diff --git a/scripts/1password_install.level.yaml b/scripts/1password_install.level.yaml new file mode 100644 index 0000000..5cff3cb --- /dev/null +++ b/scripts/1password_install.level.yaml @@ -0,0 +1,30 @@ +name: "1password_install.ps1" +description: Downloads and silently installs 1Password using official MSI +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and silently installs the latest version of 1Password for Windows using the official MSI installer with configurable deployment options. + + Usage Notes + ----------- + - Validates input parameters before proceeding + - Downloads 1Password MSI installer to temp directory + - Builds MSI arguments based on deployment options and installs silently using msiexec + - Cleans up installer file after completion + - Download URL: https://downloads.1password.com/win/1PasswordSetup-latest.msi + - Prevent Restart: true + - Manage Updates: false + - Remove Other Installs: true + + Requirements + ------------ + - Windows PowerShell 5.1 or later + - Administrator privileges + - Internet connectivity +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDIzMA +lastPushedChecksum: "sha256:4c5b17905ada8b19" +lastPushedMetaChecksum: "sha256:4cc2972b4f25ddeb" \ No newline at end of file diff --git a/scripts/agent_startup_fix.level.yaml b/scripts/agent_startup_fix.level.yaml new file mode 100644 index 0000000..fbbfa6f --- /dev/null +++ b/scripts/agent_startup_fix.level.yaml @@ -0,0 +1,31 @@ +name: agent_startup_fix.ps1 +description: Fixes RMM agent service startup with recovery options and delayed start +shell: POWERSHELL +runAs: SYSTEM +timeout: 300 +readme: | + Purpose + ------- + Configures the RMM agent service with proper recovery options and delayed automatic start to prevent startup failures on slow or overloaded machines where services timeout during boot. + + Usage Notes + ----------- + - Locates the RMM agent service by name + - Reports current service status and startup type + - Sets service recovery options (restart on failure) + - Sets service to Automatic (Delayed Start) via registry + - Reports recent crash events from Event Viewer for diagnosis + - Default service name is "limehawk"; change $ServiceName for other RMM agents + - Recovery: restart after 60s, 60s, then 120s; reset failure count every 24 hours + - Uses registry for delayed start (compatible with Server 2019 PowerShell which lacks AutomaticDelayedStart enum) + - Event log lookback defaults to 3 days + + Requirements + ------------ + - Windows OS + - Administrator privileges + - RMM agent installed +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDIzMQ +lastPushedChecksum: "sha256:5c55fbd2b948f152" +lastPushedMetaChecksum: "sha256:c4a125f9dc0cfecf" \ No newline at end of file diff --git a/scripts/antivirus_status.level.yaml b/scripts/antivirus_status.level.yaml new file mode 100644 index 0000000..f9335ba --- /dev/null +++ b/scripts/antivirus_status.level.yaml @@ -0,0 +1,30 @@ +name: antivirus_status.ps1 +description: Reports third-party antivirus status to SuperOps custom fields +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Checks for the presence and active status of third-party antivirus software on the system, excluding Windows/Microsoft Defender. Reports the active product name and boolean state to SuperOps custom fields for monitoring. + + Usage Notes + ----------- + - Validates that SuperOps module is available + - Detects OS type (client vs server) + - Queries installed AV products via SecurityCenter2 or registry fallback + - Checks enabled state via productState bitmask + - Ignores Windows Defender entries; only reports third-party AV + - Outputs AV name and enabled state (TRUE/FALSE) to SuperOps custom fields + - Confirms Windows Defender status in console output + - No configurable settings; all logic is fixed for third-party AV detection + + Requirements + ------------ + - PowerShell 5.1 or later + - Access to root\SecurityCenter2 namespace (requires local admin or equivalent) + - SuperOps module available via $SuperOpsModule variable (provided by RMM) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDIzMg +lastPushedChecksum: "sha256:1a20a2caeb5024b5" +lastPushedMetaChecksum: "sha256:6d2043db6f0128b0" \ No newline at end of file diff --git a/scripts/antivirus_uninstall.level.yaml b/scripts/antivirus_uninstall.level.yaml new file mode 100644 index 0000000..42a4d5b --- /dev/null +++ b/scripts/antivirus_uninstall.level.yaml @@ -0,0 +1,35 @@ +name: antivirus_uninstall.ps1 +description: Removes common third-party antivirus software (McAfee, Sophos, AVG, etc.) +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Detects and uninstalls common third-party antivirus software from Windows systems including McAfee, Sophos, AVG, and Microsoft Security Essentials. Designed for scenarios where existing AV must be removed before deploying a new endpoint protection solution. + + Usage Notes + ----------- + - Validates execution environment (must run as Administrator) + - Detects each AV product using registry, services, file paths, packages, and WMI + - Stops services before uninstallation + - Attempts removal via multiple methods (packages, WMI, vendor-specific tools) + - Downloads MCPR (McAfee Consumer Product Removal) tool if needed + - Downloads AVG Clear tool if needed + - Uses silent/quiet uninstall methods where possible + - No reboot is forced, though some AV may require it for complete removal + + Requirements + ------------ + - Windows PowerShell 5.1 or PowerShell 7+ + - Administrator privileges + - Internet access (optional, for downloading MCPR and AVG Clear tools) + + Security + -------- + - Some antivirus may require tamper protection to be disabled first + - A reboot may be required after uninstallation for complete removal +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDIzMw +lastPushedChecksum: "sha256:20975b8efcf885c8" +lastPushedMetaChecksum: "sha256:be876ca8a3a8af7d" \ No newline at end of file diff --git a/scripts/arch_update_verbose.level.yaml b/scripts/arch_update_verbose.level.yaml new file mode 100644 index 0000000..a3827c3 --- /dev/null +++ b/scripts/arch_update_verbose.level.yaml @@ -0,0 +1,28 @@ +name: arch_update_verbose.sh +description: Updates all packages on Arch Linux/Omarchy with verbose output +shell: BASH +runAs: SYSTEM +timeout: 5400 +readme: | + Purpose + ------- + Automates system package updates for Arch Linux and Omarchy systems with verbose output and error handling. Syncs package databases, upgrades all packages, removes orphaned dependencies, and cleans package cache. Provides color-coded status messages. + + Usage Notes + ----------- + - Run with sudo or as root + - Configure options at top of script: + - ENABLE_ORPHAN_REMOVAL: Remove orphaned packages after upgrade + - ENABLE_CACHE_CLEAN: Clean pacman cache to free disk space + - ENABLE_COLOR_OUTPUT: Use colored terminal output + + Requirements + ------------ + - Root/sudo access required + - Arch Linux or Arch-based distribution (Omarchy, EndeavourOS, Manjaro, etc.) + - Network connectivity to package mirrors + - pacman package manager +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDIzNA +lastPushedChecksum: "sha256:132e3b80eb80e9b3" +lastPushedMetaChecksum: "sha256:e2851cf2c1bec96a" \ No newline at end of file diff --git a/scripts/bitlocker_enable.level.yaml b/scripts/bitlocker_enable.level.yaml index c56b569..9e45e9a 100644 --- a/scripts/bitlocker_enable.level.yaml +++ b/scripts/bitlocker_enable.level.yaml @@ -1,30 +1,9 @@ name: bitlocker_enable.ps1 -description: Enables BitLocker on the OS drive and guarantees Protection On +description: "" shell: POWERSHELL runAs: SYSTEM -timeout: 600 -readme: | - Purpose - ------- - Converges the OS drive to BitLocker "Protection On" from any starting state: fully decrypted, encrypted with protection suspended (the OOBE pre-provisioned clear-key state), or already protected. Prints the recovery password to the console for Level activity-log capture and fails loudly (exit 1) whenever protection cannot be activated, instead of reporting false success. - - Usage Notes - ----------- - - Requires a present and ready TPM (fails otherwise) - - Ensures exactly one RecoveryPassword protector and a TPM protector - - Starts encryption via manage-bde (xts_aes256, used space only, no hardware test) when the volume is FullyDecrypted - - Activates protectors (manage-bde -protectors -enable) when the volume is encrypted but Protection Status is Off - - manage-bde exit codes are checked; failures exit 1 instead of reporting false success - - Target drive default: C: - - Requirements - ------------ - - PowerShell 5.1 or later - - Windows 10/11 Pro or Enterprise with BitLocker feature - - Level: run as System; timeout 600 seconds - - TPM present and ready - - Security - -------- - - Recovery password is printed to console by design (Level activity log is the key escrow record) - - No other secrets in logs +timeout: 100 +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzM1NDg3 +lastPushedChecksum: "sha256:3aed65cd22ff6767" +lastPushedMetaChecksum: "sha256:dddc42444529721f" \ No newline at end of file diff --git a/scripts/bitlocker_superops_enable.level.yaml b/scripts/bitlocker_superops_enable.level.yaml new file mode 100644 index 0000000..e290b47 --- /dev/null +++ b/scripts/bitlocker_superops_enable.level.yaml @@ -0,0 +1,36 @@ +name: bitlocker_superops_enable.ps1 +description: Enables BitLocker with TPM and syncs recovery key to SuperOps +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Enables BitLocker on the OS drive using TPM and Recovery Password protectors. Ensures protectors are not duplicated, prints recovery key to console for RMM log capture, and syncs the recovery key to SuperOps custom fields. + + Usage Notes + ----------- + - Validates administrative privileges and SuperOps module + - Ensures BDESVC (BitLocker Service) is running and set to Automatic + - Checks TPM status and adds TPM protector if available + - Rotates Recovery Password protector when Force is true (default) + - Initiates encryption with XTS-AES 256, used-space-only mode + - No reboot required to start encryption (skip hardware test enabled) + - Retrieves and displays recovery key, then syncs to SuperOps custom fields + - Target drive default: C: + + Requirements + ------------ + - PowerShell 5.1 or later + - Windows 10/11 Pro or Enterprise with BitLocker feature enabled + - Administrator privileges + - SuperOps module available via $SuperOpsModule + + Security + -------- + - Recovery Password is printed to console (captured by RMM logs) + - Recovery Password is synced to SuperOps custom fields +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDIzNQ +lastPushedChecksum: "sha256:5bb054e2cc26dc88" +lastPushedMetaChecksum: "sha256:5f4065d7380dd69d" \ No newline at end of file diff --git a/scripts/canon_mf455dw_driver_install.level.yaml b/scripts/canon_mf455dw_driver_install.level.yaml new file mode 100644 index 0000000..18f2ba4 --- /dev/null +++ b/scripts/canon_mf455dw_driver_install.level.yaml @@ -0,0 +1,29 @@ +name: canon_mf455dw_driver_install.ps1 +description: Downloads and installs Canon imageCLASS MF455dw printer drivers +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads the Canon imageCLASS MF455dw MF Driver package from Canon's CDN, extracts it, and installs the UFR II LT printer driver to the Windows driver store using pnputil. Optionally creates a TCP/IP printer queue if an IP address is specified. + + Usage Notes + ----------- + - Downloads Canon MF Driver package from official CDN + - Extracts driver files and installs UFR II LT driver via pnputil + - Creates TCP/IP printer port and queue if printer IP is specified + - Leave $printerIp empty to install driver only without creating a queue + - Driver extracts to C:\Temp\CanonMF455dw and is cleaned up after install + - Configurable variables: $driverUrl, $printerIp, $printerName, $installScanner + + Requirements + ------------ + - Windows 10/11 or Windows Server 2016+ + - Administrator privileges + - Network connectivity to Canon CDN (gdlp01.c-wss.com) + - curl.exe (included in Windows 10 1803+) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDIzNg +lastPushedChecksum: "sha256:9422dc3b1c79a3bf" +lastPushedMetaChecksum: "sha256:687afe0072c4a24b" \ No newline at end of file diff --git a/scripts/choco_upgrade_all.level.yaml b/scripts/choco_upgrade_all.level.yaml new file mode 100644 index 0000000..99e17f6 --- /dev/null +++ b/scripts/choco_upgrade_all.level.yaml @@ -0,0 +1,25 @@ +name: choco_upgrade_all.ps1 +description: Upgrades all Chocolatey-managed packages to latest versions +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Upgrades all Chocolatey-managed packages to their latest versions using the choco upgrade all command with automatic confirmation. + + Usage Notes + ----------- + - Checks if Chocolatey is installed before proceeding + - Runs choco upgrade all with auto-confirmation flag (-y) for unattended operation + - Operates on all installed Chocolatey packages; no configuration required + + Requirements + ------------ + - Windows OS + - Administrator privileges + - Chocolatey package manager installed +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDIzNw +lastPushedChecksum: "sha256:bf35638a77698431" +lastPushedMetaChecksum: "sha256:26c49d38afabc76f" \ No newline at end of file diff --git a/scripts/cloudflared_install.level.yaml b/scripts/cloudflared_install.level.yaml new file mode 100644 index 0000000..5a04158 --- /dev/null +++ b/scripts/cloudflared_install.level.yaml @@ -0,0 +1,41 @@ +name: cloudflared_install.ps1 +description: Installs cloudflared via winget and registers the tunnel service +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Onboards a Windows endpoint to a Cloudflare named tunnel by installing the Cloudflare.cloudflared package via winget and registering the Cloudflare Tunnel service with a connector token supplied through SuperOps runtime replacement. The connector token is treated as a secret and is masked on any output path. + + Usage Notes + ----------- + - Validates connector token is present and was replaced by SuperOps + - Resolves winget.exe (SYSTEM-aware path resolution) + - Installs Cloudflare.cloudflared via winget (treats already-installed exit codes as success) + - Resolves the cloudflared.exe binary + - Removes any pre-existing Cloudflare Tunnel service registration + - Registers the service with the connector token + - Polls the service for Running state up to 10 seconds + - Reports success or masked failure (token never echoed) + - Package Id is Cloudflare.cloudflared + - Service name is Cloudflare Tunnel + - Winget flags --exact --silent --accept-package-agreements --accept-source-agreements + + Requirements + ------------ + - CloudflaredTunnelToken runtime variable (required, non-empty) + - Windows 10 1809+ / Windows Server 2019+ + - SYSTEM or Administrator privileges + - Winget installed (run winget_setup.ps1 first if missing) + - Outbound internet connectivity to Cloudflare edge (port 7844) + + Security + -------- + - No secrets in logs + - Connector token is never printed; if it appears in an error message it is masked as **** + - Runtime variable validated against unreplaced placeholder +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDIzOA +lastPushedChecksum: "sha256:13f478410f8c5064" +lastPushedMetaChecksum: "sha256:456e101d5dc58bfa" \ No newline at end of file diff --git a/scripts/cloudflared_status.level.yaml b/scripts/cloudflared_status.level.yaml new file mode 100644 index 0000000..6f9c5fe --- /dev/null +++ b/scripts/cloudflared_status.level.yaml @@ -0,0 +1,32 @@ +name: cloudflared_status.ps1 +description: Reports cloudflared binary, service, and tunnel connectivity state +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Field-triage view of a Windows endpoint's Cloudflare Tunnel connector. Reports the cloudflared binary version and install path, the Cloudflare Tunnel service Status and StartType, and a best-effort tunnel connectivity verdict pulled from the Windows Event Log with an outbound-socket fallback signal. Always exits 0 - absence of target is itself a valid status, not an error. + + Usage Notes + ----------- + - Resolves cloudflared.exe; if absent reports Not installed and exits 0 + - Reports binary version and install path + - Reports service Status and StartType + - Reads recent Application log entries for tunnel connector events + - If no event log signal, falls back to Get-NetTCPConnection / Get-NetUDPEndpoint on port 7844 + - Always prints which signal was used so the field tech knows the basis + - Service name is Cloudflare Tunnel + - Event log window is last 15 minutes + - Event log source is cloudflared (verify on a registered host with Get-WinEvent -ListProvider *cloud*) + - Connector port is 7844 (TCP and UDP) + + Requirements + ------------ + - Windows 10 1809+ / Windows Server 2019+ + - Read access to the Application Event Log + - PowerShell 5.1 or later +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDIzOQ +lastPushedChecksum: "sha256:e7d61d1e9ee15f74" +lastPushedMetaChecksum: "sha256:4547fac1dace91c5" \ No newline at end of file diff --git a/scripts/cloudflared_uninstall.level.yaml b/scripts/cloudflared_uninstall.level.yaml new file mode 100644 index 0000000..ad2ea46 --- /dev/null +++ b/scripts/cloudflared_uninstall.level.yaml @@ -0,0 +1,30 @@ +name: cloudflared_uninstall.ps1 +description: Removes the Cloudflare Tunnel service and uninstalls cloudflared +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Tears down a Cloudflare Tunnel connector on a Windows endpoint by uninstalling the Cloudflare Tunnel service and removing the Cloudflare.cloudflared package via winget. Idempotent: a clean machine results in a no-op success. + + Usage Notes + ----------- + - Detects current state (service present, binary present) + - Removes the Cloudflare Tunnel service via cloudflared service uninstall (graceful) + - Falls back to sc.exe delete if binary is gone but service is orphaned + - Uninstalls Cloudflare.cloudflared via winget + - Verifies service no longer present