Skip to main content

Worklets

All things Worklets for Windows, macOS, and Linux

632 Topics
Tony-Automox
Tony-AutomoxAutomox Employee
posted in Find & Share Worklets
Worklet: Disable USB Removable Storage in Windows

This worklet can be used to disable USB remote storage devices in Windows. It has only been tested on Windows 10, and because of the default version of PowerShell on Win 7/8 and Server 2012 and older, I don’t believe it will work on those older operating systems without upgrading PowerShell on them - but haven’t tested. I’d be curious to see if it works on any of the older OSs, so let us know what you find. Be sure you’re not using this in an environment where GPOs would be fighting this worklet. It’s preferable if you use GPOs in your environment that you control USB remote storage that way and not with a worklet. The way the worklet is currently written, it will check to see if the USB removable storage policy is disabled (access to the removable drive is permitted) and enables it to lock down the use of USB removable storage. With some tweaking, you can also make it a worklet to reverse the process (disable the policy to allow USB removable storage). You can also tweak it so that it

5570
Tony-Automox
Tony-Automox
Tony-AutomoxAutomox Employee
posted in Find & Share Worklets
Worklet: Install / Upgrade to Microsoft Edge Chromium on Windows

This worklet by default will install the latest, stable version for Windows 64-bit. You can also modify $Channel to install the Dev or Beta instead. Here’s the description of the channels: docs.microsoft.com Microsoft Edge channel overview Microsoft Edge channel overview You can also modify $ProductVersion to specify a particular version you want installed. It has been tested on systems without any version of Edge pre-existing (ie. Win7) and on others that have the original version of Edge (whose end of life is March 9, 2021) such as Win10 v1909 & v2004. Evaluation: $software = "Microsoft Edge"; $installed = (Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where { $_.DisplayName -eq $software }) -ne $null If(-Not $installed) { Exit 1 } else { Exit 0 } Remediation: # Channel options are: Dev, Beta, Stable, EdgeUpdate, Policy $Channel = 'Stable' # Where to download the install file $Folder = "C:\Temp" $Platform = 'Windows' $Architecture = 'x64' # If set, th

2471
Tony-Automox
J
jryan
posted in Find & Share Worklets
Worklet for VB redistributables installation

Evaluation code $regkey = "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}" $name = "Version" Get-ItemProperty -Path "$regkey" -Name "$name" -ErrorAction SilentlyContinue If (($exists -ne $null) -and ($exists.Length -ne 0)) { Exit 0 } else { Exit 1 } Remediation code #Set download URLs for the various installers $vcredist_08 = "https://download.microsoft.com/download/5/D/8/5D8C65CB-C849-4025-8E95-C3966CAFD8AE/vcredist_x64.exe" $vcredist_10 = "https://download.microsoft.com/download/1/6/5/165255E7-1014-4D0A-B094-B6A430A6BFFC/vcredist_x64.exe" $vcredist_12 = "https://download.microsoft.com/download/1/6/B/16B06F60-3B20-4FF2-B699-5E9B7962F9AE/VSU_4/vcredist_x64.exe" $vcredist_13 = "https://download.microsoft.com/download/2/E/6/2E61CFA4-993B-4DD4-91DA-3737CD5CD6E3/vcredist_x64.exe" $vcredist_1519 = "https://aka.ms/vs/16/release/vc_redist.x64.exe" #Download the installers Invoke-WebRequest $vcredist_08 -OutFile $env:temp\vcredist_08.exe Invok

451
D
Tony-Automox
Tony-AutomoxAutomox Employee
posted in Find & Share Worklets
How to Make a Manual-Only Worklet Always Appear Compliant

Currently, if you have a worklet that you only run manually (never scheduled), you typically would set “Exit 1” for the evaluation so that when it’s executed, it will always run the remediation. The problem is that if you have manual-only worklets assigned to groups, none of the computers in those groups will EVER appear fully compliant since the manual worklet will always appear to be non-compliant, and thus each computer in those groups will NEVER appear as fully compliant. With this trick, you can make manual-only worklets always appear compliant. To do this, just put the following code as your worklet evaluation: Exit 0 The reason you can do this is that if you manually execute a worklet, it executes the remediation no matter what, but the “Exit 0” at least makes it appear as compliant. Remember, if you set a schedule to this worklet, it will never run because it will always get an “Exit 0” response (exit without running remediation). Use this ONLY with manual-run, non-scheduled wo

530
Tony-Automox
M
MrichardsPower User
posted in Find & Share Worklets
Worklet: Enterprise Firefox policies onto windows devices

