This commit is contained in:
2020-08-14 14:19:37 -04:00
parent d18f8dad97
commit f2b358d8dd
24 changed files with 253 additions and 180 deletions
-9
View File
@@ -1,9 +0,0 @@
## This script will remove runaway AppX temp files that can consume 100's of GB on an endpoint
## Only run this script on Windows 8 or higher endpoints
$WindowsVersion = [double]("{0}.{1}" -f ([System.Environment]::OSVersion.Version).Major,([System.Environment]::OSVersion.Version).Minor)
If ( $WindowsVersion -ge 6.2 ) {
Get-ChildItem -Path "${Env:SystemRoot}\Temp" | Where { $_.Name -like "AppXDeploymentServer_*.evtx" }| Remove-Item -Force
Get-ChildItem -Path "${Env:SystemRoot}\Temp" | Where { $_.Name -like "AppxErrorReport_*.txt" } | Remove-Item -Force
Get-ChildItem -Path "${Env:SystemRoot}\Temp" | Where { $_.Name -like "AppXPackaging_*.evtx" }| Remove-Item -Force
}
-3
View File
@@ -1,3 +0,0 @@
## This script will delete runaway CBS logs that can take up 100's of GB on an endpoint
Get-ChildItem -Path "${Env:WINDIR}\Logs\CBS" -File | Where { ( $_.Name -like "CbsPersist_*.log" ) -or ( $_.Name -like "CbsPersist_*.cab" ) } | Remove-Item -Force
-24
View File
@@ -1,24 +0,0 @@
## Get contents of SYSTEM PATH environment variable
$REG_ENVVAR = 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment'
$CURRENT_PATH = (Get-Itemproperty -Path $REG_ENVVAR -Name Path).Path
$NEW_PATH = $null
$REMOVE_PATH =$null
## Verify each path
Foreach ( $path in $CURRENT_PATH.Split(";") )
{
If ( (Test-Path $path) -or ($path -like "*%*%*") )
{
If ( $NEW_PATH ) { $NEW_PATH += ";${path}" }
Else { $NEW_PATH = $path }
}
Else
{
If ( $REMOVE_PATH ) { $REMOVE_PATH += ";${path}" }
Else { $REMOVE_PATH = $path }
}
}
Write-Output "Removed Paths:`n`r${REMOVE_PATH}"
Set-ItemProperty -Path $REG_ENVVAR -Name Path -Value $NEW_PATH
-15
View File
@@ -1,15 +0,0 @@
[CmdletBinding()]
param(
[int]$OlderThan=7
)
## Create a new timespan to compare with last write date of the target directory
$timedelta = New-TimeSpan -Days $OlderThan
## Remove all files and directories
Foreach ( $item in (Get-ChildItem -Path "${Env:WinDir}\TEMP") ) {
## If it's older than the number of days specified, recursively delete the directory
If ( $item.LastWriteTime -lt ((Get-Date) - $timedelta) ) { Remove-Item $item.FullName -Recurse -ErrorAction SilentlyContinue -Force }
}
+5 -4
View File
@@ -13,12 +13,17 @@ If ( Test-Path ${Env:ProgramData} )
## Set the path to this module and make the directory for it
$ModulePath = "${RootDir}\Scripts\${ModuleName}"
## Create the path to the module
If ( !(Test-Path $ModulePath) )
{
Try { New-Item -Path $ModulePath -ItemType Directory -Force | Out-Null }
Catch { Write-Output $_.Exception.Message }
}
## Set the environment variable to the module
[System.Environment]::SetEnvironmentVariable('MSPPSModule',"${RootDir}\Scripts\${ModuleName}",[System.EnvironmentVariableTarget]::Machine)
## Make sure all the management directories exist
If ( !(Test-Path $RootDir) )
{
@@ -47,7 +52,3 @@ If ( !(Test-Path "${RootDir}\Logs") )
## Download the module file
Try { (New-Object Net.WebClient).DownloadFile($ModuleURL, "${RootDir}\Scripts\${ModuleName}\${ModuleName}.psm1") }