and binary not resolvable + - Reports a clean-state result (idempotent on already-clean machines) + - Package Id is Cloudflare.cloudflared + - Service name is Cloudflare Tunnel + + Requirements + ------------ + - Windows 10 1809+ / Windows Server 2019+ + - SYSTEM or Administrator privileges + - Winget installed (used only if the package is registered) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI0MA +lastPushedChecksum: "sha256:f9aa02bdaa9c4cda" +lastPushedMetaChecksum: "sha256:65f4ddcdd3d9069e" \ No newline at end of file diff --git a/scripts/cloudflared_upgrade.level.yaml b/scripts/cloudflared_upgrade.level.yaml new file mode 100644 index 0000000..597c28a --- /dev/null +++ b/scripts/cloudflared_upgrade.level.yaml @@ -0,0 +1,33 @@ +name: cloudflared_upgrade.ps1 +description: Upgrades cloudflared via winget and verifies tunnel service health +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Patches the Cloudflare.cloudflared package on a Windows endpoint via winget and confirms the Cloudflare Tunnel service remains healthy after the upgrade. Idempotent: machines without cloudflared installed exit 0 with a no-op. + + Usage Notes + ----------- + - Pre-checks for an existing cloudflared install (no-op exit 0 if absent) + - Captures current version before upgrade + - Captures pre-upgrade service state + - Runs winget upgrade with --exact --silent --accept-package-agreements --accept-source-agreements + - Treats 0x8A15002B no-applicable-update as success (already current) + - Captures new version after upgrade + - Verifies service still Running if it was Running before + - Reports old to new version transition + - Package Id is Cloudflare.cloudflared + - Service name is Cloudflare Tunnel + + Requirements + ------------ + - Windows 10 1809+ / Windows Server 2019+ + - SYSTEM or Administrator privileges + - Winget installed + - Outbound internet connectivity to Cloudflare edge (port 7844) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI0MQ +lastPushedChecksum: "sha256:df3c507b8b3e95a9" +lastPushedMetaChecksum: "sha256:fa0c4f09a5a81211" \ No newline at end of file diff --git a/scripts/cups_toggle_macos.level.yaml b/scripts/cups_toggle_macos.level.yaml new file mode 100644 index 0000000..181b0f7 --- /dev/null +++ b/scripts/cups_toggle_macos.level.yaml @@ -0,0 +1,30 @@ +name: cups_toggle_macos.sh +description: Toggles CUPS web interface on/off for printer administration +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Toggles the CUPS (Common Unix Printing System) web interface on or off. If currently enabled, disables it. If disabled, enables it. Useful for managing printer administration access on macOS and Linux systems. + + Usage Notes + ----------- + - Verifies root/sudo privileges before proceeding + - Auto-detects current CUPS web interface status via cupsctl + - Toggles to opposite state and reports the new status + - Web interface URL when enabled: http://localhost:631 + + Requirements + ------------ + - macOS or Linux with CUPS installed + - cupsctl command available + - Root/sudo privileges + + Security + -------- + - Enabling the web interface exposes printer admin on localhost:631 +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI0Mg +lastPushedChecksum: "sha256:798218624bddb90d" +lastPushedMetaChecksum: "sha256:59f5cd698f6a036a" \ No newline at end of file diff --git a/scripts/dell_command_update.level.yaml b/scripts/dell_command_update.level.yaml new file mode 100644 index 0000000..f7e5bef --- /dev/null +++ b/scripts/dell_command_update.level.yaml @@ -0,0 +1,28 @@ +name: dell_command_update.ps1 +description: Installs Dell Command Update and applies driver/firmware updates +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Installs Dell Command Update via winget and runs it to scan and apply driver/firmware updates silently. Designed for automated Dell system maintenance in RMM environments. + + Usage Notes + ----------- + - Verifies winget is available, then installs Dell Command Update if not present + - Configures DCU for silent operation: auto-suspend BitLocker, disable user consent prompts + - Scans for available updates and outputs log to console + - Applies updates without rebooting (reboot=disable) + - Logs scan and apply operations to C:\dell\logs + - Hardcoded variables: DcuCliPath, DcuLogPath, WingetId + + Requirements + ------------ + - Windows 10 1809+ or Windows 11 with winget + - Dell system hardware (script will fail on non-Dell systems) + - Administrator privileges +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI0Mw +lastPushedChecksum: "sha256:a83e3d86b27a7bd3" +lastPushedMetaChecksum: "sha256:8e7dab3839499063" \ No newline at end of file diff --git a/scripts/delprof2_old_profiles_delete.level.yaml b/scripts/delprof2_old_profiles_delete.level.yaml new file mode 100644 index 0000000..4d4bee7 --- /dev/null +++ b/scripts/delprof2_old_profiles_delete.level.yaml @@ -0,0 +1,32 @@ +name: delprof2_old_profiles_delete.ps1 +description: Deletes Windows user profiles older than specified days +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Deletes Windows user profiles older than a specified number of days. Uses DelProf2 utility downloaded directly from helgeklein.com. + + Usage Notes + ----------- + - Downloads and extracts DelProf2 if not already cached + - Executes delprof2.exe /u /d:X /ed:gaia /ed:administrator + - Always protects gaia and administrator profiles + - Cleans up cached files after execution + - Set $days_old runtime variable to control threshold (default: 30 days) + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges + - Internet access for DelProf2 download from helgeklein.com + - Runtime variable: $days_old (number of days; default 30) + + Security + -------- + - DESTRUCTIVE OPERATION - deleted profiles cannot be recovered +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI0NA +lastPushedChecksum: "sha256:106abf51d75cdcc5" +lastPushedMetaChecksum: "sha256:e873225a3e8b7527" \ No newline at end of file diff --git a/scripts/delprof2_profiles_delete_all.level.yaml b/scripts/delprof2_profiles_delete_all.level.yaml new file mode 100644 index 0000000..b061360 --- /dev/null +++ b/scripts/delprof2_profiles_delete_all.level.yaml @@ -0,0 +1,30 @@ +name: delprof2_profiles_delete_all.ps1 +description: Deletes ALL Windows user profiles except protected ones +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Deletes ALL Windows user profiles except protected ones (gaia, administrator). Uses DelProf2 utility downloaded directly from helgeklein.com. + + Usage Notes + ----------- + - Downloads and extracts DelProf2 if not already cached + - Executes delprof2.exe /u /ed:gaia /ed:administrator + - Always protects gaia and administrator profiles + - Cleans up cached files after execution + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges + - Internet access for DelProf2 download from helgeklein.com + + Security + -------- + - DESTRUCTIVE OPERATION - deleted profiles cannot be recovered +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI0NQ +lastPushedChecksum: "sha256:c59f7c3794206023" +lastPushedMetaChecksum: "sha256:8c40e2cb491e3676" \ No newline at end of file diff --git a/scripts/delprof2_selected_profile_keep.level.yaml b/scripts/delprof2_selected_profile_keep.level.yaml new file mode 100644 index 0000000..103efc0 --- /dev/null +++ b/scripts/delprof2_selected_profile_keep.level.yaml @@ -0,0 +1,31 @@ +name: delprof2_selected_profile_keep.ps1 +description: Deletes all profiles EXCEPT the specified one and protected ones +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Deletes ALL Windows user profiles EXCEPT the specified profile and protected ones (gaia, administrator). Uses DelProf2 utility downloaded directly from helgeklein.com. + + Usage Notes + ----------- + - Downloads and extracts DelProf2 if not already cached + - Executes delprof2.exe /u /ed:PROFILENAME /ed:gaia /ed:administrator + - Always protects gaia and administrator profiles in addition to the specified profile + - Cleans up cached files after execution + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges + - Internet access for DelProf2 download from helgeklein.com + - Runtime variable: $profile_to_keep (username of profile to preserve) + + Security + -------- + - DESTRUCTIVE OPERATION - deleted profiles cannot be recovered +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI0Ng +lastPushedChecksum: "sha256:e42a9370705203ab" +lastPushedMetaChecksum: "sha256:5be9cc55318f8539" \ No newline at end of file diff --git a/scripts/delprof2_specific_profile_delete.level.yaml b/scripts/delprof2_specific_profile_delete.level.yaml new file mode 100644 index 0000000..f5924d4 --- /dev/null +++ b/scripts/delprof2_specific_profile_delete.level.yaml @@ -0,0 +1,33 @@ +name: delprof2_specific_profile_delete.ps1 +description: Deletes only the specified Windows user profile +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Deletes ONLY the specified Windows user profile. All other profiles are left untouched. Uses DelProf2 utility downloaded directly from helgeklein.com. + + Usage Notes + ----------- + - Validates that the target profile is not a protected profile + - Downloads and extracts DelProf2 if not already cached + - Executes delprof2.exe /u /id:PROFILENAME + - Refuses to delete gaia or administrator profiles + - Cleans up cached files after execution + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges + - Internet access for DelProf2 download from helgeklein.com + - Runtime variable: $profile_to_delete (username of profile to delete) + + Security + -------- + - DESTRUCTIVE OPERATION - deleted profile cannot be recovered + - Refuses to delete protected profiles (gaia, administrator) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI0Nw +lastPushedChecksum: "sha256:15ac32c141b8896a" +lastPushedMetaChecksum: "sha256:23eab33f019fe775" \ No newline at end of file diff --git a/scripts/deskview_install.level.yaml b/scripts/deskview_install.level.yaml new file mode 100644 index 0000000..4d838ae --- /dev/null +++ b/scripts/deskview_install.level.yaml @@ -0,0 +1,26 @@ +name: deskview_install.ps1 +description: Installs DeskView utility to startup folder for desktop icons +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads deskview.exe utility to the Windows Startup folder so it runs automatically at user login. DeskView displays desktop icons in a compact window. + + Usage Notes + ----------- + - Validates input parameters before proceeding + - Downloads deskview.exe to the common Startup folder for all users + - Runs automatically at user login after installation + - Configurable variable: $downloadUrl + + Requirements + ------------ + - Windows OS + - Administrator privileges + - Internet connectivity +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI0OA +lastPushedChecksum: "sha256:dca5111c6a4c7b0b" +lastPushedMetaChecksum: "sha256:a5d763537f429546" \ No newline at end of file diff --git a/scripts/dietpi_proxmox_install.level.yaml b/scripts/dietpi_proxmox_install.level.yaml new file mode 100644 index 0000000..7e8b526 --- /dev/null +++ b/scripts/dietpi_proxmox_install.level.yaml @@ -0,0 +1,30 @@ +name: dietpi_proxmox_install.sh +description: Creates lightweight DietPi Debian 12 VM on Proxmox +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and runs the DietPi Debian 12 Bookworm VM installer for Proxmox. Creates a lightweight Debian-based VM optimized for low resource usage. + + Usage Notes + ----------- + - Downloads the installer script from limehawk/proxmox-scripts repository on GitHub + - Executes the installer via bash and returns its exit code + - No hardcoded inputs required; installer is fetched from remote source + + Requirements + ------------ + - Proxmox VE host + - Run from Proxmox shell (not inside a VM) + - Internet access to GitHub + - curl installed + + Security + -------- + - Executes remote code fetched over HTTPS - review source before running +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI0OQ +lastPushedChecksum: "sha256:4267f99c659dd43a" +lastPushedMetaChecksum: "sha256:7146f8ea28f0e118" \ No newline at end of file diff --git a/scripts/directory_cleanup.level.yaml b/scripts/directory_cleanup.level.yaml new file mode 100644 index 0000000..1589252 --- /dev/null +++ b/scripts/directory_cleanup.level.yaml @@ -0,0 +1,25 @@ +name: directory_cleanup.ps1 +description: Deletes files and directories older than specified days +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Cleans up files and directories older than a specified number of days. Logs deleted items to a file in the target folder. + + Usage Notes + ----------- + - Recursively scans subdirectories for files older than the specified threshold + - Deletes matching files and removes empty directories afterward + - Creates deleted_files.log in the target folder with details of each deletion + + Requirements + ------------ + - Windows OS + - Runtime variable: $runtime_folderPath (path to the folder to clean up) + - Runtime variable: $runtime_days (number of days old a file must be to be deleted) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI1MA +lastPushedChecksum: "sha256:c4b0a0caf6528904" +lastPushedMetaChecksum: "sha256:befec431a22ba5de" \ No newline at end of file diff --git a/scripts/directory_size_analyze.level.yaml b/scripts/directory_size_analyze.level.yaml new file mode 100644 index 0000000..56c0f4c --- /dev/null +++ b/scripts/directory_size_analyze.level.yaml @@ -0,0 +1,30 @@ +name: directory_size_analyze.ps1 +description: Analyzes disk usage with gdu utility for directory size reports +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Runs a command-line disk usage analysis on a specified directory using gdu (Go Disk Usage analyzer). Downloads gdu from GitHub releases if not already present, extracts it to a local cache directory, and executes it against the target path in non-interactive mode. + + Usage Notes + ----------- + - Set $YourTargetDirectoryHere runtime variable to the path to scan (e.g., C:\Users) + - Designed for unattended RMM execution + - Downloads and caches gdu utility automatically; no package manager dependencies + - Supports text or JSON output formats (OutputFormat setting) + - Includes timeout protection for long-running scans (ScanTimeout setting) + - Optional cleanup of downloaded files after completion (CleanupAfterRun setting) + - Configurable scan depth controls top N items shown + + Requirements + ------------ + - PowerShell 5.1 or later + - Internet access to reach github.com for initial download + - Write permissions to the cache directory + - Runtime variable: $YourTargetDirectoryHere (target directory to scan) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI1MQ +lastPushedChecksum: "sha256:341a3b130cb083e0" +lastPushedMetaChecksum: "sha256:50e38b1f59ae7bc9" \ No newline at end of file diff --git a/scripts/disk_cleanup.level.yaml b/scripts/disk_cleanup.level.yaml new file mode 100644 index 0000000..56e28f3 --- /dev/null +++ b/scripts/disk_cleanup.level.yaml @@ -0,0 +1,29 @@ +name: disk_cleanup.ps1 +description: Runs Windows Disk Cleanup plus SoftwareDistribution/WinSxS cleanup +shell: POWERSHELL +runAs: SYSTEM +timeout: 10800 +readme: | + Purpose + ------- + Runs Windows Disk Cleanup utility on all fixed local drives, plus targeted cleanups for SoftwareDistribution, WinSxS, and Search Index to free up disk space. Shows disk space before and after with progress updates during long-running operations. + + Usage Notes + ----------- + - Queries WMI for all fixed local drives (DriveType 3) + - Runs cleanmgr.exe with /verylowdisk flag on each drive + - Progress updates every 60 seconds while cleanmgr runs (30-minute timeout per drive) + - Performs targeted cleanups on C: drive: SoftwareDistribution, WinSxS via DISM, Search Index + - Shows free space before/after and total freed at completion + - Cleanups run sequentially to avoid conflicts + - CleanupProfile: verylow (hardcoded) + + Requirements + ------------ + - Windows 10/11 with cleanmgr.exe and DISM + - WMI service running + - Administrator privileges for DISM and service operations +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI1Mg +lastPushedChecksum: "sha256:2496e05767011ab7" +lastPushedMetaChecksum: "sha256:9e36e79fba4bb5a9" \ No newline at end of file diff --git a/scripts/disk_scan_fix.level.yaml b/scripts/disk_scan_fix.level.yaml new file mode 100644 index 0000000..71ec5c9 --- /dev/null +++ b/scripts/disk_scan_fix.level.yaml @@ -0,0 +1,26 @@ +name: disk_scan_fix.sh +description: Comprehensive disk and volume health check for macOS +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Performs a comprehensive health check on all mounted disks and volumes on macOS. Verifies partition maps, file systems, and SMART status where supported. + + Usage Notes + ----------- + - Auto-detects all mounted disks + - Verifies partition map for each disk + - Checks file system health for HFS and APFS volumes + - Reports SMART status when available + - Read-only operations (verification only, no modifications) + + Requirements + ------------ + - macOS operating system + - Root/sudo privileges +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI1Mw +lastPushedChecksum: "sha256:9afd6590971bc04f" +lastPushedMetaChecksum: "sha256:9a562a254b2a72cc" \ No newline at end of file diff --git a/scripts/disk_smart_status.level.yaml b/scripts/disk_smart_status.level.yaml new file mode 100644 index 0000000..79dbc17 --- /dev/null +++ b/scripts/disk_smart_status.level.yaml @@ -0,0 +1,41 @@ +name: disk_smart_status.ps1 +description: Reports S.M.A.R.T. predictive-failure health of all physical disks +shell: POWERSHELL +runAs: SYSTEM +timeout: 1800 +readme: | + Purpose + ------- + Reports the S.M.A.R.T. / predictive-failure health of every physical disk on the machine so the RMM dashboard can flag failing drives. Combines PowerShell storage health, WMI predictive-failure status, and SMART reliability counters into a single per-machine verdict. + + Data Sources + ------------ + - Get-PhysicalDisk: primary per-disk health (HealthStatus, OperationalStatus) + - MSStorageDriver_FailurePredictStatus (root\wmi): SMART predictive-failure flag + - Get-StorageReliabilityCounter: best-effort wear / temperature / read-error counters + + Usage Notes + ----------- + - Enumerates physical disks via Get-PhysicalDisk and reports FriendlyName, MediaType, Size (GB), HealthStatus, and OperationalStatus per disk + - Queries WMI predictive-failure status via MSStorageDriver_FailurePredictStatus, reporting "Not available" when the class is missing (VMs, some controllers) instead of failing + - Pulls SMART reliability counters via Get-StorageReliabilityCounter (Wear, Temperature, ReadErrorsTotal) on a best-effort basis + - Aggregates to a final per-machine verdict: Healthy / Warning / Failing + - Exits 0 when all disks are healthy or SMART data is undeterminable (e.g. a VM); exits 1 when a disk reports a predicted failure or unhealthy HealthStatus + - No configurable settings and no inputs; the verdict comes directly from disk-reported HealthStatus and the SMART PredictFailure flag, with no tunable thresholds + - All data is queried locally; no network endpoints are contacted + + Requirements + ------------ + - Windows 10/11 or Windows Server + - PowerShell 5.1 or later + - Administrator privileges + - Storage subsystem that exposes SMART data (physical hardware) + + Security + -------- + - Read-only; makes no changes to disks or configuration + - Requires elevated privileges to query the storage subsystem +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI1NA +lastPushedChecksum: "sha256:cf1b77bc78f75a11" +lastPushedMetaChecksum: "sha256:b346d0878c0124e5" \ No newline at end of file diff --git a/scripts/dns_flush.level.yaml b/scripts/dns_flush.level.yaml new file mode 100644 index 0000000..2de3c53 --- /dev/null +++ b/scripts/dns_flush.level.yaml @@ -0,0 +1,25 @@ +name: dns_flush.sh +description: Flushes DNS cache on macOS across all supported versions +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Flushes the DNS cache on macOS to resolve DNS-related connectivity issues. Automatically detects macOS version and uses the appropriate flush method. + + Usage Notes + ----------- + - Detects macOS version automatically + - Selects appropriate DNS flush method for the detected version + - Executes flush command and reports success or failure + - Version-specific flush commands used for compatibility + + Requirements + ------------ + - macOS 10.6 or later + - Root/sudo privileges +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI1NQ +lastPushedChecksum: "sha256:5124eb497016d01a" +lastPushedMetaChecksum: "sha256:d307e5164ef19eba" \ No newline at end of file diff --git a/scripts/dns_set_provider.level.yaml b/scripts/dns_set_provider.level.yaml new file mode 100644 index 0000000..fbe1d18 --- /dev/null +++ b/scripts/dns_set_provider.level.yaml @@ -0,0 +1,45 @@ +name: dns_set_provider.ps1 +description: Sets IPv4 DNS servers on active adapters to a chosen provider +shell: POWERSHELL +runAs: SYSTEM +timeout: 300 +readme: | + Purpose + ------- + Quickly switches all active physical IPv4 network adapters to a known public DNS provider chosen by number. Designed for SuperOps runtime replacement so a tech can pick the desired DNS from a numbered list without typing IP addresses or worrying about syntax. + + Provider Selection (set DnsProviderSelection to one of these numbers) + -------------------------------------------------------------------- + 1 DHCP / Automatic - clear static DNS, return to DHCP + 2 Cloudflare - 1.1.1.1, 1.0.0.1 + 3 Cloudflare Malware - 1.1.1.2, 1.0.0.2 (block malware) + 4 Cloudflare Families - 1.1.1.3, 1.0.0.3 (block malware + adult) + 5 Google - 8.8.8.8, 8.8.4.4 + 6 OpenDNS - 208.67.222.222, 208.67.220.220 + 7 OpenDNS FamilyShield - 208.67.222.123, 208.67.220.123 + 8 Quad9 - 9.9.9.9, 149.112.112.112 (block malware) + 9 Quad9 Unsecured - 9.9.9.10, 149.112.112.10 (no filtering) + 10 AdGuard - 94.140.14.14, 94.140.15.15 (block ads) + 11 AdGuard Family - 94.140.14.15, 94.140.15.16 (block ads + adult) + 12 CleanBrowsing Security - 185.228.168.9, 185.228.169.9 + 13 CleanBrowsing Family - 185.228.168.168, 185.228.169.168 + 14 Control D Free - 76.76.2.0, 76.76.10.0 + + Usage Notes + ----------- + - Targets active Ethernet (InterfaceType 6) and Wi-Fi (InterfaceType 71) adapters + - Applies to IPv4 DNS only; IPv6 DNS is left untouched + - Selection 1 resets the adapters to DHCP (clears static DNS) + - Flushes the resolver cache after the change + - Reports per-adapter success / failure + + Requirements + ------------ + - DnsProviderSelection runtime variable (required, integer 1..14) + - Windows 10 1809+ / Windows Server 2019+ + - SYSTEM or Administrator privileges + - At least one active Ethernet or Wi-Fi adapter +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI1Ng +lastPushedChecksum: "sha256:c5ae635e195d07c1" +lastPushedMetaChecksum: "sha256:da73d5ee6c22002f" \ No newline at end of file diff --git a/scripts/dnsfilter_uninstall.level.yaml b/scripts/dnsfilter_uninstall.level.yaml new file mode 100644 index 0000000..d5ad11d --- /dev/null +++ b/scripts/dnsfilter_uninstall.level.yaml @@ -0,0 +1,30 @@ +name: dnsfilter_uninstall.ps1 +description: Completely removes DNSFilter agent and resets DNS to DHCP +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Completely removes DNSFilter agent from a Windows system including uninstalling the MSI package, stopping and removing services, deleting installation folders, cleaning up registry keys, and resetting DNS settings to DHCP. + + Usage Notes + ----------- + - Uninstalls DNS Agent via WMI if installed + - Stops and deletes related Windows services + - Removes installation folders and registry keys + - Resets all NICs to use DHCP for DNS + - Flushes DNS cache + + Requirements + ------------ + - Windows 10/11 or Windows Server + - Administrator privileges + + Security + -------- + - Resets DNS to DHCP, which may temporarily affect network connectivity +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI1Nw +lastPushedChecksum: "sha256:09f70a00c2649337" +lastPushedMetaChecksum: "sha256:c77b8bc2bb6028e6" \ No newline at end of file diff --git a/scripts/dokploy_orphaned_volumes_cleanup.level.yaml b/scripts/dokploy_orphaned_volumes_cleanup.level.yaml new file mode 100644 index 0000000..4ff479c --- /dev/null +++ b/scripts/dokploy_orphaned_volumes_cleanup.level.yaml @@ -0,0 +1,33 @@ +name: dokploy_orphaned_volumes_cleanup.sh +description: Identifies and removes orphaned Docker volumes to free space +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Scans Docker containers and Swarm services to identify volumes that are not currently mounted or in use. Provides detailed information about orphaned volumes including size, creation date, and mount point. Can optionally remove orphaned volumes automatically to free up disk space. + + Usage Notes + ----------- + - Scans all Docker containers (running and stopped) for volume mounts + - Scans all Docker Swarm services for volume usage + - Compares all system volumes against used volumes + - Displays detailed information for each orphaned volume + - Optionally removes orphaned volumes if AUTO_REMOVE is true + - Set AUTO_REMOVE to true to automatically remove orphaned volumes, false for safe mode (list only) + + Requirements + ------------ + - Docker installed and running + - Root/sudo access for volume inspection and removal + - Docker Swarm (optional, script works without it) + + Security + -------- + - Requires privileged access to Docker daemon + - Volume data is permanently deleted when removed +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI1OA +lastPushedChecksum: "sha256:4aa76efabe2abc10" +lastPushedMetaChecksum: "sha256:5caae0cbbdfa6939" \ No newline at end of file diff --git a/scripts/dokploy_running_apps_deploy.level.yaml b/scripts/dokploy_running_apps_deploy.level.yaml new file mode 100644 index 0000000..bff13f7 --- /dev/null +++ b/scripts/dokploy_running_apps_deploy.level.yaml @@ -0,0 +1,35 @@ +name: dokploy_running_apps_deploy.sh +description: Redeploys running Dokploy apps and verifies each outcome + version +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Automates redeployment of all running Dokploy applications with no stored secret, then verifies what actually happened. Reads each app's status and built-in deploy webhook token from the Dokploy database, triggers the webhook on localhost, waits for the deploy to finish, and reports the real outcome plus whether the running image changed. Idle applications are skipped. + + Usage Notes + ----------- + - Queries project, name, status, sourceType, branch, watchPaths, deploy webhook token, appName, and applicationId from the Dokploy database + - Skips applications with "idle" status; deploys all others in parallel + - No API key or stored secret: each app's own webhook token is read from the local database at runtime and used only against localhost + - docker-source apps redeploy on a bare webhook POST; git-source apps get a GitHub-style push payload carrying the branch plus a file path matching any watchPaths filter + - After triggering, waits for the deployment table to report done/error, then compares the running container image id before and after to classify each app as updated / no change / failed + - Reports per-app duration and a summary; exits 1 if any app failed or could not be verified + + Requirements + ------------ + - Must run on the Dokploy host server (Dokploy schedule or cron) + - Dokploy postgres container accessible via docker exec + - docker and curl installed + - Each target app must have "Auto Deploy" enabled — the webhook rejects apps with auto deploy turned off + + Security + -------- + - No API key or stored secret anywhere — the per-app webhook token is read from the local database at runtime + - No secrets are written to logs (only app names, image ids, and outcomes are printed) + - All calls are localhost-only, no external network traffic +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI1OQ +lastPushedChecksum: "sha256:ecf5e9ab795bafee" +lastPushedMetaChecksum: "sha256:1064c600d43f830d" \ No newline at end of file diff --git a/scripts/ds_store_disable_macos.level.yaml b/scripts/ds_store_disable_macos.level.yaml new file mode 100644 index 0000000..fae217f --- /dev/null +++ b/scripts/ds_store_disable_macos.level.yaml @@ -0,0 +1,24 @@ +name: ds_store_disable_macos.sh +description: Prevents macOS from creating .DS_Store files on network shares +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Prevents macOS from creating .DS_Store files on network shares. These files contain folder metadata and can clutter network drives, causing issues for non-Mac users accessing shared folders. + + Usage Notes + ----------- + - Sets DSDontWriteNetworkStores to true via defaults command + - Displays confirmation message + - Logout or reboot is required for changes to take effect + + Requirements + ------------ + - macOS operating system + - No special privileges required (runs as current user) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI2MA +lastPushedChecksum: "sha256:6a32e8ee9e2fd422" +lastPushedMetaChecksum: "sha256:8355c5b1c0403e8d" \ No newline at end of file diff --git a/scripts/duplicati_backup_status.level.yaml b/scripts/duplicati_backup_status.level.yaml new file mode 100644 index 0000000..1d2ce2e --- /dev/null +++ b/scripts/duplicati_backup_status.level.yaml @@ -0,0 +1,30 @@ +name: duplicati_backup_status.ps1 +description: Monitors Duplicati backup jobs via local API and reports status +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Monitors Duplicati backup jobs via the local API. Authenticates to the Duplicati web service, queries configured backups, and reports their status including metrics like backup size, file count, and next scheduled run. + + Usage Notes + ----------- + - Validates input parameters + - Authenticates to Duplicati API + - Queries all configured backup jobs + - Checks status of each job (Success, Warning, Error, etc.) + - Reports metrics: size, file count, progress, next schedule + - Exits with code 1 if any job has failed + - $duplicatiPassword: set to your Duplicati Web UI password (leave empty if no password) + - $duplicatiPort: port where Duplicati runs (default 8200) + + Requirements + ------------ + - Windows OS + - Duplicati 2.0+ installed and running + - Web UI password set (or empty for no password) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI2MQ +lastPushedChecksum: "sha256:360e0d7aeefcb55f" +lastPushedMetaChecksum: "sha256:fa6eba5ebb798793" \ No newline at end of file diff --git a/scripts/edge_chrome_default_user_set.level.yaml b/scripts/edge_chrome_default_user_set.level.yaml new file mode 100644 index 0000000..0c2537b --- /dev/null +++ b/scripts/edge_chrome_default_user_set.level.yaml @@ -0,0 +1,30 @@ +name: edge_chrome_default_user_set.ps1 +description: Sets Google Chrome as default browser for current user via SetUserFTA +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Sets Google Chrome as the default browser for the current user. Uses SetUserFTA to properly set file associations with the correct UserChoice hash that Windows 10/11 requires. Must run as the logged-in user (not SYSTEM) because default browser settings are per-user and stored in HKCU with hash validation. + + Usage Notes + ----------- + - Verifies Chrome is installed + - Checks that script is NOT running as SYSTEM + - Downloads SetUserFTA if not present + - Sets Chrome as default for http, https, .htm, .html + - All options default to $true; set individual booleans to $false to skip specific associations + - $cleanUserStartup: remove Edge from user's startup programs + - SetUserFTA is hosted in the limehawk rmm-scripts repo; change URL if hosted elsewhere + + Requirements + ------------ + - PowerShell 5.1 or later + - Must run as logged-in user (NOT as SYSTEM) + - Google Chrome must be installed + - Internet access (to download SetUserFTA if needed) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI2Mg +lastPushedChecksum: "sha256:b213f84130bd8aa5" +lastPushedMetaChecksum: "sha256:c2acc08e23506011" \ No newline at end of file diff --git a/scripts/edge_suppress_policies_system.level.yaml b/scripts/edge_suppress_policies_system.level.yaml new file mode 100644 index 0000000..29e4158 --- /dev/null +++ b/scripts/edge_suppress_policies_system.level.yaml @@ -0,0 +1,30 @@ +name: edge_suppress_policies_system.ps1 +description: Applies machine-wide policies to suppress Edge nagging behaviors +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Applies machine-wide policies to suppress Microsoft Edge nagging behaviors. Stops Edge from prompting to become default, auto-importing from other browsers, running in background, and showing promotional UI elements. Run as SYSTEM via RMM as the machine policy script. + + Usage Notes + ----------- + - Verifies admin privileges + - Creates Edge policy registry keys + - Applies 15+ registry policies to suppress Edge behaviors + - Disables EdgeUpdate scheduled tasks + - Removes Edge from startup programs + - All options default to $true (suppress everything) + - Set individual options to $false to keep specific Edge behaviors + - Covers UI prompts, features (Collections, Shopping, Sidebar, Copilot), and background behavior (startup boost, prelaunch, background mode) + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges required (runs as SYSTEM via RMM) + - Windows 10/11 with Microsoft Edge installed +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI2Mw +lastPushedChecksum: "sha256:1151af7b4680d90b" +lastPushedMetaChecksum: "sha256:ac21aa75f2e06ccc" \ No newline at end of file diff --git a/scripts/emsisoft_url_install.level.yaml b/scripts/emsisoft_url_install.level.yaml new file mode 100644 index 0000000..70bb6d7 --- /dev/null +++ b/scripts/emsisoft_url_install.level.yaml @@ -0,0 +1,39 @@ +name: emsisoft_url_install.ps1 +description: Downloads and installs Emsisoft Anti-Malware from a specified URL +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and installs Emsisoft Anti-Malware from a specified URL. Designed for deployments where the Emsisoft installer is hosted on a web server or cloud storage and needs to be deployed to endpoints via RMM. + + Usage Notes + ----------- + - Validates inputs (URL format, download path exists) + - Extracts filename from URL + - Downloads installer from specified URL + - Verifies download completed successfully + - Executes the installer immediately after download + - Download location defaults to %TEMP% directory + - Downloaded installer is NOT deleted after execution + - No installation flags are passed (interactive install) + - $installerUrl: full URL to Emsisoft installer executable + - $downloadPath: local directory to download installer to (default: $env:TEMP) + + Requirements + ------------ + - Windows PowerShell 5.1 or PowerShell 7+ + - Internet connectivity to download URL + - Administrator privileges recommended (for installation) + - Sufficient disk space for installer download + + Security + -------- + - Ensure download URL is from a trusted source only + - Downloaded file is executed immediately; validate URL before use + - Use HTTPS URLs for secure downloads +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI2NA +lastPushedChecksum: "sha256:192d86d6bb9b656b" +lastPushedMetaChecksum: "sha256:2ed3ace3665c7ce7" \ No newline at end of file diff --git a/scripts/eset_cleanup.level.yaml b/scripts/eset_cleanup.level.yaml new file mode 100644 index 0000000..24eec2e --- /dev/null +++ b/scripts/eset_cleanup.level.yaml @@ -0,0 +1,35 @@ +name: eset_cleanup.ps1 +description: Completely removes ESET antivirus remnants from Windows systems +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Performs a complete cleanup of ESET antivirus software from Windows systems. Removes services, processes, files, registry entries, and scheduled tasks left behind after ESET uninstallation. Useful when standard uninstall fails or leaves remnants that interfere with new AV deployment. + + Usage Notes + ----------- + - Validates Administrator privileges + - Stops