit 1
}
# Cisco Umbrella Roaming Client
$service = Get-Service Umbrella_RC -ErrorAction SilentlyContinue
IF($service)
{
exit 1
}
# Cisco Umbrella Roaming Client OrgInfo.json
$orginfo = 'C:\ProgramData\Cisco\Cisco Secure Client\Umbrella\OrgInfo.json'
IF((Test-Path $orginfo) -eq $false)
{
exit 1
}
Remediation
Please use the reference links in the code to read about each installer, the switches so you can update to your needs
- Paramaters
- Thumbprint ID of the root certificate used by your own SWG deployment
- OrgId of your own organization
- Payloads
- Download your own ZIP file from Cisco and upload that, the worklet will unpackage that and look for the relevant titles to install
- Root Certificate
example payloads as uploaded
- If any of the services don’t exist, run remediation
- csc_vpnagent
- csc_swgagent
- csc_umbrellagent
- If running an older version of the service Umbrella_RC, uninstall
- If the Root Certificate is missing, install from payload
- If OrgInfo.json is not in place, create it using params
# Reference Links
## Secure Client Download: https://software.cisco.com/download/home/283000185
## Admin Guide: https://docs.umbrella.com/deployment-umbrella/docs/anyconnect-umbrella-roaming-security-client-administrator-guide
## downloaded "Module Profile" found at \Profiles\umbrella\OrgInfo.json from https://dashboard.umbrella.com/o/'<your-orgid>'/#/deployments/core/roamingdevices
## downloaded "Root Certificate" found at \ from https://dashboard.umbrella.com/o/'<your-orgid>'/#/deployments/configuration/customercertificate
$thumbprint = "<your-thumbprint>"
$orgid = '<your-orgid>'
$userId = '<your-userid>'
$zip = 'cisco-secure-client-win-5.0.03072-predeploy-k9' #just the name, don't add .zip
Get-Process MSIExec | Stop-Process -force -confirm:$false
# Prepare installation folder
Copy-Item .\$zip.zip C:\windows\temp\
Expand-Archive C:\windows\temp\$zip.zip -DestinationPath C:\windows\temp\$zip
$path = "C:\Windows\Temp\$zip"
# Setup Root Certificate used to inpsect HTTPS traffic
$cert = Get-ChildItem Cert:\LocalMachine\Root | Where-Object Thumbprint -eq $thumbprint
IF(!$cert)
{
# Missing Root Certificate. Installing
Write-Output "Installing Cisco_Umbrella_Root_CA certificate"
$cert = Get-ChildItem .\Cisco_Umbrella_Root_CA.cer
$cert | Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root
}
elseif($cert)
{
Write-Output "Cisco_Umbrella_Root_CA.cer already installed in root certificate store."
}
# Remove Cisco Umbrella
$service = Get-Service Umbrella_RC -ErrorAction SilentlyContinue
IF($service)
{
# Removing Umbrella Roaming Client
Write-Output "Removing Umbrella Roaming Client"
Start-Process msiexec -ArgumentList "/x $path\Setup.msi /qn" -wait
# Validate Removal
Start-Sleep -Seconds 15
$service = Get-Service Umbrella_RC -ErrorAction SilentlyContinue
IF($service)
{
Write-Output "Failed to remove Umbrella Roaming Client"
}
}
elseif(!$service)
{
Write-Output "Umbrella Roaming Client already removed."
}
# Install Cisco Secure Client VPN Module
$service = Get-Service csc_vpnagent -ErrorAction SilentlyContinue
IF(!$service)
{
Write-Output "Installing Cisco Secure Client VPN Module."
$msi = (Get-ChildItem $path\*core-vpn-predeploy-k9.msi).fullname
Start-Process msiexec -ArgumentList "/package $msi /norestart /passive PRE_DEPLOY_DISABLE_VPN=1 LOCKDOWN=1 /lvx* C:\windows\temp\vpninstall.log" -Wait
Start-Sleep -Seconds 30
$service = Get-Service csc_vpnagent -ErrorAction SilentlyContinue
IF(!$service)
{
Write-Output "Failed to install Cisco Secure Client VPN Module. Review C:\windows\temp\vpninstall.log"
}
}
elseif($service)
{
Write-Output "Cisco Secure Client VPN Module already installed."
}
# Install Cisco Secure Client Diagnostics and Reporting Tool
$service = Get-Service csc_swgagent -ErrorAction SilentlyContinue
IF(!$service)
{
Write-Output "Installing Cisco Diagnostics and Reporting Tool"
$msi = (Get-ChildItem $path\*dart-predeploy-k9.msi).fullname
Start-Process msiexec -ArgumentList "/package $msi /norestart /passive LOCKDOWN=1 /lvx* C:\windows\temp\dartinstall.log" -Wait
Start-Sleep -Seconds 30
$service = Get-Service csc_swgagent -ErrorAction SilentlyContinue
IF(!$service)
{
Write-Output "Failed to install Cisco Secure Client Diagnostics and Reporting Tool. Review C:\windows\temp\dartinstall.log"
}
}
elseif($service)
{
Write-Output "Cisco Diagnostics and Reporting Tool already installed."
}
# Install Cisco Secure Client Agent
$service = Get-Service csc_umbrellaagent -ErrorAction SilentlyContinue
IF(!$service)
{
Write-Output "Installing Cisco Secure Client Umbrella Roaming Security Agent"
$msi = (Get-ChildItem $path\*umbrella-predeploy-k9.msi).fullname
Start-Process msiexec -ArgumentList "/package $msi /norestart /passive LOCKDOWN=1 /lvx* C:\windows\temp\umbrellainstall.log" -Wait
Start-Sleep -Seconds 30
$service = Get-Service csc_umbrellaagent -ErrorAction SilentlyContinue
IF(!$service)
{
Write-Output "Failed to install Cisco Secure Client Umbrella Roaming Security Agent. Review C:\windows\temp\umbrellainstall.log"
$log = Get-Content C:\windows\temp\umbrellainstall.log
}
}
elseif($service)
{
Write-Output "Cisco Secure Client Umbrella Roaming Security Agent already installed."
}
# Cisco Umbrella Roaming Client OrgInfo.json
$orginfo = 'C:\ProgramData\Cisco\Cisco Secure Client\Umbrella\OrgInfo.json'
IF((Test-Path $orginfo) -eq $false)
{
"OrgInfo.json was missing. Creating file. "
$json = [pscustomobject]@{organizationId=$orgid;fingerprint=$thumbprint;userId=$userId}
$json | ConvertTo-Json | out-file $orginfo -force
}
Remove-Item C:\windows\temp\$zip -Recurse -Force
$log