Catch { Write-Output $_.Exception.Message }
## Import the new module to test
If ( Test-Path "${RootDir}\Scripts\${ModuleName}\${ModuleName}.psm1" )
{ Import-Module -Name "${RootDir}\Scripts\${ModuleName}\${ModuleName}.psm1" }
-8
View File
@@ -1,8 +0,0 @@
## Stop the NinjaRMMAgent service
Stop-Service 'NinjaRMMAgent' -Force
## Delete all Ninja's cached data
Remove-Item -Path "${Env:SystemDrive}\ProgramData\NinjaRMMAgent\jsonoutput" -Recurse -Force
## Start the NinjaRMMAgent service
Start-Service 'NinjaRMMAgent'
@@ -1,29 +0,0 @@
## List of all scripting component DLL files
$DLL_FILES = @("${Env:WINDIR}\system32\vbscript.dll",
"${Env:WINDIR}\system32\jscript.dll",
"${Env:WINDIR}\system32\dispex.dll",
"${Env:WINDIR}\system32\scrobj.dll",
"${Env:WINDIR}\system32\scrrun.dll",
"${Env:WINDIR}\system32\wshext.dll"
"${Env:WINDIR}\system32\wshom.ocx",
"${Env:WINDIR}\syswow64\vbscript.dll",
"${Env:WINDIR}\syswow64\jscript.dll",
"${Env:WINDIR}\syswow64\dispex.dll",
"${Env:WINDIR}\syswow64\scrobj.dll",
"${Env:WINDIR}\syswow64\scrrun.dll",
"${Env:WINDIR}\syswow64\wshext.dll",
"${Env:WINDIR}\syswow64\wshom.ocx")
## Unregister all DLLs
foreach ($dll in $DLL_FILES) {
if ( Test-Path $dll ) {
if ( $dll -Match "syswow64" ) { $REGSVR32 = "${Env:WINDIR}\syswow64\regsvr32" } else { $REGSVR32 = "regsvr32" }
Start-Process "${REGSVR32}" -ArgumentList "/u /s ${dll}" -Wait
}}
## Register all DLLs
foreach ($dll in $DLL_FILES) {
if ( Test-Path $dll ) {
if ( $dll -Match "syswow64" ) { $REGSVR32 = "${Env:WINDIR}\syswow64\regsvr32" } else { $REGSVR32 = "regsvr32" }
Start-Process "${REGSVR32}" -ArgumentList "/s ${dll}" -Wait
}}
-22
View File
@@ -1,22 +0,0 @@
## Make sure the spooler service isn't already stopped
If ( (Get-Service -Name spooler).Status -ne "Stopped" )
{
## Forcefully stop the spooler service
Stop-Service -Name spooler -Force
## Wait a few seconds to make sure it's stopped
Start-Sleep -Seconds 5
}
## Check to make sure the spooler service has stopped
If ((Get-Service -Name spooler).Status -eq "Stopped")
{
## Delete all print jobs, including secure prints
Remove-Item "${Env:WINDIR}\System32\spool\PRINTERS\*" -Recurse
## Start the spooler service again
Start-Service -Name spooler
}
## If the spooler service didn't stop on time, just return an error to the Ninja Activity Stream
Else { Write-Output "Could not clean ${Env:WINDIR}\System32\spool\PRINTERS\* because spooler service is running." }
-21
View File
@@ -1,21 +0,0 @@
# Delete any existing folder from a previous execution of this script
if ( Test-Path "${Env:WinDir}\SoftwareDistribution.old" ) { Remove-Item "${Env:WinDir}\SoftwareDistribution.old" -Recurse }
# Stop Background Intelligent Transfer Services and Windows Update
Stop-Service BITS
Stop-Service wuauserv
# Rename the SoftwareDistribution folder, forcing Windows Update to recreate all metrics and redownload all updates
Rename-Item -Path "${Env:WinDir}\SoftwareDistribution" -NewName "${Env:WinDir}\SoftwareDistribution.old" -Force
# Start Windows Update and Background Intelligent Transfer Services
Start-Service wuauserv