and removes all ESET services (matching *ESET* pattern) + - Terminates active ESET processes (egui.exe, ekrn.exe) + - Removes ESET installation folders (Program Files, ProgramData, AppData) + - Removes ESET registry keys (HKLM and HKCU) + - Removes ESET scheduled tasks (matching *ESET* pattern) + - No inputs required; all cleanup targets are predefined + + Requirements + ------------ + - Windows PowerShell 5.1 or PowerShell 7+ + - Administrator privileges (required) + - No modules required + + Security + -------- + - Forcefully terminates processes (may lose unsaved ESET settings) + - Registry modifications are permanent + - Backup important data before running +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI2NQ +lastPushedChecksum: "sha256:be3fe66de9f75c4b" +lastPushedMetaChecksum: "sha256:0237e98d9cf419df" \ No newline at end of file diff --git a/scripts/everything_file_search.level.yaml b/scripts/everything_file_search.level.yaml new file mode 100644 index 0000000..7249fa8 --- /dev/null +++ b/scripts/everything_file_search.level.yaml @@ -0,0 +1,27 @@ +name: everything_file_search.ps1 +description: Searches all fixed drives for files matching a pattern via NTFS MFT +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Searches all fixed NTFS drives by reading the Master File Table directly via fsutil. Much faster than Get-ChildItem because it reads the MFT sequentially instead of walking the directory tree. No third-party tools. + + Usage Notes + ----------- + - Reads NTFS MFT via fsutil usn enumdata per drive + - Filters filenames inline using wildcard match + - Resolves full paths only for matches (low memory) + - May show recently deleted files not yet overwritten in MFT + + Requirements + ------------ + - Windows 10/11 with NTFS volumes + - Administrator privileges (required for MFT access) + - PowerShell 5.1 or later + - $searchPattern: wildcard pattern (e.g., *landtrust*, *.pdf) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI2Ng +lastPushedChecksum: "sha256:0cd3f77917c59864" +lastPushedMetaChecksum: "sha256:c16e860df1ba8992" \ No newline at end of file diff --git a/scripts/file_secure_delete.level.yaml b/scripts/file_secure_delete.level.yaml new file mode 100644 index 0000000..408d767 --- /dev/null +++ b/scripts/file_secure_delete.level.yaml @@ -0,0 +1,37 @@ +name: file_secure_delete.ps1 +description: Interactive version of secure delete - prompts user for all inputs +shell: POWERSHELL +runAs: CURRENT_USER +timeout: 1800 +readme: | + Purpose + ------- + Interactive wizard for secure file deletion using Microsoft SDelete with DoD 5220.22-M compliant overwriting. Guides users through configuration options step-by-step before performing deletion. Creates comprehensive documentation suitable for legal proceedings. + + Usage Notes + ----------- + - Step-by-step prompts for target path, operator name, case reference, and settings + - Dry run mode available to preview before actual deletion + - Generates SHA-256 and MD5 hashes of all files before deletion + - Produces comprehensive certificate of destruction (text and HTML) + - Captures system information for audit trail + - Auto-installs SDelete via winget if not present + - Shows summary of all selections for confirmation before proceeding + - Supports recursive deletion of directories + - Configurable number of overwrite passes (default: 3) + + Requirements + ------------ + - Interactive terminal (not suitable for RMM/headless execution) + - Microsoft SDelete (auto-installed via winget if enabled) + - PowerShell 5.1 or later + - Administrator rights recommended for complete metadata access + + Security + -------- + - Certificate contains file paths and hashes which may be sensitive + - Store certificates securely according to legal requirements +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI2Nw +lastPushedChecksum: "sha256:99d45673e39aa403" +lastPushedMetaChecksum: "sha256:489feaaeba40b6e3" \ No newline at end of file diff --git a/scripts/file_secure_delete_certificate.level.yaml b/scripts/file_secure_delete_certificate.level.yaml new file mode 100644 index 0000000..753a5fc --- /dev/null +++ b/scripts/file_secure_delete_certificate.level.yaml @@ -0,0 +1,39 @@ +name: file_secure_delete_certificate.ps1 +description: Securely deletes files with DoD-compliant overwriting and audit trail +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Securely deletes files using Microsoft SDelete with DoD 5220.22-M compliant overwriting, generating comprehensive documentation suitable for legal proceedings. Creates a detailed certificate of destruction with file hashes, metadata, system information, and timestamped audit trail. + + Usage Notes + ----------- + - Configure $targetPath, $outputDirectory, and $operatorName before running + - Set $dryRun to $true to test without actual deletion + - Generates unique session ID for audit trail + - Captures complete system information (hardware, OS, user, network) + - Calculates SHA-256 and MD5 hashes for each file (dual hash for verification) + - Records file attributes, timestamps, size, and NTFS alternate data streams + - Verifies each file no longer exists post-deletion + - Supports recursive deletion with the $recursive setting + - Optional HTML certificate generation via $generateHtml + - Configurable overwrite passes via $overwritePasses (default: 3) + - Optional $caseReference, $witnessName, and $notes fields for legal documentation + + Requirements + ------------ + - Windows 10/11 or Windows Server + - PowerShell 5.1 or later + - Administrator privileges recommended for complete metadata access + - Microsoft SDelete (auto-installed via winget if $autoInstallSDelete is enabled) + + Security + -------- + - Certificate contains file paths and hashes which may be sensitive + - Store certificates securely according to legal requirements +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI2OA +lastPushedChecksum: "sha256:a041287d0a535364" +lastPushedMetaChecksum: "sha256:47c7a4f846c9c22e" \ No newline at end of file diff --git a/scripts/files_rename_snake_case.level.yaml b/scripts/files_rename_snake_case.level.yaml new file mode 100644 index 0000000..e15d551 --- /dev/null +++ b/scripts/files_rename_snake_case.level.yaml @@ -0,0 +1,29 @@ +name: files_rename_snake_case.ps1 +description: Recursively renames files and folders to snake_case format +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Recursively renames all files and folders in a directory to snake_case format. Converts spaces, hyphens, and other non-alphanumeric characters to underscores and lowercases all characters. + + Usage Notes + ----------- + - Set target directory via SuperOps runtime variable $YourTargetPathHere + - Converts to lowercase, replaces non-alphanumeric characters with underscores + - Trims leading/trailing underscores from names + - Processes child items first (bottom-up) to avoid path issues + - Skips items already in snake_case format + - Reports each rename operation and final counts + - WARNING: Cannot be undone -- backup important directories first + + Requirements + ------------ + - Windows 10/11 + - Write permissions to target directory + - PowerShell 5.1+ +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI2OQ +lastPushedChecksum: "sha256:1667beeb231b76e8" +lastPushedMetaChecksum: "sha256:2f93af2b5c4ad238" \ No newline at end of file diff --git a/scripts/foxit_pdf_editor_plus_install.level.yaml b/scripts/foxit_pdf_editor_plus_install.level.yaml new file mode 100644 index 0000000..f6e947e --- /dev/null +++ b/scripts/foxit_pdf_editor_plus_install.level.yaml @@ -0,0 +1,28 @@ +name: foxit_pdf_editor_plus_install.ps1 +description: Installs Foxit PDF Editor from Microsoft Store via winget +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Installs Foxit PDF Editor from Microsoft Store source via winget. The MS Store version validates licenses server-side, supporting all Foxit subscription types including PDF Editor+, Suite Pro Teams, and other subscription SKUs. + + Usage Notes + ----------- + - Verifies winget is available + - Installs Foxit PDF Editor from Microsoft Store source (package ID: XPDNZD76FP5JR7) + - Silent install with automatic agreement acceptance + - Uses msstore source for proper subscription license validation + - User must sign into Foxit account post-install to activate license + - No inputs required; package ID is hardcoded + + Requirements + ------------ + - Windows 10/11 with winget installed + - Administrator/SYSTEM privileges + - Internet connectivity to Microsoft Store +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI3MA +lastPushedChecksum: "sha256:46dc5587c5f2c2bf" +lastPushedMetaChecksum: "sha256:03aa4a64189191b1" \ No newline at end of file diff --git a/scripts/gcpw_cleanup.level.yaml b/scripts/gcpw_cleanup.level.yaml new file mode 100644 index 0000000..bab7fe7 --- /dev/null +++ b/scripts/gcpw_cleanup.level.yaml @@ -0,0 +1,27 @@ +name: gcpw_cleanup.ps1 +description: Removes GCPW registry keys and folders for clean reinstallation +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Removes Google Credential Provider for Windows (GCPW) registry keys and folders to allow for a clean reinstallation or complete removal. + + Usage Notes + ----------- + - Deletes GCPW-related registry keys + - Deletes Chrome enrollment registry keys + - Removes GCPW policy and credential folders + - Reports results for each operation + - No inputs required + - Does NOT uninstall GCPW itself (use Programs and Features for that) + + Requirements + ------------ + - Windows 10/11 or Windows Server + - Administrator privileges +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI3MQ +lastPushedChecksum: "sha256:ac2a1fbb15510a20" +lastPushedMetaChecksum: "sha256:01c25972ed0defab" \ No newline at end of file diff --git a/scripts/gcpw_install.level.yaml b/scripts/gcpw_install.level.yaml new file mode 100644 index 0000000..33fae3e --- /dev/null +++ b/scripts/gcpw_install.level.yaml @@ -0,0 +1,35 @@ +name: gcpw_install.ps1 +description: Downloads, installs, and configures Google Credential Provider for Windows +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads, installs, and configures Google Credential Provider for Windows (GCPW). Sets allowed domains and enrollment token in the system registry. + + Usage Notes + ----------- + - Validates administrative privileges + - Downloads GCPW installer (32-bit or 64-bit based on OS) + - Installs GCPW silently + - Configures allowed domains in registry + - Configures enrollment token in registry + - $YourDomainsHere: comma-separated list of allowed Google Workspace domains (SuperOps runtime variable) + - $YourEnrollmentTokenHere: GCPW enrollment token from Google Admin Console (SuperOps runtime variable) + + Requirements + ------------ + - Windows 10/11 or Windows Server + - Administrator privileges + - Internet access + - Valid Google Workspace enrollment token + + Security + -------- + - Enrollment token should be kept confidential + - Only listed domains will be allowed to login +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI3Mg +lastPushedChecksum: "sha256:6a01156dccfaf3c8" +lastPushedMetaChecksum: "sha256:d432bc6517dc2bef" \ No newline at end of file diff --git a/scripts/google_update_trigger.level.yaml b/scripts/google_update_trigger.level.yaml new file mode 100644 index 0000000..d78d381 --- /dev/null +++ b/scripts/google_update_trigger.level.yaml @@ -0,0 +1,25 @@ +name: google_update_trigger.ps1 +description: Triggers Google Update scheduled task to check for Chrome updates +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Triggers the Google Update scheduled task to force an immediate check for Chrome and other Google product updates. + + Usage Notes + ----------- + - Searches for scheduled tasks matching "GoogleUpdateTaskMachineUA" + - Starts matching tasks and reports status + - No inputs required; task name pattern is hardcoded + + Requirements + ------------ + - Windows 10/11 + - Google Chrome or other Google products installed + - Administrator privileges +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI3Mw +lastPushedChecksum: "sha256:4646ca9e91cf3598" +lastPushedMetaChecksum: "sha256:2f7d6a09f0708c09" \ No newline at end of file diff --git a/scripts/hardware_report.level.yaml b/scripts/hardware_report.level.yaml new file mode 100644 index 0000000..5267670 --- /dev/null +++ b/scripts/hardware_report.level.yaml @@ -0,0 +1,32 @@ +name: hardware_report.ps1 +description: Generates comprehensive hardware inventory report via CIM queries +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Generates a comprehensive hardware inventory report for the local machine. Collects system information, CPU, memory, storage, GPU, network adapters, and BIOS details. Designed for unattended execution in RMM environments to gather standardized hardware data for asset management and documentation. + + Usage Notes + ----------- + - Collects hardware information from local system via CIM queries + - All sections are optional and can be disabled via hardcoded inputs + - Missing or unavailable hardware components are reported as "N/A" + - Output formatted as Key : Value pairs for RMM parsing + - Sizes reported in GB with 2 decimal precision + - $IncludeStorage: include storage device information (default $true) + - $IncludeGpu: include GPU information (default $true) + - $IncludeNetwork: include network adapter information (default $true) + - $IncludeBios: include BIOS information (default $true) + - $IncludeMemoryModules: include individual RAM module details (default $true) + + Requirements + ------------ + - PowerShell 5.1 or later + - Windows operating system with CIM/WMI support + - No special permissions required (runs in user context) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI3NA +lastPushedChecksum: "sha256:de8ba9756cb4a9ce" +lastPushedMetaChecksum: "sha256:405b428c41b5ab3e" \ No newline at end of file diff --git a/scripts/huntress_install_macos.level.yaml b/scripts/huntress_install_macos.level.yaml new file mode 100644 index 0000000..3d36524 --- /dev/null +++ b/scripts/huntress_install_macos.level.yaml @@ -0,0 +1,40 @@ +name: huntress_install_macos.sh +description: Installs Huntress Agent on macOS endpoints +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and installs the Huntress Agent on macOS systems. Huntress provides managed detection and response (MDR) services. This script handles the download, validation, and installation of the agent with proper logging. + + Usage Notes + ----------- + - Validates root privileges + - Validates account key format (32-character hex) + - Downloads Huntress installer from API + - Validates downloaded script before execution + - Executes installer with provided keys + - RMM name reported as "Superops.ai" for deployment tracking + - Log file written to /tmp/HuntressInstaller.log + - System extension defaults to false (requires MDM pre-configuration) + - ACCOUNT_KEY: your Huntress account secret key (32-char hex, SuperOps runtime variable) + - ORG_KEY: organization key for agent affiliation (SuperOps runtime variable) + - INSTALL_SYSTEM_EXTENSION: set to true if MDM is pre-configured (SuperOps runtime variable) + + Requirements + ------------ + - macOS operating system + - Root/sudo privileges + - Network connectivity to huntress.io + - Valid Huntress account key and organization key + - For system extension: MDM pre-configuration required + + Security + -------- + - Account key is masked in logs (shows first/last 4 chars only) + - Installer downloaded over HTTPS +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI3NQ +lastPushedChecksum: "sha256:910ea6231cde662c" +lastPushedMetaChecksum: "sha256:34241a4dc18f26c6" \ No newline at end of file diff --git a/scripts/ipconfig_release_renew.level.yaml b/scripts/ipconfig_release_renew.level.yaml new file mode 100644 index 0000000..d4bb40b --- /dev/null +++ b/scripts/ipconfig_release_renew.level.yaml @@ -0,0 +1,32 @@ +name: ipconfig_release_renew.ps1 +description: Releases and renews IP addresses on DHCP-enabled adapters +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Releases and renews IP addresses on all DHCP-enabled network adapters, and flushes the DNS cache. Useful for resolving network connectivity issues caused by stale DHCP leases or DNS cache problems. + + Usage Notes + ----------- + - Queries all network adapters for DHCP-enabled interfaces + - For each DHCP adapter: releases IP, then renews IP + - Flushes DNS cache if enabled + - Reports results for each adapter + - Targets only DHCP-enabled adapters; static IP adapters are skipped + - $FlushDns: whether to flush DNS cache after renewal (default $true) + + Requirements + ------------ + - Windows OS with network adapters + - DHCP-enabled network adapters + - Admin privileges recommended for DNS flush + + Security + -------- + - Temporarily disconnects network during release/renew +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI3Ng +lastPushedChecksum: "sha256:aee4d4bf40d78b00" +lastPushedMetaChecksum: "sha256:fa83b128df10b6e8" \ No newline at end of file diff --git a/scripts/level_agent_install.level.yaml b/scripts/level_agent_install.level.yaml new file mode 100644 index 0000000..502f9b2 --- /dev/null +++ b/scripts/level_agent_install.level.yaml @@ -0,0 +1,8 @@ +name: level_agent_install.ps1 +shell: POWERSHELL +runAs: SYSTEM +timeout: 60 +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNzUxMQ +lastPushedChecksum: "sha256:a9b2f3b9656090a7" +lastPushedMetaChecksum: "sha256:4998b3dfa27ba35b" \ No newline at end of file diff --git a/scripts/level_agent_install_macos.level.yaml b/scripts/level_agent_install_macos.level.yaml new file mode 100644 index 0000000..0462ef4 --- /dev/null +++ b/scripts/level_agent_install_macos.level.yaml @@ -0,0 +1,8 @@ +name: level_agent_install_macos.sh +shell: BASH +runAs: SYSTEM +timeout: 60 +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNzUxMg +lastPushedChecksum: "sha256:b99bbfa346ec46c5" +lastPushedMetaChecksum: "sha256:3766b722aa498154" \ No newline at end of file diff --git a/scripts/limehawk_admin_profile_branding.level.yaml