Script Requests - Itarian team will write the scripts for you :) for FREE.

[DevoteamEndpointSecurity]

Hi PremJkumar,


Regarding the "Script to install 7Zip Application" requested by asdadmin, it can be useful also in our scope, so we have imported it to our EM instance and tested it. Unfortunately, it does not work: it stays in the "Started" status forever, without returning any kind of error or other messages, see the attached screenshot for reference.

I have noticed that, for us, both download links lead to an HTTP 404 error page:

This patchportal.one-us.comodo.com page can’t be found
No web page was found for the web address: https://patchportal.one-us.comodo.co...x86/7z1900.exe
HTTP ERROR 404

This patchportal.one.comodo.com page can’t be found
No web page was found for the web address: https://patchportal.one.comodo.com/p...7z1900-x64.exe
HTTP ERROR 404

Might that error be related to the issue found?

Thanks in advance for your kind help!
-- Javier Llorente
Endpoint Security - Devoteam

[asdadmin]

I have installed 7-zip successfully using the application store. 7-zip is one of the support applications on ITARIAN

[mayberts]

Can you create a script for Storage Sense? this is how it will look in PowerShell. Thanks

## Enable Storage Sense
## Ensure the StorageSense key exists
$key = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersi on\S torageSense"
If (!(Test-Path "$key")) {
New-Item -Path "$key" | Out-Null
}
If (!(Test-Path "$key\Parameters")) {
New-Item -Path "$key\Parameters" | Out-Null
}
If (!(Test-Path "$key\Parameters\StoragePolicy")) {
New-Item -Path "$key\Parameters\StoragePolicy" | Out-Null
}

## Set Storage Sense settings
## Enable Storage Sense
Set-ItemProperty -Path "$key\Parameters\StoragePolicy" -Name "01" -Type DWord -Value 1

## Set 'Run Storage Sense' to Every Week
Set-ItemProperty -Path "$key\Parameters\StoragePolicy" -Name "2048" -Type DWord -Value 7

## Enable 'Delete temporary files that my apps aren't using'
Set-ItemProperty -Path "$key\Parameters\StoragePolicy" -Name "04" -Type DWord -Value 1

## Set 'Delete files in my recycle bin if they have been there for over' to 14 days
Set-ItemProperty -Path "$key\Parameters\StoragePolicy" -Name "08" -Type DWord -Value 1
Set-ItemProperty -Path "$key\Parameters\StoragePolicy" -Name "256" -Type DWord -Value 14

## Set 'Delete files in my Downloads folder if they have been there for over' to 60 days
Set-ItemProperty -Path "$key\Parameters\StoragePolicy" -Name "32" -Type DWord -Value 1
Set-ItemProperty -Path "$key\Parameters\StoragePolicy" -Name "512" -Type DWord -Value 60

## Set value that Storage Sense has already notified the user
Set-ItemProperty -Path "$key\Parameters\StoragePolicy" -Name "StoragePoliciesNotified" -Type DWord -Value 1

[PremJkumar]

Hi mayberts,

Thanks for your script request. We have asked our script developers to analyze and provide the script.

Kind Regards,
PremJK

[mayberts]

Historically we have used Cylance antivirus, and it still exists on our machines. It is protected with a password, and no one has it. I have found a workaround, but it is very manual. Would it be possible for this to be made into a script?

We need SetACL to change permissions of the Cyalnce have more info here https://helgeklein.com/setacl/

XCOPY \\SERVERNAME\Deploy\SetACL.exe “C:\Windows\System32” /I

SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Cylance\Desktop" -ot reg -actn setowner -ownr "n:administrators"

SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Cylance\Desktop" -ot reg -actn ace -ace "n:administrators;p:full"

reg add HKEY_LOCAL_MACHINE\SOFTWARE\Cylance\Desktop /v SelfProtectionLevel /t REG_DWORD /d 1

reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Cylance\Desktop /v LastStateRestorePoint

Once the above has been done, I can remove Cylance using the below procedure.

guid='{2E64FC5C-9286-4A31-916B-0D8AE4B22954}'

import subprocess
import ctypes

class disable_file_system_redirection:
_disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirect ion
_revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirecti on
def __enter__(self):
self.old_value = ctypes.c_long()
self.success = self._disable(ctypes.byref(self.old_value))
def __exit__(self, type, value, traceback):
if self.success:
self._revert(self.old_value)


Thanks

[PremJkumar]

Hi mayberts,

Thanks for your script request. We have asked our script developers to check and provide you with update.