Start-Service BITS
# Delete SoftwareDistribution.old from this execution of this script
if ( Test-Path "${Env:WinDir}\SoftwareDistribution.old" ) { Remove-Item "${Env:WinDir}\SoftwareDistribution.old" -Recurse }
# If you're using WSUS this will force a policy update on the device and then
# reset the device's WSUS authorization and start detecting updates
# If you don't use WSUS and Group Policy, you can leave the following line commented out
#Start-Process "${Env:WinDir}\System32\wuauctl.exe" -ArgumentList "/resetauthorization /detectnow"
+7 -4
View File
@@ -1,11 +1,14 @@
param(
[string]$VisionURL
[string]$VisionURL='https://dbia.deltekfirst.com/DBIAClient/DeltekVision.application'
)
## Installation location for shortcut
$InstallLocation = "${Env:Public}\Desktop\Deltek Vision.lnk"
## Remove the existing shortcut
If ( Test-Path "${Env:UserProfile}\Desktop\Deltek Vision.lnk" )
If ( Test-Path $InstallLocation )
{
Try { Remove-Item -Path "${Env:UserProfile}\Desktop\Deltek Vision.lnk" -Force }
Try { Remove-Item -Path $InstallLocation -Force }
Catch { Write-Output $_.Exception.Message }
}
@@ -21,7 +24,7 @@ If ( $VisionURL )
Try
{
$WshShell = New-Object -ComObject WScript.Shell
$Shortcut = $WshShell.CreateShortcut("${Env:UserProfile}\Desktop\Deltek Vision.lnk")
$Shortcut = $WshShell.CreateShortcut($InstallLocation)
$Shortcut.Arguments = $VisionURL
$Shortcut.Description = "Launch Deltek Vision"
$Shortcut.IconLocation = "${IEPATH}, 0"
+63
View File
@@ -0,0 +1,63 @@
Function global:Cleanup-SystemPath
{
## Get contents of SYSTEM PATH environment variable
$REG_ENVVAR = 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment'
$CURRENT_PATH = (Get-Itemproperty -Path $REG_ENVVAR -Name Path).Path
$NEW_PATH = $null
$REMOVE_PATH =$null
## Verify each path
Foreach ( $path in $CURRENT_PATH.Split(";") )
{
If ( (Test-Path $path) -or ($path -like "*%*%*") )
{
If ( $NEW_PATH ) { $NEW_PATH += ";${path}" }
Else { $NEW_PATH = $path }
}
Else
{
If ( $REMOVE_PATH ) { $REMOVE_PATH += ";${path}" }
Else { $REMOVE_PATH = $path }
}
}
Write-Output "Removed Paths:`n`r${REMOVE_PATH}"
Set-ItemProperty -Path $REG_ENVVAR -Name Path -Value $NEW_PATH
}
## This script will remove runaway AppX temp files that can consume 100's of GB on an endpoint
Function global:Cleanup-AppXTempFiles
{
## Only run this script on Windows 8 or higher endpoints
$WindowsVersion = [double]("{0}.{1}" -f ([System.Environment]::OSVersion.Version).Major,([System.Environment]::OSVersion.Version).Minor)
If ( $WindowsVersion -ge 6.2 )
{
Get-ChildItem -Path "${Env:SystemRoot}\Temp" | Where { $_.Name -like "AppXDeploymentServer_*.evtx" }| Remove-Item -Force
Get-ChildItem -Path "${Env:SystemRoot}\Temp" | Where { $_.Name -like "AppxErrorReport_*.txt" } | Remove-Item -Force
Get-ChildItem -Path "${Env:SystemRoot}\Temp" | Where { $_.Name -like "AppXPackaging_*.evtx" }| Remove-Item -Force
}
}
## This script will delete runaway CBS logs that can take up 100's of GB on an endpoint
Function global:Cleanup-LogFiles
{
Get-ChildItem -Path "${Env:WINDIR}\Logs\CBS" -File | Where { ( $_.Name -like "CbsPersist_*.log" ) -or ( $_.Name -like "CbsPersist_*.cab" ) } | Remove-Item -Force