Hi Guys, My security team was asking us to turn off DNS over HTTPS on our two browsers we support (firefox and chrome). On chrome its quite easy (drop a token that checks in with our enterprise gsuite) but for firefox, you need to drop a json file into the firefox directory. Evaluation: We only want to drop this json file if the box has firefox installed but not the policies.json. So we exit 0 if either both are true, or firefox just doesnt exist. $file = Test-Path 'C:\Program Files\Mozilla Firefox\distribution\policies.json' -PathType Leaf $application = Test-Path 'C:\Program Files\Mozilla Firefox\firefox.exe' -PathType Leaf if ($file -eq $true -And $application -eq $true) {exit 0} if ($application -eq $false) {exit 0} else {exit 1} Remediation: Copy-Item .\policies.json -Destination "C:\ProgramData\amagent" ######### #Copy over json before it gets to 64 bit powershell $scriptblock = { $software = "Mozilla Firefox"; $installed = (Get-ItemProperty HKLM:\Software\Microsoft\Windows\Curre

730
M
pmainard
pmainard
posted in Find & Share Worklets
Worklet - Install Okta Device Trust on Windows

This worklet will install the Okta Device Trust app on Windows to ensure that devices authenticating to secure apps (like VPN) are owned and managed by your enterprise. Make sure to grab the latest version of the Okta Device Trust app from your admin console. You can find it on the Downloads page under Settings or https://tenant.okta.com/admin/settings/downloads. After downloading the latest version of the app, upload the installation file to the worklet. As of publishing this, the latest version is 1.3.1.0 but if a newer one exists, change the file name in the remediation code as well as the $oktataskversion variable in the evaluation code. Evaluation Code ## Check to see if Okta Device Registration Task Is Installed ## # Program Name $oktaname = "Okta Device Registration Task " # Task Version Number $oktataskversion = "1.3.1.0"; $program = $oktaname + $oktataskversion # Check Status $status = (Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where { $_.D

1040
pmainard
V
VicKhan
posted in Find & Share Worklets
Clear Downloads Folder for Windows

Just a simple script we use to periodically clear staffs downloads folders as they tend to build up over time. This script will clear downloads for all users. Get-ChildItem C:\Users |%{Remove-Item -Path "C:\Users\$_\Downloads\*" -Force -Recurse}

320
V
V
VicKhan
posted in Find & Share Worklets
Set Wallpaper on MacOS

This script will set the wallpaper for Mac devices to one of your choosing. Just upload the wallpaper and adjust naming as needed. Please note, if a user has not previously allowed Finder in AppleEvents, they may get a prompt to allow. (If they accidently hit no to allow, AppleEvents can be reset using the command “tccutil reset AppleEvents”) #!/bin/bash #copy the .png file to the device scp DesktopWallpaper.png /library/ #Set wallpaper for user currentUser=$(/bin/ls -l /dev/console | /usr/bin/awk '{print $3}') sudo -u "$currentUser" -H osascript -e 'tell application "Finder" to set desktop picture to POSIX file "/library/DesktopWallpaper.png"'

1200
V
V
VicKhan
posted in Find & Share Worklets
Worklet - Add Custom Office Templates for O365 - Mac

Hi Everyone, The below code will install a custom office template for O365 on Mac’s. All that’s needed is to upload the custom template and change the sampletemplate.dotx references to your own. Confirmed working with Dotx and Potx files. #!/bin/sh scp sampletemplate.dotx /private/tmp/ currentUser=$(/bin/ls -l /dev/console | /usr/bin/awk '{print $3}') sudo -u "$currentUser" cp /private/tmp/sampletemplate.dotx /Users/$currentUser/library/"group containers"/ubf8t346g9.office/"user content.localized"/templates.localized/

330
V
Tony-Automox
Tony-AutomoxAutomox Employee
posted in Find & Share Worklets
Worklet: Install Huntress on Windows Clients

To install Huntress on clients, just put in your Account Key and Organization Key in the remediation. Evaluation: $scriptblock = { #Define Registry Location for the 64-bit and 32-bit Uninstall keys $uninstReg = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall','HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall') $appName = 'Huntress Agent' # Get all entries that match our criteria. DisplayName matches $appname $installed = @(Get-ChildItem $uninstReg -ErrorAction SilentlyContinue | Get-ItemProperty | Where-Object { ($_.DisplayName -match $appName) }) # If any matches were present, $installed will be populated. If none, then $installed is NULL and this IF statement will be false. # The return value here is what the ScriptBlock will send back to us after we run it. # 1 for Non-Compliant, 0 for Compliant if ($installed) { return 0 } else { return 1 } } $exitCode = & "$env:SystemRoot\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Wi