b/scripts/limehawk_admin_profile_branding.level.yaml new file mode 100644 index 0000000..7e8477a --- /dev/null +++ b/scripts/limehawk_admin_profile_branding.level.yaml @@ -0,0 +1,29 @@ +name: limehawk_admin_profile_branding.ps1 +description: Creates and manages MSP admin accounts with SuperOps password sync +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Standardized Limehawk MSP automation that renames the built-in Administrator (SID *-500) to "hawkadmin" and disables it, creates or updates the "limehawk" MSP admin account for daily use, generates strong passwords for both accounts and pushes them to SuperOps custom fields, cleans up old MSP accounts (m5sadmin, tlitlocal, clientadmin), and applies account pictures and wallpaper branding. + + Usage Notes + ----------- + - Built-in admin identified by SID *-500, not by name + - If limehawk account exists, password is reset (safe for existing clients) + - Account picture and wallpaper operations are best-effort (no-throw) + - Requires SuperOps module with Send-CustomField cmdlet + - Configure account names, custom field mappings, branding asset paths, and password length via hardcoded settings + - Password length defaults to 16 characters + + Requirements + ------------ + - PowerShell 5.1+ + - Run as local Administrator (elevated) + - SuperOps module available ($SuperOpsModule) + - SuperOps custom fields: "Built-in Admin Password", "MSP Admin Password" +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI3Nw +lastPushedChecksum: "sha256:cc11c5cfa54f13ae" +lastPushedMetaChecksum: "sha256:73d1db985223e3cf" \ No newline at end of file diff --git a/scripts/local_user_admin_create.level.yaml b/scripts/local_user_admin_create.level.yaml new file mode 100644 index 0000000..d928c57 --- /dev/null +++ b/scripts/local_user_admin_create.level.yaml @@ -0,0 +1,33 @@ +name: local_user_admin_create.ps1 +description: Creates local administrator account with secure random password +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Creates or updates a local administrator account with a cryptographically secure random password. If the account exists, resets the password. If not, creates the account and adds it to the Administrators group. + + Usage Notes + ----------- + - Generates cryptographically secure random password (16 characters) + - Checks if user account exists + - If exists: resets password; if not: creates account and adds to Administrators group + - Password output to console for RMM custom field capture + - Password includes uppercase, lowercase, numbers, and special characters + - $NewAdminUsername: username for the local admin account (SuperOps runtime variable) + + Requirements + ------------ + - Windows 10/11 + - Admin privileges required + - PowerShell 5.1+ + + Security + -------- + - Password generated using RNGCryptoServiceProvider + - Consider storing password securely in RMM custom fields +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI3OA +lastPushedChecksum: "sha256:b00a562a4847602e" +lastPushedMetaChecksum: "sha256:8e99e15d821de3f9" \ No newline at end of file diff --git a/scripts/local_user_admin_setup.level.yaml b/scripts/local_user_admin_setup.level.yaml new file mode 100644 index 0000000..8a76d04 --- /dev/null +++ b/scripts/local_user_admin_setup.level.yaml @@ -0,0 +1,36 @@ +name: local_user_admin_setup.ps1 +description: Creates a new local administrator account for employee onboarding +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Creates a new local administrator account intended for employee onboarding. The account is created with a blank password and configured to force a password change at first interactive logon. The account is visible on the Windows login screen so the new employee can select it and set their own password immediately. + + Usage Notes + ----------- + - Account is created with a blank password by design + - Password change is forced at first logon via net user /logonpasswordchg:yes + - Fails if the account already exists (setup only, not reset) + - Account is added to the local Administrators group + - $NewAdminUsername: account username (SuperOps runtime variable) + - $NewAdminFullName: display name shown on login screen (SuperOps runtime variable) + + Requirements + ------------ + - Windows 10/11 + - Admin privileges required (runs as SYSTEM via RMM) + - PowerShell 5.1+ + - LocalAccounts module (built-in on Windows 10/11) + + Security + -------- + - Blank password is intentional for onboarding workflow + - Windows policy restricts blank password logon to the physical console only + - Network logon with blank password is blocked by default + - Employee must set a password at first interactive logon +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI3OQ +lastPushedChecksum: "sha256:5b01541855959832" +lastPushedMetaChecksum: "sha256:7719e7438de5965b" \ No newline at end of file diff --git a/scripts/local_user_admin_toggle.level.yaml b/scripts/local_user_admin_toggle.level.yaml new file mode 100644 index 0000000..f82cbd5 --- /dev/null +++ b/scripts/local_user_admin_toggle.level.yaml @@ -0,0 +1,29 @@ +name: local_user_admin_toggle.ps1 +description: Adds or removes a local user from the Administrators group +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Adds or removes a local user from the Administrators group. Idempotent operation that ensures the user's group membership aligns with the requested action. + + Usage Notes + ----------- + - Validates user exists before operation + - Checks current membership status + - Adds or removes from Administrators group + - Reports final status + - Operates on the built-in Administrators group + - $TargetUsername: the local user account to manage (SuperOps runtime variable) + - $Action: set to "add" or "remove" (hardcoded setting) + + Requirements + ------------ + - Windows 10/11 + - Admin privileges required + - Target user must exist locally +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI4MA +lastPushedChecksum: "sha256:d8f47d2d007aaf4c" +lastPushedMetaChecksum: "sha256:6ed97fab0330af93" \ No newline at end of file diff --git a/scripts/local_user_create.level.yaml b/scripts/local_user_create.level.yaml new file mode 100644 index 0000000..75e5910 --- /dev/null +++ b/scripts/local_user_create.level.yaml @@ -0,0 +1,33 @@ +name: local_user_create.ps1 +description: Creates local user account with optional administrator privileges +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Creates a new local user account with specified username and password. Optionally adds the user to the Administrators group. + + Usage Notes + ----------- + - Validates inputs before creating the account + - Creates a standard local user account + - Optionally adds the user to the Administrators group + - Reports final status with user details + + Requirements + ------------ + - Windows 10/11 + - Admin privileges required + - PowerShell 5.1+ + - Username provided via SuperOps $NewUsername variable + - Password provided via SuperOps $NewPassword variable + - AddToAdmin set to "Yes" or "No" (default: "No") + + Security + -------- + - Password visible in script -- use RMM variables for production +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI4MQ +lastPushedChecksum: "sha256:67aa5c484662ae59" +lastPushedMetaChecksum: "sha256:203f80e78d4fd48c" \ No newline at end of file diff --git a/scripts/local_user_delete.level.yaml b/scripts/local_user_delete.level.yaml new file mode 100644 index 0000000..e95788f --- /dev/null +++ b/scripts/local_user_delete.level.yaml @@ -0,0 +1,33 @@ +name: local_user_delete.ps1 +description: Deletes local user account and associated profile directory +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Deletes a local user account and its associated profile directory. Completely removes the user from the system including their files. + + Usage Notes + ----------- + - Set to "listusers" mode to list all local users without deleting + - Validates that the target user exists before proceeding + - Removes user profile via CIM, falls back to direct filesystem removal + - Removes the local user account after profile cleanup + - Reports final status + + Requirements + ------------ + - Windows 10/11 + - Admin privileges required + - PowerShell 5.1+ + - Username provided via SuperOps $UsernameToDelete variable + + Security + -------- + - Destructive operation -- data cannot be recovered + - Backup important data before running +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI4Mg +lastPushedChecksum: "sha256:16d8ccc7f3be11d4" +lastPushedMetaChecksum: "sha256:0f41c6379afcbb6c" \ No newline at end of file diff --git a/scripts/local_user_disable.level.yaml b/scripts/local_user_disable.level.yaml new file mode 100644 index 0000000..2364291 --- /dev/null +++ b/scripts/local_user_disable.level.yaml @@ -0,0 +1,29 @@ +name: local_user_disable.ps1 +description: Disables a local user account without deleting profile data +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Disables a local user account so it cannot be used to log in. The user profile and all data are preserved on disk. Use this for offboarding when data retention is required. + + Usage Notes + ----------- + - Validates username input + - Checks user exists and current enabled status + - Disables the local user account + - Logs off any active sessions for that user + - Preserves user profile and all files + - Account can be re-enabled with Enable-LocalUser + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges + - PowerShell 5.1+ + - $UsernameToDisable: local username to disable (SuperOps runtime variable) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI4Mw +lastPushedChecksum: "sha256:0f2f743bc9b235f6" +lastPushedMetaChecksum: "sha256:04dbfddb823cc39c" \ No newline at end of file diff --git a/scripts/macos_auto_updates_enable.level.yaml b/scripts/macos_auto_updates_enable.level.yaml new file mode 100644 index 0000000..5705aaf --- /dev/null +++ b/scripts/macos_auto_updates_enable.level.yaml @@ -0,0 +1,25 @@ +name: macos_auto_updates_enable.sh +description: Enables all automatic update settings on macOS +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Enables all automatic update settings on macOS including automatic checking, downloading, and installation of macOS updates, App Store updates, and security/critical updates. Ensures systems stay patched and secure. + + Usage Notes + ----------- + - Verifies root/sudo privileges before making changes + - Enables AutomaticCheckEnabled, AutomaticDownload, AutoUpdate + - Enables ConfigDataInstall, CriticalUpdateInstall, AutomaticallyInstallMacOSUpdates + - Verifies all settings were applied after enabling + + Requirements + ------------ + - macOS 10.14 or later + - Root/sudo privileges +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI4NA +lastPushedChecksum: "sha256:25ead792bd41f224" +lastPushedMetaChecksum: "sha256:4ce1ba02ae3dea40" \ No newline at end of file diff --git a/scripts/maintenance_reboot.level.yaml b/scripts/maintenance_reboot.level.yaml new file mode 100644 index 0000000..e92f451 --- /dev/null +++ b/scripts/maintenance_reboot.level.yaml @@ -0,0 +1,33 @@ +name: maintenance_reboot.ps1 +description: System reboot with graceful or force mode for maintenance +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Performs system reboot when uptime exceeds threshold or reboot flags are detected. Supports graceful mode (default) for servers/workstations with active users, which warns users and skips reboot if critical apps are running, and force mode for after-hours maintenance windows with immediate reboot. + + Usage Notes + ----------- + - Calculates current uptime from last boot time + - Checks Windows registry for reboot-pending flags (CBS, WU, PendingFileRename) + - Graceful mode: configurable warning delay ($WarningMinutes, default 5) + - Graceful mode: skips reboot if critical apps running (QuickBooks, SQL, etc.) + - Force mode: immediate forced reboot, no user warning + - If neither uptime nor flags trigger, no action taken + - $GracefulReboot default: true + - $DefaultMaxUptimeDays default: 7 + + Requirements + ------------ + - PowerShell 5.1+ + - Local Administrator rights + + Security + -------- + - Force mode will not prompt users -- use for empty machines only +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI4NQ +lastPushedChecksum: "sha256:7f7bd5e13d21a1a0" +lastPushedMetaChecksum: "sha256:ec38353eb325da89" \ No newline at end of file diff --git a/scripts/mrt_scan.level.yaml b/scripts/mrt_scan.level.yaml new file mode 100644 index 0000000..6a2e522 --- /dev/null +++ b/scripts/mrt_scan.level.yaml @@ -0,0 +1,30 @@ +name: mrt_scan.ps1 +description: Executes Windows Malicious Software Removal Tool with configurable scan mode +shell: POWERSHELL +runAs: SYSTEM +timeout: 3600 +readme: | + Purpose + ------- + Executes the built-in Windows Malicious Software Removal Tool (MRT.exe) with configurable scan mode. Designed for RMM deployment via SuperOps, allowing administrators to trigger Quick or Full silent scans on target endpoints. Displays scan status and log preview upon completion. + + Usage Notes + ----------- + - Validates administrative privileges before scanning + - Validates scan mode is Quick or Full + - Executes MRT with /Q for Quick or /F /Q for Full + - Waits for scan completion (minutes to hours depending on mode) + - Displays last 50 lines of MRT log file for review + - RMM variable injection configures $ScanMode at runtime + + Requirements + ------------ + - Windows OS with MRT.exe (included by default) + - Administrator privileges + - PowerShell 5.1+ + - SuperOps module available via $SuperOpsModule variable + - $ScanMode set to Quick or Full (case-insensitive) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI4Ng +lastPushedChecksum: "sha256:869633f2768cf87a" +lastPushedMetaChecksum: "sha256:80e7cbe7e02a4240" \ No newline at end of file diff --git a/scripts/msi_url_install.level.yaml b/scripts/msi_url_install.level.yaml new file mode 100644 index 0000000..04869c7 --- /dev/null +++ b/scripts/msi_url_install.level.yaml @@ -0,0 +1,28 @@ +name: msi_url_install.ps1 +description: Downloads and silently installs an MSI package from a specified URL +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and silently installs an MSI package from the URL specified in the MSIURL runtime variable. The file is saved to the temporary directory and cleaned up after installation completes. + + Usage Notes + ----------- + - Uses curl for fast, reliable downloads with redirect support + - Extracts filename from URL, falls back to downloaded_package.msi + - Runs msiexec with /qn (quiet, no UI) and /norestart flags + - Cleans up the temporary MSI file after installation + - Exit code 3010 indicates success but reboot required + + Requirements + ------------ + - PowerShell 5.1+ + - Admin rights + - Network connectivity + - $MsiScriptUrl set to the full URL of the MSI file (via SuperOps $MSIURL) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI4Nw +lastPushedChecksum: "sha256:11645faa554f4b42" +lastPushedMetaChecksum: "sha256:fa6304a82cedf013" \ No newline at end of file diff --git a/scripts/network_dhcp_set_macos.level.yaml b/scripts/network_dhcp_set_macos.level.yaml new file mode 100644 index 0000000..8918c9a --- /dev/null +++ b/scripts/network_dhcp_set_macos.level.yaml @@ -0,0 +1,28 @@ +name: network_dhcp_set_macos.sh +description: Configures macOS network interface to use DHCP for automatic IP +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Configures a macOS network interface to use DHCP for automatic IP addressing. Toggles the network service off and on to ensure the new DHCP settings take effect immediately. + + Usage Notes + ----------- + - Detects primary network interface automatically, falls back to en0 + - Edit INTERFACE variable to target a specific interface (en0, en1, etc.) + - Disables the network service, sets DHCP, then re-enables the service + - Verifies DHCP configuration after applying + - TOGGLE_DELAY controls wait time between off/on (default: 2 seconds) + - Temporarily disrupts network connectivity during toggle + + Requirements + ------------ + - Root/sudo access required + - macOS 10.14 or later + - networksetup command available +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI4OA +lastPushedChecksum: "sha256:0aedf22695283c5f" +lastPushedMetaChecksum: "sha256:6b73f50022607156" \ No newline at end of file diff --git a/scripts/network_scan.level.yaml b/scripts/network_scan.level.yaml new file mode 100644 index 0000000..cf2994a --- /dev/null +++ b/scripts/network_scan.level.yaml @@ -0,0 +1,28 @@ +name: network_scan.ps1 +description: Scans IP address range using multi-threaded ping to discover active hosts +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Scans a range of IP addresses using multi-threaded ping requests to discover active hosts on the network. Optionally resolves hostnames via DNS. + + Usage Notes + ----------- + - Edit $startIP and $endIP variables to set scan range + - Validates IP address range before scanning + - Creates runspace pool for parallel execution + - Set $disableDNS to true to skip hostname resolution (faster) + - Adjust $threads variable to control concurrency (default: 32) + - $pingAttempts controls number of ping attempts per IP (default: 1) + - Results sorted by IP address with hostname if DNS enabled + + Requirements + ------------ + - Windows PowerShell 5.1 or later + - Network access to target IP range +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI4OQ +lastPushedChecksum: "sha256:a9fb4a959015c576" +lastPushedMetaChecksum: "sha256:cb5aec02bc2ab99c" \ No newline at end of file diff --git a/scripts/network_service_refresh_macos.level.yaml b/scripts/network_service_refresh_macos.level.yaml new file mode 100644 index 0000000..f338821 --- /dev/null +++ b/scripts/network_service_refresh_macos.level.yaml @@ -0,0 +1,28 @@ +name: network_service_refresh_macos.sh +description: Refreshes all macOS network services by toggling them off and on +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Refreshes