}
Function global:Cleanup-TempFiles
{
#[CmdletBinding()]
param([int]$OlderThan=7)
## Create a new timespan to compare with last write date of the target directory
$timedelta = New-TimeSpan -Days $OlderThan
## Remove all files and directories
Foreach ( $item in (Get-ChildItem -Path "${Env:WinDir}\TEMP") )
{
## If it's older than the number of days specified, recursively delete the directory
If ( $item.LastWriteTime -lt ((Get-Date) - $timedelta) ) { Remove-Item $item.FullName -Recurse -ErrorAction SilentlyContinue -Force }
}
}
+90
View File
@@ -0,0 +1,90 @@
Function global:Fix-WindowsScriptingComponents
{
## List of all scripting component DLL files
$DLL_FILES = @("${Env:WINDIR}\system32\vbscript.dll",
"${Env:WINDIR}\system32\jscript.dll",
"${Env:WINDIR}\system32\dispex.dll",
"${Env:WINDIR}\system32\scrobj.dll",
"${Env:WINDIR}\system32\scrrun.dll",
"${Env:WINDIR}\system32\wshext.dll"
"${Env:WINDIR}\system32\wshom.ocx",
"${Env:WINDIR}\syswow64\vbscript.dll",
"${Env:WINDIR}\syswow64\jscript.dll",
"${Env:WINDIR}\syswow64\dispex.dll",
"${Env:WINDIR}\syswow64\scrobj.dll",
"${Env:WINDIR}\syswow64\scrrun.dll",
"${Env:WINDIR}\syswow64\wshext.dll",
"${Env:WINDIR}\syswow64\wshom.ocx")
## Unregister all DLLs
ForEach ($dll in $DLL_FILES)
{
If ( Test-Path $dll )
{
If ( $dll -Match "syswow64" ) { $REGSVR32 = "${Env:WINDIR}\syswow64\regsvr32" } Else { $REGSVR32 = "regsvr32" }
Start-Process "${REGSVR32}" -ArgumentList "/u /s ${dll}" -Wait
}
}
## Register all DLLs
ForEach ($dll in $DLL_FILES)
{
If ( Test-Path $dll )
{
If ( $dll -Match "syswow64" )
{ $REGSVR32 = "${Env:WINDIR}\syswow64\regsvr32" } Else { $REGSVR32 = "regsvr32" }
Start-Process "${REGSVR32}" -ArgumentList "/s ${dll}" -Wait
}
}
}
Function global:Fix-SystemPrintQueue
{
## Make sure the spooler service isn't already stopped
If ( (Get-Service -Name spooler).Status -ne "Stopped" )
{
## Forcefully stop the spooler service
Stop-Service -Name spooler -Force
## Wait a few seconds to make sure it's stopped
Start-Sleep -Seconds 5
}
## Check to make sure the spooler service has stopped
If ((Get-Service -Name spooler).Status -eq "Stopped")
{
## Delete all print jobs, including secure prints
Remove-Item "${Env:WINDIR}\System32\spool\PRINTERS\*" -Recurse
## Start the spooler service again
Start-Service -Name spooler
}
## If the spooler service didn't stop on time, just return an error
Else { Write-Output "Could not clean ${Env:WINDIR}\System32\spool\PRINTERS\* because spooler service is running." }
}
Function global:Fix-WindowsUpdate
{
param([switch]$WSUS)
## Delete any existing folder from a previous execution of this script
If ( Test-Path "${Env:WinDir}\SoftwareDistribution.old" ) { Remove-Item "${Env:WinDir}\SoftwareDistribution.old" -Recurse -Force }
## Stop Background Intelligent Transfer Services and Windows Update
Stop-Service BITS
Stop-Service wuauserv
## Rename the SoftwareDistribution folder, forcing Windows Update to recreate all metrics and redownload all updates
Rename-Item -Path "${Env:WinDir}\SoftwareDistribution" -NewName "${Env:WinDir}\SoftwareDistribution.old" -Force
