Script works locally, but not through Automox

I was able to get it to work on my test system once I changed:

Invoke-GPUpdate -Force

to:

$cmdCommand = 'C:\Windows\System32\gpupdate.exe'
& $cmdCommand '/force'

Hi Tony,

Thanks for the reply. Will have to wait to test this out as it seems when I try to run this individual worklet on my test machines it just runs through every single applied policy on that device. Which I believe is causing some issues.

Here are the end part of the logs after the scripts try to run, not sure whats going on. But chatting with support.

2020/10/27 09:06:52 mqclient.go:340: Pushing result to agent.ec1b5fee-25e3-4aa7-a98c-8f147c1b2aa9.resp
2020/10/27 09:06:52 cmd.go:158: Received execCmd command
2020/10/27 09:06:52 cmd.go:108: Executing command: ["$BLinfo = Get-Bitlockervolume\n\nif($blinfo.ProtectionStatus -eq 'On' -and $blinfo.EncryptionPercentage -eq '100'){\n    Write-Output \"'$env:computername - '$($blinfo.MountPoint)' is encrypted and compliant\"\n    exit 0\n} else {\n\tWrite-Output \"'$env:computername - '$($blinfo.MountPoint)' is not encrypted and non-compliant\"\n    exit 1\n}" ""]
2020/10/27 09:06:55 cmd_windows.go:135: runScript: Error in Wait exit status 1
status: 1
stdOut: Omitted
stdErr: 
2020/10/27 09:06:55 mqclient.go:340: Pushing result to agent.ec1b5fee-25e3-4aa7-a98c-8f147c1b2aa9.resp
2020/10/27 09:06:55 cmd.go:158: Received execCmd command
2020/10/27 09:06:55 cmd.go:108: Executing command: ["Write-Host \"Application of compliance GPO's has begun.\"" ""]
2020/10/27 09:06:56 cmd_windows.go:147: Command End -- elapsed 1.4555068s
2020/10/27 09:06:56 mqclient.go:340: Pushing result to agent.ec1b5fee-25e3-4aa7-a98c-8f147c1b2aa9.resp
2020/10/27 09:13:44 axbackoff.go:43: Backoff duration was 36m21.174155572s
2020/10/27 09:13:44 cmd.go:158: Received nop command
2020/10/27 09:13:44 asclient.go:241: POST https://api.automox.com/checkin?uptime=425393&ver=1.0-29&tz=UTC-0700
2020/10/27 09:13:44 asclient.go:583: No proxy found. Using direct connection
2020/10/27 09:14:55 axbackoff.go:43: Backoff duration was 37m11.853398634s
2020/10/27 09:14:55 cmd.go:158: Received nop command
2020/10/27 09:14:55 asclient.go:241: POST https://api.automox.com/checkin?uptime=425464&ver=1.0-29&tz=UTC-0700&diag=1
2020/10/27 09:14:55 asclient.go:583: No proxy found. Using direct connection
2020/10/27 09:15:46 asclient.go:420: Checkin error occurred: Post https://api.automox.com/checkin?uptime=425393&ver=1.0-29&tz=UTC-0700: net/http: timeout awaiting response headers
2020/10/27 09:15:46 main.go:429: ERROR: client.DoCheckin(): Post https://api.automox.com/checkin?uptime=425393&ver=1.0-29&tz=UTC-0700: net/http: timeout awaiting response headers

Hi Tony,

Do you have any other suggestions? I have not been able to get this to work when running through a worklet.

Thanks,

Try using this instead:

#Enable Deny write access to removable drives not protected by Bitlocker
$RegPath = 'HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE'
$RegName = 'RDVDenyWriteAccess'
$RegData = '1'
$RegType = 'DWORD'

IF(!(Test-Path $RegPath)) {
    New-Item -Path $RegPath -Force | Out-Null
}
New-ItemProperty -Path $RegPath -Name $RegName -Value $RegData -PropertyType $RegType -Force | Out-Null

#Disable DenyCrossOrganization Use
$RegPath = 'HKLM:\Software\Policies\Microsoft\FVE'
$RegName = 'RDVDenyCrossOrg'
$RegData = '0'
$RegType = 'DWORD'

IF(!(Test-Path $RegPath)) {
    New-Item -Path $RegPath -Force | Out-Null
}
New-ItemProperty -Path $RegPath -Name $RegName -Value $RegData -PropertyType $RegType -Force | Out-Null

#Enable 'Enforce Full Encryption type on removable data drives'
$RegPath = 'HKLM:\Software\Policies\Microsoft\FVE'
$RegName = 'RDVEncryptionType'
$RegData = '1'
$RegType = 'DWORD'

New-ItemProperty -Path $RegPath -Name $RegName -Value $RegData -PropertyType $RegType -Force | Out-Null

#Enable 'Control use of Bitlocker on removable drives'
$RegPath = 'HKLM:\Software\Policies\Microsoft\FVE'
$RegName = 'RDVAllowBDE'
$RegData = '1'
$RegType = 'DWORD'

New-ItemProperty -Path $RegPath -Name $RegName -Value $RegData -PropertyType $RegType -Force | Out-Null

#Enable 'Allow users to apply Bitlocker protection on removable data drives'
$RegPath = 'HKLM:\Software\Policies\Microsoft\FVE'
$RegName = 'RDVConfigureBDE'
$RegData = '1'
$RegType = 'DWORD'

New-ItemProperty -Path $RegPath -Name $RegName -Value $RegData -PropertyType $RegType -Force | Out-Null

#Enable 'Allow users to suspend and decrypt Bitlocker protection on removable data drives'
$RegPath = 'HKLM:\Software\Policies\Microsoft\FVE'
$RegName = 'RDVDisableBDE'
$RegData = '1'
$RegType = 'DWORD'

New-ItemProperty -Path $RegPath -Name $RegName -Value $RegData -PropertyType $RegType -Force | Out-Null

Write-Host "| All Bitlocker To-Go policies have been applied. |"

Hi Tony,

Thanks for putting that together. No dice with that either, seems to run through automox fine, but doesn’t change anything.

Worked for me locally and by worklet on a Win10 v1909 machine. What kind of machine are you trying to use it on?

I am running on a Windows 10 v2004 machine. I tested it on a 2nd machine I have and can’t get it to work locally. This was running powershell as admin.

Out of curiosity where were you checking to verify the settings were changed? Was it just in the “Local Group Policy Editor”?

Figured out what was going on.

After researching and learning more of how local GPO’s work it appears these scripts were modifying the registry keys as expected, but the changes don’t reflect in gpedit.msc.

And even though they don’t show in gpedit.msc the changes are made and applied.

Thanks again for the help your provided 🙂