Skip to main content

Worklets

All things Worklets for Windows, macOS, and Linux

641 Topics
jack.smith
jack.smithAll Star
posted in Find & Share Worklets
Worklet - Enforced Reboots with Notifications using Scheduled Tasks

The idea behind this worklet is to display balloon tip in the taskbar once every 5 hours and then every 15 minutes to warn end users of an upcoming reboot and when. If an end user reboots during the notification stages, there is a scheduled task that triggers upon restart that will run another powershell script that was written to cancel out running any future events built by this worklet. The notification is using a custom icon file I built using a company logo. Please do a lot of testing beforehand as the code is not professionally written to accommodate for every scenario one could encounter. Enjoy! Evaluation Code # Cleanup prior reboot task Unregister-ScheduledTask -TaskName 'RebootMsg*' -Confirm:$false | Out-Null # Establish Reboot Data Points $uptime = (get-date) - (gcim Win32_OperatingSystem).LastBootUpTime $sysInfo = New-Object -ComObject "Microsoft.Update.SystemInfo" if($sysInfo.RebootRequired -or $uptime.Days -gt 28) { exit 1} else { exit 0} Remediation C

9221
P
L
lindsaydallas
posted in Find & Share Worklets
Worklet Schedule Issue

Hi Everyone, I have created a worklet using the Community Worklet, "Targeted Reboot within Timeframe’. Issue is, i am unable to make this run using the Schedule. I have set the Schedule time 2am everyday and ticked ‘If a device misses configured patch time, it will patch next time the device checks in’ along with setting targeted time within the script of 2am Start time and 5.45am End Time. With checking the Activity Log for this Worklet, nothing appears. If i Run the Policy Manually, it works great and as expected, the server is evaluated, Rebooted if Pending and adds a record into the Activity Log. Can worklets run using the Schedule or is something else required? Appreciate any assistance. Cheers,

3053
M
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Find & Share Worklets
CIS Compliance: Windows 10 - 1 Account Policies - 1.2 Account Lockout

This section contains covers the Worklet that automatically applies the CIS recommendations for (1) Account Policies (1.2) Account Lockout. It is highly recommended that all Windows devices adhere to these recommendations and be evaluated frequently to ensure compliance. 1.2.1 (L1) Ensure ‘Account lockout duration’ is set to ‘15 or more minute(s)’ 1.2.2 (L1) Ensure ‘Account lockout threshold’ is set to ‘10 or fewer invalid logon attempt(s), but not 0’ 1.2.3 (L1) Ensure ‘Reset account lockout counter after’ is set to ‘15 or more minute(s)’ You can set these to be more restrictive than the settings above, but the following remediation code run without changes will set the thresholds as listed above. Remediation code: #SYPNOSIS #Automatically configures the Account Policies -> Account Lockout Policies the CIS recommended configuration for Windows 10 1809 #1.2 Account Lockout Policy #1.2.1 Ensure 'Account lockout duration' is set to '15 or more minute(s)' #1.2.2 Ensure 'Account lockou

4942
K
D
David_MitchellNovice
posted in Find & Share Worklets
Worklet to install Arduino IDE

I just wanted to share an example of getting creative with installs. This software will require a user prompt to install the certificates, but if they are already installed, you can install it silently. So I installed the software on a workstation manually and exported the certs. I added them to the policy package and use powershell to install the certs before installing the software. #REQUIRES -Version 2.0 <# .SYNOPSIS This script allows an admin to install Arduino IDE. .DESCRIPTION #> #Handle Exit codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function Arduino{ #############Change the settings in this block####################### ##################################################################### Try { certutil -addstore TrustedPublisher ArdruinoLLC.cer certutil -addstore TrustedPublisher ArdruinoSRL.cer certutil -addstore TrustedPublisher adafruit.cer Start-Process -FilePath "arduino-1.8.16-windows.exe" -A

491
D
D
david.thomsonNovice
posted in Find & Share Worklets
TPM 2.0 / Windows 11

Here is a quick way to check if a device has TPM 2.0. The output is written to reports > activity log. I’m sure there is a better way to do this, but on the other hand, it is better than checking devices manually. Remediation code: $info = (wmic /namespace:\root\cimv2\security\microsofttpm path win32_tpm get * /format:textvaluelist.xsl)) write-output $info exit 0

1680
D
M
Mike_JanewayNovice
posted in Find & Share Worklets
Disk cleanup- delete temp files

I am looking for a way to perform a disk cleanup that will delete temp files. I would like to perform it on command and also run daily on users computers. Thanks in advance