all network services on macOS by toggling them off and on. Preserves the original enabled/disabled state of each service. Useful for resolving DHCP lease issues, DNS problems, or general network connectivity problems without requiring a full system restart. + + Usage Notes + ----------- + - Lists all network services and processes each one + - Records initial enabled/disabled state before toggling + - Disables each service, waits briefly, then re-enables + - Restores original state if a service was previously disabled + - TOGGLE_DELAY controls wait time between off/on (default: 2 seconds) + - Temporarily disrupts network connectivity during refresh + + Requirements + ------------ + - Root/sudo access required + - macOS 10.14 or later + - networksetup command available +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI5MA +lastPushedChecksum: "sha256:5c518394b55357ae" +lastPushedMetaChecksum: "sha256:dfafcc5d6cef2dd1" \ No newline at end of file diff --git a/scripts/ninjaone_uninstall.level.yaml b/scripts/ninjaone_uninstall.level.yaml new file mode 100644 index 0000000..9767547 --- /dev/null +++ b/scripts/ninjaone_uninstall.level.yaml @@ -0,0 +1,29 @@ +name: ninjaone_uninstall.ps1 +description: Completely removes NinjaOne RMM agent and Ninja Remote from Windows +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Completely removes NinjaOne RMM agent and Ninja Remote from a Windows system. Includes disabling uninstall prevention, removing services, cleaning up registry entries, and removing the virtual display driver. + + Usage Notes + ----------- + - Auto-detects NinjaOne installation path from registry + - Disables uninstall prevention before running MSI uninstaller + - Stops and removes NinjaRMMAgent, nmsmanager, and lockhart services + - Kills running processes after service removal + - Removes installation directories and data directories + - Cleans up registry entries in HKLM + - Removes Ninja Remote components and virtual display driver + - Creates transcript log in Windows\temp for review + + Requirements + ------------ + - Windows OS + - Administrator privileges +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI5MQ +lastPushedChecksum: "sha256:c5cf794d589cf8bc" +lastPushedMetaChecksum: "sha256:1d07441138e0c6b2" \ No newline at end of file diff --git a/scripts/nircmd_resolution_set.level.yaml b/scripts/nircmd_resolution_set.level.yaml new file mode 100644 index 0000000..ecf2e32 --- /dev/null +++ b/scripts/nircmd_resolution_set.level.yaml @@ -0,0 +1,28 @@ +name: nircmd_resolution_set.ps1 +description: Changes display resolution using NirSoft NirCmd utility +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Changes the display resolution using NirSoft's NirCmd utility. Downloads NirCmd if not already present, then sets the specified resolution. + + Usage Notes + ----------- + - Creates destination directory if it does not exist + - Downloads NirCmd (x86 version for compatibility) from official NirSoft website + - Extracts NirCmd from zip archive + - Sets display resolution to specified values and cleans up zip file + - Edit $resolutionWidth, $resolutionHeight, and $colorDepth variables + - $destinationFolder default: C:\limehawk\nircmd + + Requirements + ------------ + - Windows 10/11 or Windows Server + - Internet access for NirCmd download + - Display must support the requested resolution +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI5Mg +lastPushedChecksum: "sha256:144f3fde5574868a" +lastPushedMetaChecksum: "sha256:5ca9f9cf9f5a5181" \ No newline at end of file diff --git a/scripts/nircmd_screenshot.level.yaml b/scripts/nircmd_screenshot.level.yaml new file mode 100644 index 0000000..8a6cb98 --- /dev/null +++ b/scripts/nircmd_screenshot.level.yaml @@ -0,0 +1,29 @@ +name: nircmd_screenshot.ps1 +description: Captures screenshot using NirSoft NirCmd utility +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Captures a screenshot of the current display using NirSoft's NirCmd utility. Downloads NirCmd if not already present, then saves a timestamped screenshot. + + Usage Notes + ----------- + - Creates destination directories if they do not exist + - Downloads correct NirCmd version (x64 or x86) based on OS architecture + - Extracts NirCmd from zip archive + - Captures screenshot with timestamped filename + - Cleans up temporary zip file after extraction + - $destinationFolder default: C:\limehawk\nirsoft + - $screenshotFolder default: C:\limehawk\nirsoft\screenshots + + Requirements + ------------ + - Windows 10/11 or Windows Server + - Internet access for NirCmd download (official NirSoft website) + - Write permissions to destination folder +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI5Mw +lastPushedChecksum: "sha256:1796923bd56b59bc" +lastPushedMetaChecksum: "sha256:14d852f3133d9e8d" \ No newline at end of file diff --git a/scripts/nirsoft_uninstall_view.level.yaml b/scripts/nirsoft_uninstall_view.level.yaml new file mode 100644 index 0000000..a270b00 --- /dev/null +++ b/scripts/nirsoft_uninstall_view.level.yaml @@ -0,0 +1,30 @@ +name: nirsoft_uninstall_view.ps1 +description: Uses NirSoft UninstallView to uninstall software matching patterns +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads NirSoft UninstallView utility and uses it to uninstall software matching a specified pattern using wildcard matching. + + Usage Notes + ----------- + - Set the SuperOps runtime variable $YourAppPatternHere to the application name or pattern to uninstall + - Supports wildcards (e.g., Adobe*, *Chrome*, etc.) + - Determines system architecture and downloads appropriate 32/64-bit version + - Extracts to limehawk\nirsoft directory + - Runs uninstall command with wildcard matching + - Cleans up downloaded zip file after extraction + - Check manually after execution to confirm uninstallation + + Requirements + ------------ + - Windows OS + - Administrator privileges + - Internet connectivity (downloads from official NirSoft website) + - $YourAppPatternHere: application name or pattern to uninstall (SuperOps runtime variable) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI5NA +lastPushedChecksum: "sha256:87cabcfd5f2ac46f" +lastPushedMetaChecksum: "sha256:5ccf687959bb12b2" \ No newline at end of file diff --git a/scripts/nvram_reset_reboot_macos.level.yaml b/scripts/nvram_reset_reboot_macos.level.yaml new file mode 100644 index 0000000..c36e627 --- /dev/null +++ b/scripts/nvram_reset_reboot_macos.level.yaml @@ -0,0 +1,32 @@ +name: nvram_reset_reboot_macos.sh +description: Resets NVRAM and schedules immediate macOS reboot +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Schedules an NVRAM reset on the next reboot and immediately reboots the Mac. NVRAM (Non-Volatile Random-Access Memory) stores system settings that macOS accesses quickly, including startup disk selection, display resolution, speaker volume, time zone information, and recent kernel panic information. Useful for troubleshooting boot issues, display problems, audio issues, startup disk not found errors, and time/date problems. + + Usage Notes + ----------- + - Detects Mac architecture (Intel vs Apple Silicon) + - Displays current NVRAM values before reset + - Sets NVRAM variable to trigger reset on next boot + - Immediately reboots the system after setting reset flag + - User data is not affected (only system settings reset) + + Requirements + ------------ + - Root/sudo access required + - macOS 10.14 or later + - Intel-based Mac (Apple Silicon uses different reset method) + + Security + -------- + - Runs with elevated privileges (sudo required) + - Will immediately reboot the system +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI5NQ +lastPushedChecksum: "sha256:706557f66e04e540" +lastPushedMetaChecksum: "sha256:01867e65928c912f" \ No newline at end of file diff --git a/scripts/onedrive_reenable.level.yaml b/scripts/onedrive_reenable.level.yaml new file mode 100644 index 0000000..94f1de0 --- /dev/null +++ b/scripts/onedrive_reenable.level.yaml @@ -0,0 +1,30 @@ +name: onedrive_reenable.ps1 +description: Removes OneDrive blocking policies and reinstalls OneDrive +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Reverses the registry policies set by onedrive_remove_complete.ps1 and reinstalls OneDrive. Use this when a machine needs to switch back to Microsoft services. + + Usage Notes + ----------- + - Validates administrative privileges + - Removes HKLM GPO DisableFileSyncNGSC policy + - Removes Explorer DisableOneDriveFileSync policy + - Optionally cleans Default User profile policies + - Downloads and installs OneDrive from Microsoft CDN + - $installOneDrive: download and install OneDrive (default: true) + - $cleanDefaultProfile: also clean Default User profile (default: true) + - OneDrive download URL: https://go.microsoft.com/fwlink/?linkid=844652 + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges + - Network connectivity to Microsoft CDN (for installation) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI5Ng +lastPushedChecksum: "sha256:640ca7ab752253cc" +lastPushedMetaChecksum: "sha256:927a6fa438d77c73" \ No newline at end of file diff --git a/scripts/onedrive_remove_complete.level.yaml b/scripts/onedrive_remove_complete.level.yaml new file mode 100644 index 0000000..c033f10 --- /dev/null +++ b/scripts/onedrive_remove_complete.level.yaml @@ -0,0 +1,31 @@ +name: onedrive_remove_complete.ps1 +description: Completely removes Microsoft OneDrive with startup suppression +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Performs a complete, multi-path uninstallation of Microsoft OneDrive with permanent startup suppression. Stops running processes, executes the official Microsoft uninstall utility against all known install paths (system and Office), removes scheduled tasks, and applies registry policies to prevent reinstallation. + + Usage Notes + ----------- + - Stops all running OneDrive processes + - Executes OneDriveSetup.exe /uninstall for each found path (System32, SysWOW64, Office x86, Office x64) + - Removes all OneDrive scheduled tasks + - Sets HKLM GPO DisableFileSyncNGSC=1 to prevent startup for all users + - Removes HKCU Run key OneDrive entry + - Sets Explorer policy to hide OneDrive from navigation pane + - Cleans Default User profile to prevent OneDrive on new accounts + - $cleanDefaultProfile controls Default User cleanup (default: true) + - Reboot recommended for full cleanup + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges + - No network requirements (local operations only) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI5Nw +lastPushedChecksum: "sha256:e1f4ee52cb2ad974" +lastPushedMetaChecksum: "sha256:1763b0675e257efc" \ No newline at end of file diff --git a/scripts/onestart_remove_complete.level.yaml b/scripts/onestart_remove_complete.level.yaml new file mode 100644 index 0000000..aef65b4 --- /dev/null +++ b/scripts/onestart_remove_complete.level.yaml @@ -0,0 +1,35 @@ +name: onestart_remove_complete.ps1 +description: Completely removes OneStart.ai PUP from Windows systems +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Completely removes OneStart.ai browser/PUP from Windows systems. First attempts a clean uninstall via NirSoft UninstallView, then performs manual cleanup of any remaining processes, files, registry keys, and scheduled tasks. + + Usage Notes + ----------- + - Downloads NirSoft UninstallView (architecture-appropriate) + - Attempts silent uninstall of OneStart via UninstallView + - Terminates any running OneStart/DBar processes + - Removes scheduled tasks matching OneStart patterns + - Removes leftover files and folders from AppData, ProgramData, Program Files + - Backs up registry keys to SystemDrive\limehawk\registry_backup before removal + - Cleans up registry keys in HKCU and HKLM + - $appName default: OneStart + + Requirements + ------------ + - Windows PowerShell 5.1+ + - Administrative privileges required + - Internet access for UninstallView download + + Security + -------- + - Only removes OneStart-related items using known paths and patterns + - Registry keys are backed up before removal for recovery if needed +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI5OA +lastPushedChecksum: "sha256:a672ec29a7dc6a4b" +lastPushedMetaChecksum: "sha256:00d73bce056db2aa" \ No newline at end of file diff --git a/scripts/onlyoffice_install.level.yaml b/scripts/onlyoffice_install.level.yaml new file mode 100644 index 0000000..4b2ad75 --- /dev/null +++ b/scripts/onlyoffice_install.level.yaml @@ -0,0 +1,27 @@ +name: onlyoffice_install.ps1 +description: Downloads and silently installs OnlyOffice Desktop Editors +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and silently installs OnlyOffice Desktop Editors, a free office suite compatible with Microsoft Office formats. + + Usage Notes + ----------- + - Validates input parameters before proceeding + - Downloads OnlyOffice MSI installer to temp directory + - Installs silently using msiexec + - Cleans up installer file after completion + - $downloadUrl points to official OnlyOffice website + + Requirements + ------------ + - Windows OS (64-bit) + - Administrator privileges + - Internet connectivity +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDI5OQ +lastPushedChecksum: "sha256:85daf10183a79aef" +lastPushedMetaChecksum: "sha256:4b64ef7800cf0aec" \ No newline at end of file diff --git a/scripts/openssh_server_remove.level.yaml b/scripts/openssh_server_remove.level.yaml new file mode 100644 index 0000000..0c41dc4 --- /dev/null +++ b/scripts/openssh_server_remove.level.yaml @@ -0,0 +1,33 @@ +name: openssh_server_remove.ps1 +description: Removes OpenSSH Server, firewall rule, and cleans up config +shell: POWERSHELL +runAs: SYSTEM +timeout: 300 +readme: | + Purpose + ------- + Stops and removes the OpenSSH Server from Windows. Removes the firewall rule, uninstalls the Windows capability, and optionally cleans up the sshd configuration directory. + + Usage Notes + ----------- + - Stops the sshd and ssh-agent services + - Removes the Windows Firewall rule OpenSSH-Server-In-TCP + - Removes the default shell registry key + - Uninstalls the OpenSSH.Server Windows capability + - Removes sshd config directory if configured (default: true) + - $RemoveConfig controls whether to delete C:\ProgramData\ssh (default: true) + - $RemoveHostKeys controls whether to delete host keys with config (default: true) + + Requirements + ------------ + - Windows Server 2019+ or Windows 10 1809+ + - Administrator privileges + + Security + -------- + - Host keys are deleted by default to prevent reuse + - Config removal ensures no stale authorized_keys remain +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMwMA +lastPushedChecksum: "sha256:71f9a649c4db3f9b" +lastPushedMetaChecksum: "sha256:b0fae51c710c8234" \ No newline at end of file diff --git a/scripts/openssh_server_setup.level.yaml b/scripts/openssh_server_setup.level.yaml new file mode 100644 index 0000000..1023b88 --- /dev/null +++ b/scripts/openssh_server_setup.level.yaml @@ -0,0 +1,40 @@ +name: openssh_server_setup.ps1 +description: Installs and configures OpenSSH Server on Windows +shell: POWERSHELL +runAs: SYSTEM +timeout: 300 +readme: | + Purpose + ------- + Installs the OpenSSH Server Windows capability, configures the sshd service for automatic startup, enables public key authentication, and opens the Windows Firewall for SSH traffic on port 22. + + Usage Notes + ----------- + - Checks if OpenSSH Server is already installed before proceeding + - Configures sshd_config for key auth and restricted access + - Default shell set to PowerShell for SSH sessions + - Access restricted to Administrators group via AllowGroups in sshd_config + - Configures sshd service for Automatic (Delayed Start) + - Opens Windows Firewall for SSH traffic on configured port + - Verifies SSH is listening on the configured port after start + - $SshPort default: 22 + - $DefaultShell default: PowerShell + - $AllowedUsersGroup default: Administrators + - Password authentication: enabled + - Public key authentication: enabled + + Requirements + ------------ + - Windows Server 2019+ or Windows 10 1809+ + - Administrator privileges + - Internet access if OpenSSH capability not already present + + Security + -------- + - Access restricted to Administrators group by default + - Public key authentication enabled for passwordless access + - Password authentication left enabled for initial setup convenience +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMwMQ +lastPushedChecksum: "sha256:c182f7aae76eb7a9" +lastPushedMetaChecksum: "sha256:ed6fdd260dab7da6" \ No newline at end of file diff --git a/scripts/outlook_link_handling_fix.level.yaml b/scripts/outlook_link_handling_fix.level.yaml new file mode 100644 index 0000000..f9083d2 --- /dev/null +++ b/scripts/outlook_link_handling_fix.level.yaml @@ -0,0 +1,27 @@ +name: outlook_link_handling_fix.ps1 +description: Configures Outlook to open hyperlinks in the default browser +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Fixes an issue where clicking shared file links (OneDrive, SharePoint) in Outlook incorrectly launches Outlook Classic instead of opening in the default web browser. Sets the documented Office link handling registry values to use the system default browser. + + Usage Notes + ----------- + - Checks if the Office Links registry path exists and creates it if missing + - Sets BrowserChoice to 1 (Default Browser) + - Sets DecisionComplete to 1 (locks in the preference) + - Restart Outlook after running for changes to take effect + - $registryPath: HKCU:\Software\Microsoft\Office\16.0\Common\Links + + Requirements + ------------ + - PowerShell 5.1 or later + - No administrator privileges required (HKCU is user-writable) + - Microsoft Office 2016 or later (Office 16.0) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMwMg +lastPushedChecksum: "sha256:bfcb50c6b844cef4" +lastPushedMetaChecksum: "sha256:04fef14eb0b70e39" \ No newline at end of file diff --git a/scripts/outlook_new_force_migrate.level.yaml b/scripts/outlook_new_force_migrate.level.yaml new file mode 100644 index 