1370
Tony-Automox
simon.doodson
simon.doodson
posted in Find & Share Worklets
Worklet - Install Cisco Umbrella for Mac

Installing software silently on Macs is always a pain; thankfully Automox makes it much easier. Here is a simple script to check and install an uploaded Cisco Umbrella if it’s not found on the machine. The evaluation simply checks to see if the Cisco Umbrella service is running on the machine. The remediation utilises the uploaded .zip file needed for Cisco Umbrella installs. The zip is downloadable from the Umbrella dashboard and contains both the install package and registration details. Evaluation script: #Checking if Umbrella Service is present sudo launchctl list | grep -i RoamingClientConfigUpdater if [[ $? -eq 0 ]]; then exit 0 else exit 1 fi Remediation: #Copy attached umbrella zip to temp folder scp umbrella.zip /tmp #unzipping zip in temp folder unzip /tmp/umbrella.zip -d /tmp/umbrella #Creating folder for Umbrella sudo mkdir “/Library/Application Support/OpenDNS Roaming Client/” #Copying license info to Umbrella folder sudo cp /tmp/umbrella/OrgInfo.plist “/Library/Applicatio

1950
simon.doodson
B
bburns
posted in Find & Share Worklets
Install all the Microsoft Visual Studio Redistributables

Checks for a redistributable and if it is not there installs all the common ones. Especially useful if users do not have local admin Evaluation Code $regkey = "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}" $name = "Version" Get-ItemProperty -Path "$regkey" -Name "$name" -ErrorAction SilentlyContinue If (($exists -ne $null) -and ($exists.Length -ne 0)) { Exit 0 } else { Exit 1 } Remediation Code: #Set download URLs for the various installers $vcredist_08 = "https://download.microsoft.com/download/5/D/8/5D8C65CB-C849-4025-8E95-C3966CAFD8AE/vcredist_x64.exe" $vcredist_10 = "https://download.microsoft.com/download/1/6/5/165255E7-1014-4D0A-B094-B6A430A6BFFC/vcredist_x64.exe" $vcredist_12 = "https://download.microsoft.com/download/1/6/B/16B06F60-3B20-4FF2-B699-5E9B7962F9AE/VSU_4/vcredist_x64.exe" $vcredist_13 = "https://download.microsoft.com/download/2/E/6/2E61CFA4-993B-4DD4-91DA-3737CD5CD6E3/vcredist_x64.exe" $vcredist_1519 = "https://ak

2120
B
E
EIT
posted in Find & Share Worklets
Worklet: Install Printers

Here’s a worklet that we use to install printers via Automox: Eval Code: $testFile = "$env:windir\InstalledPrinters.txt" $testFileValue = (Test-Path $testFile) if ($testFileValue -eq $true ) { Exit 0 } else { Exit 1 } Remediation Code: $testServer = "printserver" $testServerValue = (Test-connection -Computername $testServer -BufferSize 16 -Count 1 -Quiet) if ($testServerValue -eq $false ) { Exit 0 Write-Host "printserver not reachable!" } else { Add-Printer -ConnectionName "\\printserver\east-gray" Add-Printer -ConnectionName "\\printserver\west-color" New-Item -ItemType file "$env:windir\InstalledPrinters.txt" }

3672
Nic-Automox
voltairine
voltairineRookie
posted in Find & Share Worklets
Worklet: Windows Defender Remote Work - RTM, Removable Drives, and other scan configurations

Its important that Windows devices are abiding by endpoint protection schemes now that so many more people are working remotely. It can also be hard to enforce standards around removable devices. That’s why we use the following to ensure the proper configurations are in place for Windows Defender (see comments for details on each item): #To enable real-time monitoring: Set-MpPreference -DisableRealtimeMonitoring $false #Making sure to catch removable USB drives as scan-able: Set-MpPreference -DisableRemovableDriveScanning $false #Making sure that email scanning (attachments) is enabled Set-MpPreference -DisableEmailScanning $false #Disable the scan of network files, which can cause issues remotely Set-MpPreference -DisableScanningNetworkFiles $false #Making sure to scan scripts as well Set-MpPreference -DisableScriptScanning $false #Make it so that before a scan runs Defender checks for new/the latest threat signatures Set-MpPreference -CheckForSignaturesBeforeRunningScan $true Feel fr

490
voltairine
D
DavidM-AutomoxFormer Automox Employee
posted in Find & Share Worklets
Windows 10 Feature Update From Local Server Share