51714
M
Thor
ThorRookie
posted in Find & Share Worklets
Worklet to install Enercalc

I’m working on a worklet to install Enercalc. In the documentation it says to run it unattended to use: ECSEL6_SETUP.EXE /S /Q /V PAC “my_PCC_CODE_HERE” I wrote just a quick and dirty oneliner to just to see if I could get it to work as I never wrote a worklet before. I came up with: Start-Process -FilePath 'ecsel20_setup.exe' -ArgumentList ('/s', '/q', '/v', "_PAC_", '"MY_PCC_CODE_HERE"') -Wait -Passthru In a powershell, it works great and install. I decided to test it on a worklet and something interesting happened. During the install of Enercalc, if you don’t have the Microsoft VC++ redistributables installed on the PC it automatically installs them. So the Enercalc install automatically installed all of them on my test machine, except didn’t install Enercalc. I’m really not sure where to go to try and figure out what’s going on, but a thought that I have is that during the install of Enercalc it displays an install screen during install, but I’m not sure if that would affect this

1052
Thor
R
rmullenNovice
posted in Find & Share Worklets
Worklet - Java 271

Hey guys, just need some assistance finalising the Java worklet. The automatic patching seems to have uninstalled Java from a fair few machines so need to resolve. It works fine running from the local machine, however no luck from Automox. Eval is fine. It downloads the two files then does not run the commands; installing 2 instances of Java (32 and 64bit). #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } try{ $process1 = Start-Process -FilePath 'jre-8u271-windows-i586.exe' -ArgumentList '/s', 'REMOVEOUTOFDATEJRES=1', '/L C:\ProgramData\amagent\worklets\java\java_86.log' -Wait -Passthru -ErrorAction Stop $process2 = Start-Process -FilePath 'jre-8u271-windows-x64.exe' -ArgumentList '/s', '/L C:\ProgramData\amagent\worklets\java\java_64.log' -Wait -Passthru -ErrorAction Stop exit 0 } Catch{ $Exception = $error[0].Exception.Message + "`nAt Line " + $error[0].InvocationInfo.ScriptLineNumber Write-Output $Exception exit 90 } Would app

1635
B
D
dmunsonChannel Partner
posted in Find & Share Worklets
Worklet to set screen lock on Mac

My company is working on making sure we have automatic screen lockouts on our machines. For our Windows machines we control this through GPO, but that does not affect the handful of Mac machines we have in our environment. Does anyone know how to script out a way to have Macs lock after a certain amount of inactivity (i.e. 5 minutes)? My DuckDuckGoing has been unsuccessful in searching for an answer to this. Thanks!

1411
J
M
msheth
posted in Find & Share Worklets
I am trying to copy files from share server but not able to do it.

hey everyone, I have been trying to get the copy file to work. but on the Automox it shows it was copied but it is not. when I ran the scripted locally with x86 it looks to be able to copy the files. Copy-Item -Path ‘\servername\freenas4\installs\VPN Certs*’ -Destination ‘c:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile’ -PassThru

2093
D
AdamN
AdamNFormer Automox Employee
posted in Find & Share Worklets
OMIGOD: Worklet to patch OMI

Hey Automox Community, As some of you may be aware, a number of high/critical vulnerabilities targeting Azure Virtual Machines have been discovered and patched by Microsoft. These vulnerabilities target the Open Management Infrastructure (OMI) agent running on Linux VM’s, and include remote code execution and privilege escalation vulnerabilities. This worklet will install the correct Microsoft repository based on your distribution of Linux and patch the OMI agent. We suggest running this worklet if any of your assets are Azure Linux VM’s. For more information about the vulnerability, see CVE-2021-38647 and Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions. Evaluation Code: #!/bin/bash #================================================================ # HEADER #================================================================ #% SYNOPSIS #+ Updates OMI on Azure Linux VM's. #% #% DESCRIPTION #% The eval code checks to see if the device is an Azu

1735
R
Y
YB_OpsRookie
posted in Find & Share Worklets
Greenshot

Hi Any one got a working worklet for greenshot ?