0000000..9a41480 --- /dev/null +++ b/scripts/outlook_new_force_migrate.level.yaml @@ -0,0 +1,30 @@ +name: outlook_new_force_migrate.ps1 +description: Forces migration to New Outlook and hides toggle to prevent revert to Classic +shell: POWERSHELL +runAs: SYSTEM +timeout: 3600 +readme: | + Purpose + ------- + Forces all user profiles on a machine to migrate to New Outlook and prevents them from switching back to Classic Outlook. Applies per-user registry keys across all loaded and unloaded user hives (runs as SYSTEM via RMM), and sets machine-wide HKLM policies to enforce New Outlook as the default mail client. + + Usage Notes + ----------- + - Enumerates all user profiles from the registry ProfileList + - Temporarily loads unloaded ntuser.dat hives to apply per-user keys + - Sets DoNewOutlookAutoMigration, UseNewOutlook, and HideNewOutlookToggle per user + - Applies machine-wide HKLM policies (NewOutlookMigrationComplete, UseNewOutlook, OneWinNativeOutlookEnabled) + - Unloads any hives that were temporarily loaded + - All four options default to $true (full lockdown to New Outlook) + - Set individual options to $false to keep specific behaviors + - Users will not be able to revert to Classic Outlook without admin intervention + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges required (runs as SYSTEM via RMM) + - Windows 10/11 +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMwMw +lastPushedChecksum: "sha256:e983e27a747703ea" +lastPushedMetaChecksum: "sha256:158f24a6adb6916b" \ No newline at end of file diff --git a/scripts/outlook_new_remove.level.yaml b/scripts/outlook_new_remove.level.yaml new file mode 100644 index 0000000..d257193 --- /dev/null +++ b/scripts/outlook_new_remove.level.yaml @@ -0,0 +1,27 @@ +name: outlook_new_remove.ps1 +description: Removes the New Outlook (Microsoft.OutlookForWindows) app from all user profiles and prevents reinstallation +shell: POWERSHELL +runAs: SYSTEM +timeout: 600 +readme: | + Purpose + ------- + Removes the "New Outlook" (Microsoft.OutlookForWindows) Appx package from all user profiles on a Windows machine and prevents it from being reprovisioned. Used when organizations want to keep users on Classic Outlook and prevent the new Outlook from appearing via Windows Update or new user provisioning. + + Usage Notes + ----------- + - Checks if Microsoft.OutlookForWindows is installed via Get-AppxPackage + - Removes the package from all user profiles with Remove-AppxPackage -AllUsers + - Removes the provisioned package so new user profiles do not get it + - Deletes the OutlookUpdate registry key under UScheduler to prevent re-provisioning via Windows Update + - No configurable inputs required - targets Microsoft.OutlookForWindows specifically + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges + - No network requirements (local operations only) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMwNA +lastPushedChecksum: "sha256:b2ff05e51e2d5e97" +lastPushedMetaChecksum: "sha256:b28aed12e71c2c75" \ No newline at end of file diff --git a/scripts/outlook_new_restore.level.yaml b/scripts/outlook_new_restore.level.yaml new file mode 100644 index 0000000..4c7b0cc --- /dev/null +++ b/scripts/outlook_new_restore.level.yaml @@ -0,0 +1,28 @@ +name: outlook_new_restore.ps1 +description: Reinstalls the New Outlook app and re-enables the Try the new Outlook toggle +shell: POWERSHELL +runAs: SYSTEM +timeout: 600 +readme: | + Purpose + ------- + Reverses the remove_new_outlook.ps1 script by reinstalling the New Outlook (Microsoft.OutlookForWindows) app and re-enabling the "Try the new Outlook" toggle in Classic Outlook. Used when an organization wants to roll back the removal and allow users to access New Outlook again. + + Usage Notes + ----------- + - Resolves winget path with SYSTEM context awareness for RMM compatibility + - Installs Microsoft.OutlookForWindows via winget with silent and accept flags + - Falls back to Add-AppxPackage with Microsoft Store URI if winget is unavailable + - Recreates the OutlookUpdate registry key under UScheduler so Windows Update can provision the app again + - Removes the HideNewOutlookToggle registry value from loaded user hives to re-enable the toggle in Classic Outlook + - No configurable inputs required - targets Microsoft.OutlookForWindows specifically + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges + - winget recommended (falls back to Store URI if unavailable) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMwNQ +lastPushedChecksum: "sha256:45a3649ff7a97649" +lastPushedMetaChecksum: "sha256:4bf3be293721ff57" \ No newline at end of file diff --git a/scripts/password_files_search.level.yaml b/scripts/password_files_search.level.yaml new file mode 100644 index 0000000..9308e1b --- /dev/null +++ b/scripts/password_files_search.level.yaml @@ -0,0 +1,31 @@ +name: password_files_search.ps1 +description: Searches user profiles for password and credential files +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Scans all user profiles on a Windows machine for files that may contain passwords or credentials. Useful for security audits to identify exposed sensitive data in common user directories. + + Usage Notes + ----------- + - Enumerates all user profiles in C:\Users (excludes Public, Default) + - Searches Desktop, Documents, Downloads, Pictures, and cloud folders (OneDrive, Dropbox, Google Drive, Box) + - Patterns include: *password*, *credential*, *creds*, *logins*, etc. + - Critical patterns flagged separately: 1Password Emergency Kit, KeePass, BitWarden backup, seed phrase, private keys + - Uses Windows Search Index if available, falls back to filesystem search + - Max search depth: 10 levels + - Optional Google Chat webhook alert via $GoogleChatWebhook variable (sent only when files found) + - Read-only operation -- does not modify or delete files + - File contents are NOT read, only metadata reported (path, size, modified date) + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges (to access other user profiles) + - SuperOps runtime variable: GoogleChatWebhook (optional) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMwNg +lastPushedChecksum: "sha256:74b41d5efc2d9aad" +lastPushedMetaChecksum: "sha256:cd158eec1d02200e" \ No newline at end of file diff --git a/scripts/password_files_tickets_search.level.yaml b/scripts/password_files_tickets_search.level.yaml new file mode 100644 index 0000000..3ac17c9 --- /dev/null +++ b/scripts/password_files_tickets_search.level.yaml @@ -0,0 +1,36 @@ +name: password_files_tickets_search.ps1 +description: Searches for password files and creates SuperOps tickets +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Scans all user profiles on a Windows machine for files that may contain passwords or credentials. Creates a SuperOps ticket assigned to the requester associated with the asset when findings are detected. + + Usage Notes + ----------- + - Enumerates all user profiles in C:\Users (excludes Public, Default) + - Searches Desktop, Documents, Downloads, Pictures, and cloud folders + - Patterns include: *password*, *credential*, *creds*, *logins*, etc. + - Separates critical findings from regular findings + - Critical findings trigger HIGH priority tickets; regular findings get Medium priority + - Looks up asset in SuperOps by hostname and assigns ticket to asset's requester + - Optional Google Chat webhook alert in addition to ticket creation + - Read-only file operation -- does not modify or delete files + - File contents are NOT read, only metadata reported + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges (to access other user profiles) + - SuperOps API key with ticket creation permissions ($SuperOpsApiKey runtime variable) + - Optional: GoogleChatWebhook runtime variable for webhook alerts + + Security + -------- + - API key should be stored securely in SuperOps variables +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMwNw +lastPushedChecksum: "sha256:e3aaedff2a6342a9" +lastPushedMetaChecksum: "sha256:c40aab6caa59ebbc" \ No newline at end of file diff --git a/scripts/potplayer_install.level.yaml b/scripts/potplayer_install.level.yaml new file mode 100644 index 0000000..ccedfc6 --- /dev/null +++ b/scripts/potplayer_install.level.yaml @@ -0,0 +1,28 @@ +name: potplayer_install.ps1 +description: Downloads and silently installs PotPlayer media player +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and silently installs PotPlayer media player. Automatically selects the correct version (32-bit or 64-bit) based on system architecture. + + Usage Notes + ----------- + - Fetches PotPlayer website to find download links + - Selects appropriate version based on OS architecture + - Downloads installer to temp directory + - Installs silently using /S switch + - Cleans up installer file after completion + + Requirements + ------------ + - Windows OS + - Administrator privileges + - Internet connectivity + - $baseUrl: Base URL for PotPlayer website to scrape download links +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMwOA +lastPushedChecksum: "sha256:7533ac610d424652" +lastPushedMetaChecksum: "sha256:e34a1ac1f92a47b7" \ No newline at end of file diff --git a/scripts/power_plans_default_add.level.yaml b/scripts/power_plans_default_add.level.yaml new file mode 100644 index 0000000..bf3fe87 --- /dev/null +++ b/scripts/power_plans_default_add.level.yaml @@ -0,0 +1,28 @@ +name: power_plans_default_add.ps1 +description: Restores missing default Windows power plans +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Adds the four standard Windows power plans (High Performance, Ultimate Performance, Power Saver, and Balanced) by duplicating them from their default GUIDs. Useful for restoring missing power plans on systems where they have been removed or are unavailable. + + Usage Notes + ----------- + - Duplicates High Performance power plan + - Duplicates Ultimate Performance power plan (Win10 1803+) + - Duplicates Power Saver power plan + - Duplicates Balanced power plan + - Reports success/failure for each plan + - Skips plans that already exist + + Requirements + ------------ + - Windows 10/11 or Windows Server 2016+ + - Administrator privileges + - powercfg.exe available (standard Windows component) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMwOQ +lastPushedChecksum: "sha256:3bb8c3a5422e2db1" +lastPushedMetaChecksum: "sha256:9998ceb48258c846" \ No newline at end of file diff --git a/scripts/power_profile_always_on_set.level.yaml b/scripts/power_profile_always_on_set.level.yaml new file mode 100644 index 0000000..50c433c --- /dev/null +++ b/scripts/power_profile_always_on_set.level.yaml @@ -0,0 +1,31 @@ +name: power_profile_always_on_set.ps1 +description: Creates custom always-on power plan for workstations +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Creates a custom "Always On - Limehawk" power plan optimized for workstations that should never sleep while on AC power. If the plan already exists, it will be reused and reconfigured. The plan is based on High Performance settings. + + Usage Notes + ----------- + - Creates or reuses custom power plan based on High Performance + - Sets the custom plan as the active power plan + - Configures display, disk, standby, and hibernate timeouts for AC and DC power + - Disables hibernation on desktops (no battery) + - Default settings: Display 30min AC, Sleep never AC, Hibernate never AC + - Windows 11: Custom plans work but are hidden in Settings app + - To verify: Run control powercfg.cpl or powercfg /getactivescheme + + Requirements + ------------ + - Windows 10/11 or Windows Server 2016+ + - Administrator privileges + - High Performance power plan must exist + - $customPlanName: Name of the custom power plan + - Timeout variables: $displayTimeoutAC/DC, $diskTimeoutAC/DC, $standbyTimeoutAC/DC, $hibernateTimeoutAC/DC +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMxMA +lastPushedChecksum: "sha256:27bd0adef334e036" +lastPushedMetaChecksum: "sha256:6baf5970ca55c03c" \ No newline at end of file diff --git a/scripts/power_profile_set_macos.level.yaml b/scripts/power_profile_set_macos.level.yaml new file mode 100644 index 0000000..d2b521a --- /dev/null +++ b/scripts/power_profile_set_macos.level.yaml @@ -0,0 +1,26 @@ +name: power_profile_set_macos.sh +description: Configures always-on power settings for macOS systems +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Configures an "always-on" power profile for macOS laptops and desktops. Sets display sleep, disk sleep, system sleep, and hibernation settings based on whether the device has a battery (laptop vs desktop). + + Usage Notes + ----------- + - Auto-detects battery presence to identify laptop vs desktop + - Desktop (no battery): Display 30min, Disk 60min, System Sleep never, Hibernation disabled + - Laptop (with battery): Display 30min AC / 10min DC, Disk 60min AC / 30min DC, System Sleep 20min DC, Hibernation enabled + - Configures all settings via pmset + + Requirements + ------------ + - macOS 10.12 or later + - Root/sudo privileges + - pmset utility (standard macOS component) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMxMQ +lastPushedChecksum: "sha256:6f8c56d312326c36" +lastPushedMetaChecksum: "sha256:bb301f6395f145ee" \ No newline at end of file diff --git a/scripts/prinstall_add.level.yaml b/scripts/prinstall_add.level.yaml new file mode 100644 index 0000000..7c5afd9 --- /dev/null +++ b/scripts/prinstall_add.level.yaml @@ -0,0 +1,33 @@ +name: prinstall_add.ps1 +description: Installs a network or USB printer using prinstall 0.3.0+ +shell: POWERSHELL +runAs: SYSTEM +timeout: 600 +readme: | + Purpose + ------- + Installs a printer on Windows using prinstall 0.3.0+. Network mode walks the full four-tier driver resolution pipeline (local store -> manufacturer download -> Microsoft Update Catalog HWID match -> IPP Class Driver fallback) automatically. USB mode swaps the driver on an existing PnP-created queue via Set-Printer. + + Usage Notes + ----------- + - Set $usbMode to $true for USB printers (driver swap on existing queue) + - Network mode: set $YourPrinterIpHere + - USB mode: set $YourUsbQueueNameHere to the existing queue name (e.g. "Brother MFC-L2750DW") + - Driver name optional via $YourDriverNameHere (auto-detects if not set) + - Display name optional via $YourPrinterNameHere (uses model name if not set) + - Requires prinstall.exe installed (run prinstall_setup.ps1 first) + + Requirements + ------------ + - Windows OS + - Administrator privileges + - prinstall.exe 0.3.0 or newer installed + - Network access to printer IP (network mode only) + - $YourPrinterIpHere: Printer IP address (network mode) + - $YourUsbQueueNameHere: Existing USB queue name (USB mode) + - $YourDriverNameHere: (optional) Specific driver name + - $YourPrinterNameHere: (optional) Display name for the printer +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMxMg +lastPushedChecksum: "sha256:14ba5595155d0539" +lastPushedMetaChecksum: "sha256:909105b5f9ee34c0" \ No newline at end of file diff --git a/scripts/prinstall_driver_add.level.yaml b/scripts/prinstall_driver_add.level.yaml new file mode 100644 index 0000000..39e7903 --- /dev/null +++ b/scripts/prinstall_driver_add.level.yaml @@ -0,0 +1,29 @@ +name: prinstall_driver_add.ps1 +description: Stages a driver into the Windows driver store using prinstall 0.4.12+ +shell: POWERSHELL +runAs: SYSTEM +timeout: 600 +readme: | + Purpose + ------- + Stages a print driver on Windows using prinstall 0.4.12+ without creating a printer queue. Target auto-detects as either a filesystem path (INF or folder) or a model string ("HP LaserJet 1320"). Model-string targets download the manufacturer pack from prinstall's embedded manifest and stage it. + + Usage Notes + ----------- + - Set $YourDriverTargetHere to a path OR a model string + - For model strings with multiple matches, set $YourDriverNameHere to pick one explicitly (ignored for path targets) + - Leave $noVerify $false unless a vendor pack ships without .cat signatures + - Requires prinstall.exe 0.4.12+ installed (run prinstall_setup.ps1 first) + + Requirements + ------------ + - Windows OS + - Administrator privileges + - prinstall.exe 0.4.12 or newer installed + - Internet connectivity (model-string targets only) + - $YourDriverTargetHere: Path or model string + - $YourDriverNameHere: (optional) Explicit driver pick for model targets +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMxMw +lastPushedChecksum: "sha256:a65408cecc70eaf4" +lastPushedMetaChecksum: "sha256:96b999bd1c07b8e3" \ No newline at end of file diff --git a/scripts/prinstall_driver_list.level.yaml b/scripts/prinstall_driver_list.level.yaml new file mode 100644 index 0000000..fc85380 --- /dev/null +++ b/scripts/prinstall_driver_list.level.yaml @@ -0,0 +1,24 @@ +name: prinstall_driver_list.ps1 +description: Lists drivers in the Windows driver store using prinstall 0.4.13+ +shell: POWERSHELL +runAs: SYSTEM +timeout: 300 +readme: | + Purpose + ------- + Enumerates every driver in the Windows driver store via prinstall 0.4.13+. Useful for RMM audits and for discovering the exact driver name to feed into `prinstall_driver_remove.ps1`. Date column populates from Get-PrinterDriver's DriverDate field, with an INF DriverVer fallback for drivers Windows doesn't report a date for directly. + + Usage Notes + ----------- + - Default output is a pretty table; set $asJson $true for a parseable JSON payload + - Read-only — no admin privileges required + - Requires prinstall.exe 0.4.13+ installed (run prinstall_setup.ps1 first) + + Requirements + ------------ + - Windows OS + - prinstall.exe 0.4.13 or newer installed +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMxNA +lastPushedChecksum: "sha256:feaf37e6d0aa7773" +lastPushedMetaChecksum: "sha256:28995de0f60bab15" \ No newline at end of file diff --git a/scripts/prinstall_driver_remove.level.yaml b/scripts/prinstall_driver_remove.level.yaml new file mode 100644 index 0000000..3c3ab92 --- /dev/null +++ b/scripts/prinstall_driver_remove.level.yaml @@ -0,0 +1,27 @@ +name: prinstall_driver_remove.ps1 +description: Removes