@aescolastico wrote an amazing Windows 10 feature update script and kindly shared it with us a while back. Here is the link to his solution:Worklet: Automox OS Upgrade to Latest Windows10 OS version One of our customers was presented with a content download issue. Their devices were all in their offices, and all contain the same OS (same SKU, Language, architecture). @aescolastico’s solution does a fantastic job of determining what iso to download… due to this specific scenario, they preferred to download once, and use that ISO specifically for upgrades. With the environment and OS specifics already determined, I turned @aescolastico’s Ferrari of a script into a Moped to reduce the needed internet bandwidth and download time. A highbred of the two scripts is quite possible (example, check OS specs and download if it doesn’t match one you’ve placed in a local repository). Anywho, here it is :). How to use a Worklet to upgrade Windows 10 from a local network share: <# .SYNOPSIS This scri

2290
D
CamilleS-Automox
CamilleS-AutomoxFormer Automox Employee
posted in Find & Share Worklets
Building and sharing Automox Worklets on the community

Have you helped to build and share Automox worklets on this community? If so, fantastic. If not, how can we help you get started? If you need to know more about what Automox worklets can do, check out our latest blog post on the topic: Building and Sharing Automox Worklets on the Automox Alive Community.

210
CamilleS-Automox
Tony-Automox
Tony-AutomoxAutomox Employee
posted in Find & Share Worklets
Reset All of the Windows Updates Components to Default Settings

This script will completely reset the Windows Update client settings. It has been tested on Windows 7, 8, 10, and Server 2008 R2, 2012 R2, 2016. It will configure the services and registry keys related to Windows Update for default settings. It will also clean up files related to Windows Update. This worklet can either be run manually, or you can put in an evaluation code of: Exit 1 if you want to always run the worklet on a set schedule. <# .SYNOPSIS Resets the Windows Update components .DESCRIPTION This script will reset all of the Windows Updates components to DEFAULT SETTINGS, clean-up some files related to Windows Update, and notify the user that a reboot will occur in 15 minutes (which can be modified) giving them a second warning at 5 minutes. .OUTPUTS Results are output to the Activity Log. #> $arch = Get-WMIObject -Class Win32_Processor -ComputerName LocalHost | Select-Object AddressWidth Write-Host "1. Stopping Windows Update Services..." Stop-Service -Name BITS Stop-Service

6760
Tony-Automox
mfaas
mfaasRookie
posted in Find & Share Worklets
Worklet: Distribute custom Word template (Normal.dotm) to all users?

Hi, all, In our environment, we use a customized MS Word Template that is updated every few months. Is it possible to use a worklet/required software to either: Create the %appdata%\Roaming\Microsoft\Templates\ directory and copy the Normal.dotm in there? If it exists, compare file hashes and, if different, copy the newer version into that appdata directory? I can certainly do this programmatically on my PC, but it requires SMB access that the agent won’t have, as it runs as system. Can I upload the Normal.dotm as the “Installer Files” then access it somehow via the c:\ProgramData\amagent folder? Or, am I going about this all wrong? I am very new to Automox and am, honestly, still in my trial! Hope this make sense!

13452
Nic-Automox
CamilleS-Automox
CamilleS-AutomoxFormer Automox Employee
posted in Find & Share Worklets
Worklet: How to Disable Remote Desktop Protocol Connection

Here’s an example of a worklet we recently created in response to managing updates for the BlueKeep vulnerability: Introducing the Automox Worklet To enable your ability to configure and update systems using the Automox platform, we’ve created an endpoint hardening worklet that disables the remote desktop protocol connection. An Automox worklet is an open extensible automation architecture that allows IT operations to create any custom task that they can imagine. Our tool consumes and contains these worklets within a policy that can be automated and maintained across all devices with the Automox sensor installed. These reusable units of work can be applied across any supported operating system (including Windows, Linux, and OSX) and are powered by PowerShell and Bash scripting. How to Disable Remote Desktop Services Worklet If a machine is unpatchable, security administrators can use this worklet as a mitigating control to protect impacted Windows systems from the BlueKeep vulnerabilit

3742
Nic-Automox
J
jesumyipPower User
posted in Find & Share Worklets
Problem with worklet that manipulates registry

Hi all. I have a worklet that runs the following code in the remediation section. It doesn’t seem to be working. It works just fine if I run it in a powershell window (that runs as admin). What gives? I’m trying to disable auto-startup of Starleaf. $registryPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder" $registryProperty = "StarLeaf.lnk" $enableValue = ([byte[]](0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00)) $disableValue = ([byte[]](0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00)) Set-ItemProperty -Path $registryPath -Name $registryProperty -Value $disableValue -Type Binary

1771
J
Maikel
MaikelChannel Partner
posted in Find & Share Worklets
Looking for Worklet Best Practices

Hi All, im quite new to Automox and was wondering if you experts already collected best practices for creating worklets. For instance how can i write a proper output message to the activity log based on a step in evaluation or remediation and what things did you come up with when using the worklets? At this point for me anything goes!