Kind Regards,
PremJK

[PremJkumar]

Hi mayberts,

Please run this script in JSON prepared by our script developers to suffice your needs,
20210616-Remove_Cylance_antivirus.json

Note: Run as System User or Logged in User.

Kind Regards,
PremJK

[mayberts]

PremJkumar I have imported to JSON, but it fails to do anything. I can run the procedure and it shows as started, but there is no additional info. I can see it doesn't do the first step which is Xcopy

[mdyunusraza]

Hi,
Is it possible to run the procedure with the desired account on the client? Currently the only option is SYSTEM and Logged in user. We cannot use logged in user as it does not have admin rights and SYSTEM we are not able to use as it does not show any popup. I am deploying the applications to the client using chocolatey and have created a GUI app based on powershell. This GUI app is called before the application is installed. The purpose of this app is to allow user to postpone the installation if they want to do it. Ideally this is supposed to be given by Itarian itself but that is a gap in this product, so i try to fill that gap but i am now stuck in this SYSTEM and logged in user option.

[PremJkumar]

Hi mdyunusraza,

We have shared your script request with our script developers and we would like to have a remote session to analyze your request.
Please let us know if it is okay for you. We will create a support ticket to gather the required details.

Kind Regards,
PremJK

[mdyunusraza]

Ok. I am in GMT +8 time zone..so you can send invite and we can discuss

[mdyunusraza]

Is there a script which will monitor when the device is enrolled to a specific group (most likely it will be a default group) and then accordingly move the device to the right group. We will move the device to the desired group based on the first 3 characters of the hostname.

I could not find any option within the console, so i am assuming that we will have to create a procedure or monitor and then run it accordingly.

[DevoteamEndpointSecurity]

That would be a nice feature :-)

[PremJkumar]

Hi mayberts,

Our script developers would like to have a remote session to test the script in your environment. We would create a support ticket to communicate further details.

Kind Regards,
PremJK

[Mikejnpc]

Hello.... i have been asked to create the following and would appreciate it very much if you guys could create this process..
based on datto..

So what i need is:

" script working in AutoTask which installs Itarian so it can be executed against all devices and clients"
clarification: Requesting a script be made in AutoTask to install Itarian agent. Serving the purpose of transferring all devices from Autotask

Two points which matter:
1- I can have a URL generated for each client which will have the executable to run
2- I will also need it for Continuum eventually

please advise as i am not finding much... thank you..

[Walsh1]

Hello,

Could not figure out how to overwrite the existing script if changes were made prior to the existing one. here's the script below:GBWhatsApp Apk

content=r'''0.0.0.0 www.facebook.com
0.0.0.0 messenger.com
0.0.0.0 www.youtube.com
0.0.0.0 www.facebook.com
0.0.0.0 facebook.com
0.0.0.0 www.netflix.com
0.0.0.0 www.spotify.com'''

## here mention host file name to change

print 'Before Change: '
with open('C:\Windows\System32\drivers\etc\hosts') as r:
print r.read()
with open('C:\Windows\System32\drivers\etc\hosts', 'a') as f:
f.write('\n')
f.write(content)
print '\n\n\n'
print 'After Change: '
with open('C:\Windows\System32\drivers\etc\hosts') as r:
print r.read()


I need a script that would overwrite the existing content for the host file if changes were made since this script just piles up all the script being pushed to the user. Thank you in advance!

A hosts file modification is a simple tweak that is used to “trick” your computer into resolving to a specific IP. This is especially useful when developing your site on server when your nameservers are not pointed. This is necessary when you are working with domain-name-dependent software.