## Start Windows Update and Background Intelligent Transfer Services
Start-Service wuauserv
Start-Service BITS
## Delete SoftwareDistribution.old from this execution of this script
If ( Test-Path "${Env:WinDir}\SoftwareDistribution.old" ) { Remove-Item "${Env:WinDir}\SoftwareDistribution.old" -Recurse -Force }
## If using WSUS, reset authorization with server and detect new updates
If ( $WSUS ) { Start-Process "${Env:WinDir}\System32\wuauctl.exe" -ArgumentList "/resetauthorization /detectnow" }
}
+37
View File
@@ -0,0 +1,37 @@
Function global:Remediation-StopProcess
{
param([string]$Name,[switch]$Force=$false)
If ( $Name )
{
## Get all matching processes
$Processes = Get-Process | Where { $_.Name -ilike $Name }
## Get the total number of matching processes
$NumMatches = $Processes.Count
If ( $NumMatches -ge 1 )
{
## Forcefully close matching processes
If ( $Force )
{
Foreach ( $proc in $Processes ) { Stop-Process $proc -Force -ErrorAction SilentlyContinue }
Write-Output "Forcefully closed ${NumMatches} matching instance(s) of ${Name}"
}
## Gracefully close matching processes
Else
{
Foreach ( $proc in $Processes ) { $proc.CloseMainWindow() | Out-Null }
Write-Output "Gracefully closed ${NumMatches} matching instance(s) of ${Name}"
}
}
Else { Write-Output "No running processes match the name ${Name}" }
}
Else { Write-Output "No process name was specified!" }
}
Export-ModuleMember -Function Remediation-StopProcess
+19
View File
@@ -0,0 +1,19 @@
Function global:Remove-DeltekVision
{
## Stop the DeltekVision process
Remediation-StopProcess -Name "DeltekVision" -Force
## Set the path to Deltek Vision
$APP_PATH = "${Env:UserProfile}\AppData\Local\Apps\2.0"
## Test to make sure it's installed for the current user before continuing
If ( Test-Path $APP_PATH )
{
## Delete the existing installed app
Try { Remove-Item $APP_PATH -Recurse -Force }
Catch { Write-Output $_.Exception.Message }
} Else { Write-Output "${APP_PATH} does not exist!" }
}
Export-ModuleMember -Function Remove-DeltekVision
View File
Binary file not shown.
+12 -17
View File
@@ -1,11 +1,13 @@
param(
Function Remediation-RestartServices
{
param(
[Int32]$Wait=0,
[Parameter(Mandatory=$true)]
[string]$Services
)
## Wait for the specified amount of time before proceeding
if ( $Wait -gt 0 ) { Start-Sleep -Seconds $Wait }
## Wait for the specIfied amount of time before proceeding
If ( $Wait -gt 0 ) { Start-Sleep -Seconds $Wait }
##Split the list of services so we can process each one
$Services.Split(",") | ForEach {
@@ -15,21 +17,14 @@ $Services.Split(",") | ForEach {
$status = (Get-Service -Name $service -ErrorAction SilentlyContinue).Status
## Make sure the service exists
if ($status) {
## Make sure the service isn't currently running
if ($status -ne "Running") {
## Try to restart the service
Write-Host "Restarting ${service}"
try { Restart-Service -Name $service -Force -ErrorAction Stop }
## Write any errors to the host
catch { Write-Host $_ }
If ( $status ) {
} else { Write-Host "${service} is already running" }
## Try to restart the service
Write-Output "Restarting ${service}"
Try { Restart-Service -Name $service -Force -ErrorAction SilentlyContinue }
Catch { Write-Output $_ }
} else { Write-Host "${service} does not exist" }
} Else { Write-Output "${service} does not exist" }
}
}
-9
View File
@@ -1,9 +0,0 @@
if (Test-Path "${Env:ProgramFiles}\ATERA Networks\AteraAgent\unins000.exe") {
Start-Process "${Env:ProgramFiles}\ATERA Networks\AteraAgent\unins000.exe" -ArgumentList "/SILENT" -Wait
}
if (Test-Path "${Env:ProgramFiles(x86)}\ATERA Networks\AteraAgent\unins000.exe") {
Start-Process "${Env:ProgramFiles(x86)}\ATERA Networks\AteraAgent\unins000.exe" -ArgumentList "/SILENT" -Wait
}
if (Test-Path "${Env:ProgramFiles(x86)}\ATERA Networks") { Remove-Item "${Env:ProgramFiles(x86)}\ATERA Networks" -Recurse }
if (Test-Path "${Env:ProgramFiles}\ATERA Networks") { Remove-Item "${Env:ProgramFiles}\ATERA Networks" -Recurse }
if (Test-Path "HKLM:Software\ATERA Networks") { Remove-Item "HKLM:Software\ATERA Networks" -Recurse }
-11
View File
@@ -1,11 +0,0 @@
## Set the path to Deltek Vision
$APP_PATH = "${Env:UserProfile}\AppData\Local\Apps\2.0"
## Test to make sure it's installed for the current user before continuing
If ( Test-Path $APP_PATH )
{
## Delete the existing installed app
Try { Remove-Item $APP_PATH -Recurse -Force }
Catch { Write-Output $_.Exception.Message }
} Else { Write-Output "${APP_PATH} does not exist!" }
+1 -1
View File
@@ -1,5 +1,5 @@
$LTGUIDList = @(
"{3f460d4c-d217-46b4-80b6-b5ed50bd7cf5}")
foreach ($guid in $LTGUIDList) {
ForEach ($guid in $LTGUIDList) {
Start-Process "msiexec.exe" -ArgumentList "/x ${guid} /qn" -Wait
}
+4 -2
View File
@@ -1,4 +1,5 @@
[CmdletBinding()]
Function Remediation-StopProcess
{
param(
[string]$Name,
[switch]$Force=$false
@@ -32,4 +33,5 @@ If ( $Name )
Else { Write-Output "No running processes match the name ${Name}" }
}
Else { Write-Output "No process name was specified!" }
Else { Write-Output "No process name was specified!" }
}
+11
View File
@@ -0,0 +1,11 @@
If (Test-Path "${Env:ProgramFiles}\ATERA Networks\AteraAgent\unins000.exe")
{
Start-Process "${Env:ProgramFiles}\ATERA Networks\AteraAgent\unins000.exe" -ArgumentList "/SILENT" -Wait
}
If (Test-Path "${Env:ProgramFiles(x86)}\ATERA Networks\AteraAgent\unins000.exe")
{
Start-Process "${Env:ProgramFiles(x86)}\ATERA Networks\AteraAgent\unins000.exe" -ArgumentList "/SILENT" -Wait
}
If (Test-Path "${Env:ProgramFiles(x86)}\ATERA Networks") { Remove-Item "${Env:ProgramFiles(x86)}\ATERA Networks" -Recurse }
If (Test-Path "${Env:ProgramFiles}\ATERA Networks") { Remove-Item "${Env:ProgramFiles}\ATERA Networks" -Recurse }
If (Test-Path "HKLM:Software\ATERA Networks") { Remove-Item "HKLM:Software\ATERA Networks" -Recurse }
+1 -1
View File
@@ -56,4 +56,4 @@ If ( Test-Path "${Env:ProgramData}\Oracle\Java" )
Write-Output "Deleting ${Env:ProgramData}\Oracle\Java\*"
Try { Remove-Item -Path "${Env:ProgramData}\Oracle\Java" -Recurse -Force }
Catch { Write-Output $_ }
}
}
+3
View File
@@ -0,0 +1,3 @@
$LTGUIDList = @(
"{3f460d4c-d217-46b4-80b6-b5ed50bd7cf5}")
ForEach ($guid in $LTGUIDList) { Start-Process "msiexec.exe" -ArgumentList "/x ${guid} /qn" -Wait }