This script has been compiled using information from the following Microsoft sources:

• CVE-2022-41099: Security Update Guide
• Add an update package to Windows RE

Creating Fields​

We're adding one role custom field for devices with the Windows Desktop or Laptop and Windows Server roles, note that we've customised slightly the autogenerated machine name here, if you use the default adjust the field name in the script appropriately.

The Script​

loading...

The Results​

We run this script daily and have a corresponding monitor setup to check CVE fields with a value of "Yes" and alert us if any are found. You'll find information on remediating this vulnerability in this followup post.

This script has been compiled using information from the following Microsoft sources:

• Release notes for Microsoft Office security updates
• Update history for Microsoft 365 Apps (by date)
• Update history for Office Beta Channel

This has only been tested against M365 Apps and Office 2021 VL versions "en masse" and only 64-bit office - if it doesn't work for you let me know on the NinjaOne Users Discord and I'll see what I can do to fix it!

Creating Fields​

We're adding one role custom field for devices with the Windows Desktop or Laptop role, note that we've customised slightly the autogenerated machine name here, if you use the default adjust the field name in the script appropriately.

The Script​

loading...

The Results​

We run this script daily and have a corresponding monitor setup to check CVE fields with a value of "Yes" and alert us if any are found. To remediate this vulnerability update Microsoft Office by running something like this:

loading...

This update script will force restart Office apps - it should restore open files automatically but if you want a softer approach replace the Start-Process line with:

Start-Process -FilePath $C2RPath -ArgumentList '/update user forceappshutdown=true updatepromptuser=true' -Wait

Prejay on the MSPGeek Discord has helpfully suggested the following to update C2R Office builds without a user logged in or as system:

Start-Process -FilePath $C2RPath -ArgumentList '/frequentupdate SCHEDULEDTASK displaylevel=false' -Wait

Mark Hodges (also on the MSPGeek Discord) has also helpfully suggested this more comprehensive update script which will update Office 2016 and 2019 as well as C2R Office.

This script has been compiled using information from the following Microsoft sources:

• CVE-2023-21554: Security Update Guide

Creating Fields​

We're adding one role custom field for devices with the Windows Desktop or Laptop role, note that we've customised slightly the autogenerated machine name here, if you use the default adjust the field name in the script appropriately.

The Script​

loading...

The Results​

We run this script daily and have a corresponding monitor setup to check CVE fields with a value of "Yes" and alert us if any are found. To remediate install the April 2023 Security Update.

This script takes a few parameters to create a Notification App. The App Name and Icon are the most important as these are what will appear in the toast notification.

Parameter documentation follows:

The Script​

loading...

Generic Example​

# Setup parameter hashtable.
$NotificationAppParams = @{
  IconURI = 'https://homotechsual.dev/img/Icon.png'
  IconFileName = 'homotechsual.png'
  WorkingDirectory = 'C:\RMM\NotificationApp'
  AppId = 'homotechsual.example'
  AppDisplayName = 'Homotechsual Example'
  AppIconBackgroundColor = 0
  ShowInSettings = 1
}
Register-NotificationApp @NotificationAppParams

RMM Example​

Unsurprisingly, I'm going to use NinjaOne as the example RMM here. So I've done the donkeywork that is best documented by NinjaOne themselves on the Dojo and added the script above to the NinjaOne Script Library - but what next?

Option 1: Same App for All Customers​

Well the chances are that you want to use the same relatively small set of apps per customer so we'll just store a nice blob of text in the Ninja Script Library.

We could end up with a "Preset Parameter" set like this:

-IconURI https://homotechsual.dev/img/Icon.png -IconFileName homotechsual.png -WorkingDirectory C:\RMM\NotificationApp -AppId homotechsual.example -AppDisplayName "Homotechsual Example" -AppIconBackgroundColor 0 -ShowInSettings 1

You can have multiple preset parameter sets and simply select the one you want to use when you run the script or when you schedule it against a group (or however you want to run this) but what about getting more creative?

Option 2: Pull App Details per Customer​

We can use Documentation fields to store the details of the app per client and then use the NinjaOne CLI to pull the details when we run the script. This is a little more work but it's worth it if you want to brand your notifications per customer.

We'll need to add a few fields to the NinjaOne Documentation tab for each client:

We can then use the NinjaOne CLI to pull the details for the client we're running the script against and use them to create the parameter set for the script.

This means editing our script a little to accept the parameters from the CLI and then using the NinjaOne CLI to pull the details from the Documentation tab. We're going to assume you called your Document Template Example Template and your fields named as above in the table (with spaces between words if you wish).

At the top of the script we're going to replace the entire parameter block:

[CmdletBinding()]
Param(
    # The URI of the app icon to use for the notification app registration.
    [Parameter(Mandatory)]
    [uri]$IconURI,
    # File name to use for the app icon. Optional. If not specified, the file name from the URI will be used.
    [string]$IconFileName,
    # The working directory to use for the app icon. If not specified, 'C:\RMM\NotificationApp\' will be used.
    [System.IO.DirectoryInfo]$WorkingDirectory = 'C:\RMM\NotificationApp\',
    # The app ID to use for the notification app registration. Expected format is something like: 'CompanyName.AppName'.
    [Parameter(Mandatory)]
    [string]$AppId,
    # The app display name to use for the notification app registration.
    [Parameter(Mandatory)]
    [string]$AppDisplayName,
    # The background color to use for the app icon. Optional. If not specified, the background color will be transparent. Expected format is a hex value like 'FF000000' or '0' for transparent.
    [ValidatePattern('^(0)$|^([A-F0-9]{8})$')]
    [string]$AppIconBackgroundColor = 0,
    # Whether or not to show the app in the Windows Settings app. Optional. If not specified, the app will not be shown in the Settings app. Expected values are 0 or 1 (0 = false, 1 = true).
    [int]$ShowInSettings = 0
)

$IconURI = Ninja-Docs-Property-Get "Example Template" "NotificationIconURI"
$IconFileName = 'NotificationIcon.png'
$WorkingDirectory = 'C:\RMM\NotificationApp\'
$AppId = Ninja-Docs-Property-Get "Example Template" "NotificationAppId"
$AppDisplayName = Ninja-Docs-Property-Get "Example Template" "NotificationAppDisplayName"
$AppIconBackgroundColor = Ninja-Docs-Property-Get "Example Template" "NotificationAppBackgroundColor"
$ShowInSettings = 1

if (($null -eq $IconURI) -or ($null -eq $AppId) -or ($null -eq $AppDisplayName)) {
    Write-Error "Required fields are not populated in the Documentation tab."
    exit
}

So this is an entirely separate script - you can use it with the custom app you just created or you can use it with the default where notifications come from Windows PowerShell. It's up to you.

This script takes a few parameters to create a Notification App. The App Name and Icon are the most important as these are what will appear in the toast notification.

Parameter documentation follows:

The Script​

loading...

Generic Example​

# Setup parameter hashtable.
$NotificationParams = @{
  AppId = 'homotechsual.example'
  NotificationImage = 'C:\RMM\NotificationApp\NotificationIcon.png'
  NotificationTitle = 'Example Notification'
  NotificationMessage = 'This is an example notification.'
  NotificationType = 'reminder'
}
Send-Notification @NotificationParams

Script Example​

It's probably most useful to use this script as part of a larger script. For example, you could use it to send a notification when a script has finished running. You could also use it to send a notification when a scheduled task has finished running.

loading...

This would output something like this:

Creating Fields​

We're adding seven role custom fields for devices with the Windows Laptop role:

The Script​

This script accepts a single parameter to set the data storage directory for the script. This is where the script will store the battery information it gathers. The script will create the directory if it doesn't exist. The default is C:\RMM\Data use parameter -OutputPath to override.

loading...

Source: https://www.cyberdrain.com/monitoring-with-powershell-monitoring-battery-health/

The Results​

You can set this up to run on a schedule - we run this script monthly to keep up-to-date battery information in NinjaOne.

Creating Fields​

We're adding three role custom fields for devices with the Windows Laptop role:

The domain join status field should be configured with the following option values:

• Azure AD Domain
• AD Domain
• Hybrid Azure AD/AD Domain
• On-premise DRS
• No Domain

Options​

We've created a dropdown field for this script, we can't set the options by name with these - so first we need to find out how NinjaOne wants us to give the selected option. To do that we're going to open a PowerShell session to any device in the role that has the field assigned and run:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned
Import-Module NJCliPSh
Ninja-Property-Options domainJoinStatus

This will print a list that looks something like this:

1989092a-1ae0-4e6e-b274-50ea9618d436=Azure AD Domain
53745d33-fd5e-4c7d-bfd5-fea174a46781=No Domain
bb4c5215-ead7-47a3-8f36-f711c81580ce=On-premises DRS
c23486e9-49eb-4acb-8f9d-7f5d8711c284=AD Domain
c6e7ef80-68a1-4591-8055-5cee585f4f79=Hybrid Azure AD/AD Domain

When we want to pass the option to the field we need to use the GUID - for example 1989092a-1ae0-4e6e-b274-50ea9618d436 for Azure AD Domain.

The Script​

### Inline Comments

'<MARKED STRINGS>'

loading...

The Results​

You can set this up to run on a schedule - we run this script monthly to keep up-to-date domain information in NinjaOne.

Creating Fields​

We're adding one role custom field for devices with the Windows Desktops and Laptops role:

The Script​

loading...

The Results​

We run this after hardware changes or post onboarding.

Creating Fields​

We're adding three role custom fields for devices with the Windows Desktops and Laptops role:

The Script​

loading...

The Results​

You can set this up to run on a schedule - we run this script twice daily.

Creating Fields​

We're adding three role custom fields for devices with the Windows Desktops and Laptops role:

The Script​

loading...

Source: https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/understanding-readiness-for-windows-11-with-microsoft-endpoint/ba-p/2770866

Thanks to @gavsto for invaluable input on a couple of the checks in here - he's helped make them more robust and accurate.

The Results​

We ran this as a one-off job to evaluate our managed estate.

Limitations​

This script won't detect compatible devices if the TPM is not enabled in the BIOS. It may not detect all compatible devices.

Creating Fields​

We're adding two role custom fields for devices with the Windows Desktops and Laptops and the Windows Server role:

The Script​

loading...

The Results​

We run this on a schedule so it runs just after our OS patching applies.

Limitations​

Won't work with Insider/Preview versions - hasn't been tested on Windows 7 / 8 or 8.1. Has been tested on Server 2012 R2, 2022 and Windows 10 and 11.

Creating Fields​

We're adding three role custom fields for devices with the Windows Desktops and Laptops and the Windows Server role:

The Script​

loading...

Parameters​

You can pass a few different parameters to this script to tune it's behaviour. These are:

For documentation on the CLI switches available see the LibreSpeed CLI documentation.

The Results​

In this screenshot we've added a separator and a nice custom title with an emoji to make it look a bit nicer.

⏱️SPEEDTEST

We run this on demand when we want to refresh information on the device - we don't run it on a schedule at present.

Limitations​

Requires the ability to run the LibreSpeed CLI tool on the device. The script can fetch the latest version and will do so automatically.

Creating Fields​

We're adding three role custom fields for devices with the Windows Desktops and Laptops and the Windows Server role:

The Script​

loading...

Parameters​

You can pass a few different parameters to this script to tune it's behaviour. These are:

For documentation on the CLI switches available you should download the latest version of the CLI and check out the speedtest.md file in the Zip or run speedtest.exe --help.

The Results​

In this screenshot we've added a separator and a nice custom title with an emoji to make it look a bit nicer.

⏱️SPEEDTEST

We run this on demand when we want to refresh information on the device - we don't run it on a schedule at present.

Limitations​

Requires the ability to run the Ookla Speedtest CLI tool on the device. The script cannot automatically determine the latest version at this time - please pass an updated URL if you wish to use a later version before the script is updated.