311
Y
V
viennaNovice
posted in Find & Share Worklets
Worklet: Uninstall TeamViewer on Windows

Hi all, we had a couple machines that had TeamViewer installed and needed to mass uninstall, thought I’d share the Worklet to uninstall this Evaluation: if (Test-Path -Path "C:\Program Files (x86)\TeamViewer") { Write-Output "TeamViewer not installed, skipping" exit 0 } else { Write-Output "TeamViewer installed, we will uninstall" Exit 1 } Remediation: $AllApps = Get-ItemProperty "HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" $TeamViewer = $AllApps | Where-Object {$_.DisplayName -Like "TeamViewer*"} Write-Output "Uninstalling TeamViewer" Start-Process -FilePath ($TeamViewer.UninstallString) -ArgumentList "/S" -WindowStyle Hidden

3733
J
J
jesumyipPower User
posted in Find & Share Worklets
Create scheduled task to run at user log-on as user him/herself

Hi everyone We sometimes have a requirement to replicate the behaviour of GPOs that run in the user context. This means you need to execute a task under the current logged on user and trigger it to occur only when user logs on. To achieve this, we can use a scheduled task with 2 special settings: It is triggered only when a user logs on It runs under the context of the local “USERS” group. With #2, you are able to access all the usual user-context-specific data such as %USERNAME%, HKCU, etc. And, this approach makes the scheduled task run under the context of ANY user that logs on. Say for example you have 2 users - USERA and USERB logging on, the scheduled task will take on the security context of USERA or USERB depending on who logs on. Unfortunately, you cannot achieve this with the New-ScheduledTask cmdlet. You will have to use COM programming. Here’s the code: $ShedService = New-Object –comobject 'Schedule.Service' $ShedService.Connect() $Task = $ShedService.NewTask(0) $Task.Re

61864
D
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Find & Share Worklets
What worklets would you like us to write next?

We’re continuing to crank out more worklets for you to download and use: https://community.automox.com/c/worklets and we’re looking for some input from the community as to what we should work on next. What tasks would you love to automate but haven’t had the time to script? Tell us what you’d like and we can help by putting together a worklet for you.

48120
J
C
chevychaserRookie
posted in Find & Share Worklets
Install Nessus Agent on Linux Hosts - Bash Script

has anyone created any worklets or required software policy for installing Nessus on linux hosts? This would include configuring the agent with the necessary switches.

3842
C
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Find & Share Worklets
Worklet: Windows Cleanup Tool

This worklet will allow you to run the Windows Cleanup Tool on any of your Windows endpoints, based on the amount of free space remaining on the C: drive. If you use the /SageSet and /SageRun commands, you’ll need to create presets on the endpoints first. This /SageSet process can be automated, as some folks have demonstrated here: stackoverflow.com Automate process of Disk Cleanup cleanmgr.exe without user intervention powershell, registry, powershell-3.0, resource-cleanup asked by Pinte Dani on 11:01AM - 04 Mar 15 UTC If you don’t want to bother with the /SageSet presets you can use the /VeryLowDisk flag instead, with the caveat that this will pop up the scan completion window on the endpoint, which might be confusing to users. More documentation on the cleanmgr.exe flags here: Winaero – 2 Dec 16 Disk Cleanup Cleanmgr Command Line Arguments in Windows 10 The built-in tool, Dis

2111
M
C
CSV
posted in Find & Share Worklets
Dell Command | Batch File either not running or not producing log file

I have a batch file which disables BIOS updates in Dell command: “%PROGRAMFILES%\Dell\CommandUpdate\dcu-cli.exe”/configure -autoSuspendBitLocker=disable -outputLog=C:\Temp\dell.log The remediation code is: Copy-Item -Path “dellcommand.bat” -Destination “c:\Temp” Start-Process C:\Temp\dellcommand.bat New-Item -Path “C:\Program Files\Dell\CommandUpdate” -Name “BIOSudDisabled” -ItemType “Directory” It copies the batch file to the temp folder and creates the new folder but there is no evidence of the batch file actually being executed. I can’t seem to get my head around why as everything works fine when run locally. Any help appreciated.

1892
C
jack.smith
jack.smithAll Star
posted in Find & Share Worklets
Windows Update Troubleshooter

This will kick off the Windows Update Troubleshooter process and attempt to report back results of the process into the activity log. Remediation Code $tsp = Get-TroubleshootingPack C:\Windows\diagnostics\system\WindowsUpdate Invoke-TroubleshootingPack -Pack $tsp -AnswerFile .\WUDAnswers.xml -Unattended -Result $env:HomeDrive\WUDResult [xml]$xml = Get-Content $env:HomeDrive\WUDResult\ResultReport.xml $xml.ResultReport.Package.Problem.DetectionInformation.DetailedInformation.Detail.Contents.Objects.Object | % { write-output $_.'#text';write-output ". " }