13211
Nic-Automox
D
DavidM-AutomoxFormer Automox Employee
posted in Find & Share Worklets
Enable and Configure Storage sense - Windows 10

Microsoft announced that it will begin depreciating the Disk Cleanup tool starting in Windows 10 v1809, and in its place they are ramping up the built-in Storage sense feature originally released with Windows 10. Storage sense will automatically run cleanups when your disk is low on space, but you can configure it further to run on a schedule. If you have a manageable version of Windows 10 (Pro, Ent, Edu), than you can configure Storage sense through GPO. If your devices are not domain joined (or you prefer not to use GPO to manage storage sense), this Worklet can help enable the feature, and set some of the most common configurations. What are we doing in the settings? Evaluation - The example here is fairly simple. It checks if the primary key exists. The key is only created when GPO settings are applied, or if you manually place them. The idea is, that if this key is already there, it will not run remediation which could change what was applied by GPO. Remediation - Uses group polic

8040
D
D
DavidM-AutomoxFormer Automox Employee
posted in Find & Share Worklets
KACE Uninstall Script for Windows

Here is a worklet to assist with KACE agent uninstallation. The agent installation presents a few challenges, as it is a 32 bit installer, so it can be installed either in program files, or in program files (x86) depending on the OS architecture. In addition based on the Quest installation instructions, it will be created in one of two different sub-directories based on OS version and client version. This worklet is designed to work on either 32-bit or 64-bit Windows devices, and will work as long as the AMPTools.exe file exists in one of the default locations. We have an awesome customer giving this a shot, and I will update the code here if we find anything needs to be changed. Evaluation code borrowed from the Worklet: Enforced Application Uninstall for Windows Evaluation Code: <# .SYNOPSIS Check for presence of specified application on the target device .DESCRIPTION Read 32-bit and 64-bit registry to find matching applications Exits with 0 for compliance, 1 for Non-Compliance. Non-

28510
D
D
danursulineNovice
posted in Find & Share Worklets
Deployment of Google Remote Desktop

I threw this together for my org to get some easy remote support tools in place. Just wanted to post it here if someone else found it useful or could do a better job 😉 Evaluation Code: #REQUIRES -Version 2.0 <# .SYNOPSIS This Test script checks to see if Chrome is installed .DESCRIPTION This script queries the installed files for 32 and 64bit software and returns 0 if product is installed or 1 if not .Notes File Name :ChromeRemoteDesktop_Install_Test.ps1 Author :Automox Prerequisite :PowerShell V2 over win7 and upper #> #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function ChromeRemoteDesktop_Install_Test { [array]$key = Get-UninstallRegistryKey -SoftwareName "Chrome Remote Desktop Host" $alreadyInstalled = $false $version = '80.0.3987.18' if ($key.Count -ne 0) { $key | ForEach-Object { if ($_.DisplayVersion -eq $version) { $alreadyInstalled = $true } } } $packageArgs = @{ packageName = 'chrome-remote-desktop-host' fileType = 'msi' url = 'https://dl.goog

3768
D
D
dcadmin
posted in Find & Share Worklets
Using a worklet to remove Skype Appx

Attempting to check for the presence of the Microsoft Store App version of Skype. If present, run the Remediation (remove). The Worklet displays an Error status in the Activity Log, but I do not know why, nor how to check the logs/console. Using a modified version of the Skype install script - it does the same 32/64 bit checks, but remediates if Skype was found, rather than not found. At least I think. Eval: #REQUIRES -Version 2.0 <# .SYNOPSIS This Test script checks to see if Skype is installed .DESCRIPTION This script queries the installed files for 32 and 64bit software and returns a 1 if product is installed or 0 if not .Notes File Name :Skype_Uninstall_Test.ps1 Author : Prerequisite :PowerShell V2 over win7 and upper #> #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function Skype_Uninstall_Test { <# .SYNOPSIS This function Checks a Skype installation. .DESCRIPTION After checking the Skype availability, based on the exit code tool will decide to call r

1331
A
Welcome Ottomators!
Worklets
How to Use Worklets
Find & Share Worklets
Automox Platform Info
Automox University
Industry News
Ottomator Cafe
Terms & ConditionsCookie settings

Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings