10 posts tagged with "NinjaOne"

• The entire NinjaOne community on the NinjaOne Discord for the inspiration and support.
• David Szpunar for his efforts on various M365 / Office apps scripts.
• Kelvin Tegelaar for his prior M365 / Office apps scripts.

This script has been compiled using information from the following Microsoft sources:

• CVE-2022-41099: Security Update Guide
• Add an update package to Windows RE

Creating Fields​

We're adding one role custom field for devices with the Windows Desktop or Laptop and Windows Server roles, note that we've customised slightly the autogenerated machine name here, if you use the default adjust the field name in the script appropriately.

The Script​

loading...

The Results​

We run this script daily and have a corresponding monitor setup to check CVE fields with a value of "Yes" and alert us if any are found. You'll find information on remediating this vulnerability in this followup post.

This script has been compiled using information from the following Microsoft sources:

• Release notes for Microsoft Office security updates
• Update history for Microsoft 365 Apps (by date)
• Update history for Office Beta Channel

This has only been tested against M365 Apps and Office 2021 VL versions "en masse" and only 64-bit office - if it doesn't work for you let me know on the NinjaOne Users Discord and I'll see what I can do to fix it!

Creating Fields​

We're adding one role custom field for devices with the Windows Desktop or Laptop role, note that we've customised slightly the autogenerated machine name here, if you use the default adjust the field name in the script appropriately.

The Script​

loading...

The Results​

We run this script daily and have a corresponding monitor setup to check CVE fields with a value of "Yes" and alert us if any are found. To remediate this vulnerability update Microsoft Office by running something like this:

loading...

This update script will force restart Office apps - it should restore open files automatically but if you want a softer approach replace the Start-Process line with:

Start-Process -FilePath $C2RPath -ArgumentList '/update user forceappshutdown=true updatepromptuser=true' -Wait

Prejay on the MSPGeek Discord has helpfully suggested the following to update C2R Office builds without a user logged in or as system:

Start-Process -FilePath $C2RPath -ArgumentList '/frequentupdate SCHEDULEDTASK displaylevel=false' -Wait

Mark Hodges (also on the MSPGeek Discord) has also helpfully suggested this more comprehensive update script which will update Office 2016 and 2019 as well as C2R Office.

This script has been compiled using information from the following Microsoft sources:

• CVE-2023-21554: Security Update Guide

Creating Fields​

We're adding one role custom field for devices with the Windows Desktop or Laptop role, note that we've customised slightly the autogenerated machine name here, if you use the default adjust the field name in the script appropriately.

The Script​

loading...

The Results​

We run this script daily and have a corresponding monitor setup to check CVE fields with a value of "Yes" and alert us if any are found. To remediate install the April 2023 Security Update.

This script has been compiled using information from the following Microsoft sources:

• CVE-2023-35628: Security Update Guide

Creating Fields​

We're adding one role custom field for devices with the Windows Desktop or Laptop and/or Windows Server role, note that we've customised slightly the autogenerated machine name here, if you use the default adjust the field name in the script appropriately.

Thanks to Gavsto for stopping me doing down the rabbit hole of checking KB numbers by pointing out that it wouldn't be future proof once the next cumulative update was released!

The Script​

loading...

The Results​

We run this script daily and have a corresponding monitor setup to check CVE fields with a value of "Yes" and alert us if any are found. To remediate install the December 2023 Cumulative Update.

This script has been compiled using information from the following Microsoft sources:

• CVE-2024-21413: Security Update Guide

The updates include changes/corrections to the targetted versions - check your version please!

Creating Fields​

We're adding one role custom field for devices with the Windows Desktop or Laptop and/or Windows Server role, note that we've customised slightly the autogenerated machine name here, if you use the default adjust the field name in the script appropriately.

The Script​

loading...

The Results​

We run this script daily and have a corresponding monitor setup to check CVE fields with a value of "Yes" and alert us if any are found. To remediate install the applicable Office / M365 Apps February 2024 Security Update.

This script has been compiled using information from the following Microsoft sources:

• CVE-2024-30103: Security Update Guide

This script also uses information from the following non-Microsoft sources:

• Morphisec: CVE-2024-30103 Microsoft Outlook Vulnerability

Creating Fields​

We're adding one role custom field for devices with the Windows Desktop or Laptop and/or Windows Server role, note that we've customised slightly the autogenerated machine name here, if you use the default adjust the field name in the script appropriately.

The Script​

loading...

The Results​

We run this script daily and have a corresponding monitor setup to check CVE fields with a value of "Yes" and alert us if any are found. To remediate install the applicable Office / M365 Apps June 2024 Security Update.

Creating Fields​

We're adding seven role custom fields for devices with the Windows Laptop role:

The Script​

This script accepts a single parameter to set the data storage directory for the script. This is where the script will store the battery information it gathers. The script will create the directory if it doesn't exist. The default is C:\RMM\Data use parameter -OutputPath to override.

loading...