2700
jack.smith
Stambo-Automox
Stambo-AutomoxAutomox Employee
posted in Find & Share Worklets
Check disk space on C: drive

Automox requires a minimum of 3GB of free disk space in order to execute daily functions prioperly. This worklet checks for free disk space on the C:\ drive. The worklet will produce a result in the Activity Log only if a host has less than 3.0GB of free space on the C:\ drive. Evaluation: $runCheck = { $minDiskSpaceGB = 3.0 $diskCheck = Get-WmiObject -Class Win32_logicaldisk -Filter "DriveType = '3'" | Where-Object {$_.DeviceID -eq "C:"}| Select-Object -Property DeviceID, @{L='FreeSpaceGB';E={"{0:N2}" -f ($_.FreeSpace /1GB)}},@{L="Capacity";E={"{0:N2}" -f ($_.Size/1GB)}} | Where-Object {[float]$_.FreeSpaceGB -lt $minDiskSpaceGB} if ( $diskCheck -eq $null ) { return 0 } else { return 1 } } exit $exitCode = & $runCheck Remediation: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } $runCheck = { $minDiskSpaceGB = 3.0 $diskCheck = Get-WmiObject -Class Win32_logicaldisk -Filter "DriveType = '3'" | Where-Object {$_.DeviceID -eq "C:"}| Select-Object -Property De

2765
Stambo-Automox
O
ORORNovice
posted in Find & Share Worklets
Knowbe4 Phish Alert Button(PAB) installation

I have this KB article: Outlook (Client-based) Phish Alert Button Product Manual – Knowledge Base Can anyone help me to create the worklet for Win10 device?

742
O
D
David_MitchellNovice
posted in Find & Share Worklets
Worklet: Example of a workflow to continue across reboots to fix corrupt Sophos install using scheduled tasks

This is something that I put together to fix corrupt installs of Sophos caused by our old imaging system. The logic could be used for any workflow that needs to span reboots and continue. I am attaching two executables and two PowerShell scripts to the worklet. The worklet then copies them to C:\Windows\Temp so they are not removed when the worklet completes and they can continue after reboot. Eval code -I always want this to run on whatever target devices are selected Exit 1 Remediation Code #Create scheduled task to trigger script1 on next boot $AtStartup = New-ScheduledTaskTrigger -AtStartup -RandomDelay 00:00:30 $Settings = New-ScheduledTaskSettingsSet $Principal = New-ScheduledTaskPrincipal -UserID "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount -RunLevel Highest $Action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-NonInteractive -NoLogo -NoProfile -ExecutionPolicy Bypass -File "c:\windows\temp\script1.ps1"' $Task = New-ScheduledTask -Trigger $AtStartup -Settin

3710
D
gareth.blakecoggins
gareth.blakecogginsRookie
posted in Find & Share Worklets
Carbon Black - Windows

Afternoon, I have managed to find a worklet for installing Carbon Black on a Mac EndPoint - but I am unable to find one for installing on a Windows Endpoint, is there a template available or has anyone else had any luck in writing one? The “12 Hour” time frame from the CB console is too long for sensible deployments 🙂 Thanks

1812
owl-IT
S
scriptpirateNovice
posted in Find & Share Worklets
System needs a reboot prompting script?

I wonder if its possible to make a mac script that would check if system is pending a reboot and then push user notifications to do it, not necessary to have an option for user to do it from the message, just want to alert user they need to reboot…repeatedly…until they hopefully do.

67618
S
Marina
MarinaFormer Automox Employee
posted in Find & Share Worklets
Worklet: SeriousSAM/HiveNightmare LPE Vulnerability (CVE-2021-36934)

The following worklet is used to mitigate the abuse of a low privilege user that have RX permissions in the %windir%\system32\config directory. With the availability of VSS shadow copies, this low privilege user may obtain credentials and DPAPI computer keys, install programs, delete data, or create new accounts. The following worklet follows the recommendations of Microsoft for a suggested workaround. Note: The recommendations provided by Microsoft includes the deletion of shadow copies. Please be advised that ransomware authors may also delete shadow copies, and many antiviruses and EDR solutions may block or flag this activity. Additionally, depending on your backup software and/or policies, this mitigation may conflict with your existing practices. Please consult with your IT/Security policies first prior to implementing this worklet. Also per best practice, please also test this worklet on a small sample size prior to implementing across the organization. Evaluation Code To evalu

2209
Marina
Terms & ConditionsCookie settings