Source: https://www.cyberdrain.com/monitoring-with-powershell-monitoring-battery-health/

The Results​

You can set this up to run on a schedule - we run this script monthly to keep up-to-date battery information in NinjaOne.

Creating Fields​

We're adding three role custom fields for devices with the Windows Laptop role:

The domain join status field should be configured with the following option values:

• Azure AD Domain
• AD Domain
• Hybrid Azure AD/AD Domain
• On-premise DRS
• No Domain

Options​

We've created a dropdown field for this script, we can't set the options by name with these - so first we need to find out how NinjaOne wants us to give the selected option. To do that we're going to open a PowerShell session to any device in the role that has the field assigned and run:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned
Import-Module NJCliPSh
Ninja-Property-Options domainJoinStatus

This will print a list that looks something like this:

1989092a-1ae0-4e6e-b274-50ea9618d436=Azure AD Domain
53745d33-fd5e-4c7d-bfd5-fea174a46781=No Domain
bb4c5215-ead7-47a3-8f36-f711c81580ce=On-premises DRS
c23486e9-49eb-4acb-8f9d-7f5d8711c284=AD Domain
c6e7ef80-68a1-4591-8055-5cee585f4f79=Hybrid Azure AD/AD Domain

When we want to pass the option to the field we need to use the GUID - for example 1989092a-1ae0-4e6e-b274-50ea9618d436 for Azure AD Domain.

The Script​

### Inline Comments

'<MARKED STRINGS>'

loading...

The Results​

You can set this up to run on a schedule - we run this script monthly to keep up-to-date domain information in NinjaOne.

Creating Fields​

We're adding one role custom field for devices with the Windows Desktops and Laptops role:

The Script​

loading...

The Results​

We run this after hardware changes or post onboarding.

Creating Fields​

We're adding three role custom fields for devices with the Windows Desktops and Laptops role:

The Script​

loading...

The Results​

You can set this up to run on a schedule - we run this script twice daily.

Creating Fields​

We're adding two role custom fields for devices with the Windows Desktops and Laptops role:

The Script​

loading...

Source: https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/understanding-readiness-for-windows-11-with-microsoft-endpoint/ba-p/2770866

Thanks to @gavsto for invaluable input on a couple of the checks in here - he's helped make them more robust and accurate.

The script's detailed output has changed and will now show two metrics related to Secure Boot. Previously it showed in SecureBootSuitable whether the state of Secure Boot was suitable for Windows 11 installation. This has been enhanced with a new SecureBootPossible metric which will show whether it's likely that Secure Boot can be enabled. A "No" to both metrics will indicate that Secure Boot is not enabled or not capable of being enabled and thus the device is not Windows 11 capable. A "Yes" to SecureBootPossible indicates that Secure Boot can likely be enabled and that this should be done to make the device Windows 11 capable.

The Results​

We ran this as a one-off job to evaluate our managed estate.

Limitations​

This script won't detect compatible devices if the TPM is not enabled in the BIOS. It may not detect all compatible devices. This script may not accurately detect Secure Boot capability on all devices.

Creating Fields​

We're adding two role custom fields for devices with the Windows Desktops and Laptops and the Windows Server role:

The Script​

loading...

The Results​

We run this on a schedule so it runs just after our OS patching applies.

Limitations​

Won't work with Insider/Preview versions - hasn't been tested on Windows 7 / 8 or 8.1. Has been tested on Server 2012 R2, 2022 and Windows 10 and 11.

Creating Fields​

We're adding three role custom fields for devices with the Windows Desktops and Laptops and the Windows Server role:

The Script​

loading...

Parameters​

You can pass a few different parameters to this script to tune it's behaviour. These are:

For documentation on the CLI switches available see the LibreSpeed CLI documentation.

The Results​

In this screenshot we've added a separator and a nice custom title with an emoji to make it look a bit nicer.

⏱️SPEEDTEST

We run this on demand when we want to refresh information on the device - we don't run it on a schedule at present.

Limitations​

Requires the ability to run the LibreSpeed CLI tool on the device. The script can fetch the latest version and will do so automatically.

Creating Fields​

We're adding three role custom fields for devices with the Windows Desktops and Laptops and the Windows Server role:

The Script​

loading...

Parameters​

You can pass a few different parameters to this script to tune it's behaviour. These are:

For documentation on the CLI switches available you should download the latest version of the CLI and check out the speedtest.md file in the Zip or run speedtest.exe --help.

The Results​

In this screenshot we've added a separator and a nice custom title with an emoji to make it look a bit nicer.

⏱️SPEEDTEST

We run this on demand when we want to refresh information on the device - we don't run it on a schedule at present.

Limitations​

Requires the ability to run the Ookla Speedtest CLI tool on the device. The script cannot automatically determine the latest version at this time - please pass an updated URL if you wish to use a later version before the script is updated.