a driver from the Windows driver store using prinstall 0.4.13+ +shell: POWERSHELL +runAs: SYSTEM +timeout: 600 +readme: | + Purpose + ------- + Removes a print driver from the Windows driver store using prinstall 0.4.13+. Target is either an exact driver name or a fuzzy/model string that resolves to one staged driver. If the driver is in use by any printer queue, refuses unless $force = $true (cascade — removes dependent queues first). + + Usage Notes + ----------- + - Set $YourDriverTargetHere to the driver name from `prinstall driver list` or a fuzzy string + - Leave $force $false by default — only set to $true when you explicitly want to destroy dependent queues + - Windows system drivers (Microsoft IPP Class Driver, etc.) cannot be removed + - Requires prinstall.exe 0.4.13+ installed (run prinstall_setup.ps1 first) + + Requirements + ------------ + - Windows OS + - Administrator privileges + - prinstall.exe 0.4.13 or newer installed + - $YourDriverTargetHere: Exact driver name OR fuzzy/model string +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMxNQ +lastPushedChecksum: "sha256:2807dd15e3ce2e70" +lastPushedMetaChecksum: "sha256:7d3f1836096ae023" \ No newline at end of file diff --git a/scripts/prinstall_drivers.level.yaml b/scripts/prinstall_drivers.level.yaml new file mode 100644 index 0000000..9b49d6d --- /dev/null +++ b/scripts/prinstall_drivers.level.yaml @@ -0,0 +1,30 @@ +name: prinstall_drivers.ps1 +description: Previews matched and universal drivers for a network printer +shell: POWERSHELL +runAs: SYSTEM +timeout: 120 +readme: | + Purpose + ------- + Wraps `prinstall drivers ` to identify a printer by IP and show the matched + universal driver candidates the installer would pick from. Lets a technician preview driver selection before committing to a `prinstall add` install. Supports SNMP-based model discovery and an optional manual model override for printers that don't respond to SNMP. + + Usage Notes + ----------- + - Invokes `prinstall drivers ` and streams output to the RMM console + - Leave $YourModelHere blank to let prinstall auto-detect the model via SNMP + - Set $YourModelHere to a known model string to bypass SNMP for silent printers + - Read-only: this command previews drivers only, it does NOT install anything + - Requires prinstall.exe installed (run prinstall_setup.ps1 first) + + Requirements + ------------ + - Windows OS + - prinstall.exe installed (run prinstall_setup.ps1 first) + - Network access to the printer's IP + - UDP 161 (SNMP) reachable OR a known model string passed via $YourModelHere + - $YourIpHere: IPv4 address of the target printer (required) + - $YourModelHere: Optional model override — leave blank for SNMP auto-detect +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMxNg +lastPushedChecksum: "sha256:460ee74ac32197ed" +lastPushedMetaChecksum: "sha256:2f7436090f0b5465" \ No newline at end of file diff --git a/scripts/prinstall_id.level.yaml b/scripts/prinstall_id.level.yaml new file mode 100644 index 0000000..22792f6 --- /dev/null +++ b/scripts/prinstall_id.level.yaml @@ -0,0 +1,28 @@ +name: prinstall_id.ps1 +description: Identifies a single printer by IP via SNMP using prinstall +shell: POWERSHELL +runAs: SYSTEM +timeout: 120 +readme: | + Purpose + ------- + Wraps the `prinstall id ` subcommand to query a single printer via SNMP and return model, serial number, and device status. Used by techs to verify a printer's identity and reachability before running an add, or to confirm SNMP is answering on an expected IP. + + Usage Notes + ----------- + - Runs `prinstall id ` and streams output to the console + - $YourIpHere is required — an unreplaced placeholder is treated as an input error + - Unlike prinstall_scan, this script does not auto-detect anything; the target IP must be supplied + - Requires prinstall.exe installed (run prinstall_setup.ps1 first) + + Requirements + ------------ + - Windows OS + - prinstall.exe installed (run prinstall_setup.ps1 first) + - Network access to the target printer + - UDP 161 (SNMP) open to the printer + - $YourIpHere: Target printer IP address (e.g. 192.168.1.10) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMxNw +lastPushedChecksum: "sha256:6b982f78a98d4882" +lastPushedMetaChecksum: "sha256:b26e694699e39eee" \ No newline at end of file diff --git a/scripts/prinstall_list.level.yaml b/scripts/prinstall_list.level.yaml new file mode 100644 index 0000000..25f2716 --- /dev/null +++ b/scripts/prinstall_list.level.yaml @@ -0,0 +1,24 @@ +name: prinstall_list.ps1 +description: Lists installed printers on the system using prinstall +shell: POWERSHELL +runAs: SYSTEM +timeout: 300 +readme: | + Purpose + ------- + Lists all locally installed printers (USB, network, virtual) using prinstall's list command. Useful for auditing printer installations via RMM or verifying a printer was added successfully. + + Usage Notes + ----------- + - Enumerates all printers Windows knows about via Get-Printer + - No runtime variables required + - Requires prinstall.exe installed (run prinstall_setup.ps1 first) + + Requirements + ------------ + - Windows OS + - prinstall.exe installed +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMxOA +lastPushedChecksum: "sha256:d8c62d94975b0077" +lastPushedMetaChecksum: "sha256:94ac01ac37cd842b" \ No newline at end of file diff --git a/scripts/prinstall_remove.level.yaml b/scripts/prinstall_remove.level.yaml new file mode 100644 index 0000000..1874062 --- /dev/null +++ b/scripts/prinstall_remove.level.yaml @@ -0,0 +1,33 @@ +name: prinstall_remove.ps1 +description: Removes a printer and its orphaned driver/port using prinstall 0.3.0+ +shell: POWERSHELL +runAs: SYSTEM +timeout: 600 +readme: | + Purpose + ------- + Removes a printer on Windows using prinstall 0.3.0+. Three-step cleanup with + orphan detection: queue -> driver (with -RemoveFromDriverStore to take the + underlying oem.inf package with it) -> port. System drivers and non-IP + ports are automatically skipped. Idempotent — removing a non-existent + printer returns success. + + Usage Notes + ----------- + - Target can be an IP address or the exact printer queue name + - IP targets are resolved to queue names via the IP_ port convention + - Set $keepDriver to $true to skip driver cleanup (leave driver staged) + - Set $keepPort to $true to skip port cleanup (leave port registered) + - Settle sleep + retry loop smooths over Windows spooler reference lag + - Requires prinstall.exe 0.3.0 or newer (run prinstall_setup.ps1 first) + + Requirements + ------------ + - Windows OS + - Administrator privileges + - prinstall.exe 0.3.0 or newer installed + - $YourPrinterTargetHere: Printer IP (e.g. "192.168.1.50") or exact queue name +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMxOQ +lastPushedChecksum: "sha256:d68a04864344e349" +lastPushedMetaChecksum: "sha256:3b7a381e8dfe0968" \ No newline at end of file diff --git a/scripts/prinstall_scan.level.yaml b/scripts/prinstall_scan.level.yaml new file mode 100644 index 0000000..0a9d085 --- /dev/null +++ b/scripts/prinstall_scan.level.yaml @@ -0,0 +1,30 @@ +name: prinstall_scan.ps1 +description: Scans a subnet for network printers using prinstall +shell: POWERSHELL +runAs: SYSTEM +timeout: 300 +readme: | + Purpose + ------- + Scans a subnet for network printers using prinstall 0.3.1's full multi-method discovery pipeline: TCP port probe (9100/631/515), IPP Get-Printer-Attributes, SNMPv2c, and mDNS/Bonjour multicast browse. Catches even silent AirPrint printers that ignore SNMP. Returns printer IPs, models, discovery method(s), and status. + + Usage Notes + ----------- + - Uses `prinstall scan [subnet] --verbose` with the default `all` method (port + IPP + SNMP + mDNS merged) + - Leave $YourSubnetHere blank to auto-detect the local subnet from the primary NIC + - Requires prinstall.exe installed (run prinstall_setup.ps1 first) + - prinstall_setup.ps1 pre-creates a firewall rule so the mDNS pass works under SYSTEM execution + + Requirements + ------------ + - Windows OS + - prinstall.exe installed (run prinstall_setup.ps1 first) + - Network access to target subnet + - UDP 161 (SNMP), TCP 9100 (raw), TCP 631 (IPP) open to target + - UDP 5353 (mDNS) allowed on the NIC — created by prinstall_setup.ps1 + - $YourSubnetHere: Subnet in CIDR notation (e.g. 192.168.1.0/24) or blank for auto-detect + - $ScanModeAllNetworkUsb: 'all' / 'network' / 'usb' — blank defaults to 'all' (full network + USB scan). 'usb' ignores $YourSubnetHere. +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMyMA +lastPushedChecksum: "sha256:97d57bd6f9b1475b" +lastPushedMetaChecksum: "sha256:f881129b3146716f" \ No newline at end of file diff --git a/scripts/prinstall_setup.level.yaml b/scripts/prinstall_setup.level.yaml new file mode 100644 index 0000000..a2b668e --- /dev/null +++ b/scripts/prinstall_setup.level.yaml @@ -0,0 +1,27 @@ +name: prinstall_setup.ps1 +description: Installs or uninstalls prinstall from GitHub releases +shell: POWERSHELL +runAs: SYSTEM +timeout: 600 +readme: | + Purpose + ------- + Installs or uninstalls prinstall. Install mode downloads the latest release from GitHub, extracts the binary to C:\ProgramData\prinstall\, pre-creates a Windows Firewall rule for mDNS discovery (UDP 5353), and adds the install directory to the machine PATH so techs can run `prinstall scan` (etc.) without the full path. Uninstall mode reverses all three — removes the directory, the firewall rule, and the PATH entry. Prinstall is a CLI/TUI tool for discovering network printers, matching drivers, and installing them on Windows. + + Usage Notes + ----------- + - Set InstallOrUninstall to 'install' or 'uninstall' + - Install: queries GitHub Releases API for latest version, downloads and extracts, adds firewall rule + PATH entry + - Uninstall: removes install directory, firewall rule, and PATH entry + - Verifies binary by running prinstall --version after install + - PATH changes apply immediately to new shells; the current session is patched in-memory too so follow-up commands in the same RMM run work without a reboot + + Requirements + ------------ + - Windows OS + - Administrator privileges (required to modify machine PATH and firewall rules) + - Internet connectivity to github.com (install only) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMyMQ +lastPushedChecksum: "sha256:91001c70808f9cc5" +lastPushedMetaChecksum: "sha256:61dabbef7cd23842" \ No newline at end of file diff --git a/scripts/prinstall_trust_codesign.level.yaml b/scripts/prinstall_trust_codesign.level.yaml new file mode 100644 index 0000000..64f0fe2 --- /dev/null +++ b/scripts/prinstall_trust_codesign.level.yaml @@ -0,0 +1,34 @@ +name: prinstall_trust_codesign.ps1 +description: Imports the Prinstall self-signed code signing cert into LocalMachine trust stores +shell: POWERSHELL +runAs: SYSTEM +timeout: 300 +readme: | + Purpose + ------- + Pushes the Prinstall self-signed code signing public cert (prinstall-codesign.cer, + bundled alongside this script) into Cert:\LocalMachine\Root and + Cert:\LocalMachine\TrustedPublisher on managed endpoints. After this runs, + signed prinstall.exe release binaries (v0.4.10+) pass Smart App Control + without requiring a publicly-trusted commercial code signing cert. + Idempotent — checks thumbprint before importing, safe to re-run. + + Usage Notes + ----------- + - Deploy once per endpoint, typically as part of agent provisioning + - Re-run is a no-op if the cert is already trusted (thumbprint match) + - CertPath runtime variable is optional — leave empty to use the .cer + bundled alongside this script + - Pair with docs/selfsign-setup.md in the prinstall repo for the full + signing flow (cert generation + GitHub Actions secret upload) + - Cert is valid 10 years; renew by regenerating and re-running this script + + Requirements + ------------ + - Windows OS + - Administrator / SYSTEM privileges (LocalMachine stores require elevation) + - prinstall-codesign.cer accessible (co-located with script, or via CertPath) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMyMg +lastPushedChecksum: "sha256:cb3d19fc839edbb8" +lastPushedMetaChecksum: "sha256:7cfbced5d7bab9de" \ No newline at end of file diff --git a/scripts/print_queue_clear.level.yaml b/scripts/print_queue_clear.level.yaml new file mode 100644 index 0000000..aeca594 --- /dev/null +++ b/scripts/print_queue_clear.level.yaml @@ -0,0 +1,29 @@ +name: print_queue_clear.ps1 +description: Clears stuck print jobs by resetting Print Spooler service +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Resets and clears the Windows print queue by stopping the Print Spooler service, removing all queued print jobs from the spooler directory, and restarting the service. Resolves common printing issues caused by stuck or corrupted print jobs. + + Usage Notes + ----------- + - Checks current status of Print Spooler service + - Stops the Print Spooler service and waits for handles to release + - Removes print job files with retry logic (3 attempts per file) + - Reports successfully removed and locked files separately + - Restarts the Print Spooler service and verifies it is running + + Requirements + ------------ + - Windows 10/11 or Windows Server + - Administrator privileges + - Print Spooler service must exist + - $serviceName: Print Spooler service name (default: "Spooler") + - $stopTimeout / $startTimeout: Service timeout in seconds (default: 30) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMyMw +lastPushedChecksum: "sha256:a2439d52ec6601ab" +lastPushedMetaChecksum: "sha256:c47138daa63d3581" \ No newline at end of file diff --git a/scripts/print_queue_reset.level.yaml b/scripts/print_queue_reset.level.yaml new file mode 100644 index 0000000..6aae1a0 --- /dev/null +++ b/scripts/print_queue_reset.level.yaml @@ -0,0 +1,30 @@ +name: print_queue_reset.ps1 +description: Resets Windows print queue by clearing spooler directory +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Resets and clears the Windows print queue by stopping the Print Spooler service, removing all queued print jobs from the spooler directory, and restarting the service. Resolves common printing issues caused by stuck or corrupted print jobs that prevent new documents from printing. + + Usage Notes + ----------- + - Stops the Print Spooler service if running and waits for handles to release + - Attempts to remove print job files with retry logic (3 attempts per file) + - Reports successfully removed and locked files separately + - Locked files are removed when service restarts + - Spooler directory: %SystemRoot%\System32\spool\PRINTERS + - Service stop/start timeout: 30 seconds each + + Requirements + ------------ + - Windows operating system + - Administrator privileges + - Print Spooler service must exist + - $serviceName: Service name (default: "Spooler") + - $stopTimeout / $startTimeout: Timeout in seconds (default: 30) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMyNA +lastPushedChecksum: "sha256:96b72c3fc16240ef" +lastPushedMetaChecksum: "sha256:de589b74fc31c8cd" \ No newline at end of file diff --git a/scripts/printer_connection_test.level.yaml b/scripts/printer_connection_test.level.yaml new file mode 100644 index 0000000..aca9608 --- /dev/null +++ b/scripts/printer_connection_test.level.yaml @@ -0,0 +1,29 @@ +name: printer_connection_test.sh +description: Tests network printer connectivity via ping and IPP port check +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Tests network connectivity to configured printers by pinging their hostnames/IPs. Reports success/failure for each printer and optionally sends an email alert if any tests fail. + + Usage Notes + ----------- + - Pings each configured printer and records pass/fail status + - Performs DNS lookup for failed printers as diagnostics + - Optional email alerts via sendmail when failures occur + - Ping count: 2 packets, timeout: 5 seconds + - Email alerts disabled by default + + Requirements + ------------ + - macOS or Linux + - Network access to printer hosts + - PRINTERS: Array of printer hostnames or IP addresses + - SEND_EMAIL / MAIL_TO / MAIL_FROM: Email notification settings + - (Optional) sendmail for email alerts +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMyNQ +lastPushedChecksum: "sha256:80e00c348b5ea77c" +lastPushedMetaChecksum: "sha256:cfe2d9e32e309cfd" \ No newline at end of file diff --git a/scripts/printer_install_linux.level.yaml b/scripts/printer_install_linux.level.yaml new file mode 100644 index 0000000..5ad9525 --- /dev/null +++ b/scripts/printer_install_linux.level.yaml @@ -0,0 +1,35 @@ +name: printer_install_linux.sh +description: Installs network printer via IPP using lpadmin on Linux +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Installs network printers on Linux using CUPS/lpadmin. Supports PPD files for driver functionality. Automatically installs CUPS and required packages if not present. + + Usage Notes + ----------- + - Detects OS and verifies Linux + - Installs CUPS if needed and enabled + - Verifies or finds PPD file in standard search paths + - Removes existing printers with same name before installing + - Installs each configured printer via lpadmin + - Enables and accepts jobs for each printer + - Default protocol: lpd + - PPD search paths: /usr/share/cups/model/, /usr/share/ppd/, /etc/cups/ppd/ + + Requirements + ------------ + - Debian/Ubuntu or compatible Linux (apt, yum, or dnf) + - Root/sudo privileges + - Internet access for package installation + - PPD file for the printer model + - PRINTERS: Array of "hostname|location|display_name" entries + - PROTOCOL: lpd, ipp, or socket + - PPD_PATH: Path to the PPD driver file + - AUTO_INSTALL_CUPS: Whether to install CUPS if missing +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMyNg +lastPushedChecksum: "sha256:d721fe27c531e96a" +lastPushedMetaChecksum: "sha256:a855a5e07fd137cd" \ No newline at end of file diff --git a/scripts/printer_install_macos.level.yaml b/scripts/printer_install_macos.level.yaml new file mode 100644 index 0000000..c39623d --- /dev/null +++ b/scripts/printer_install_macos.level.yaml @@ -0,0 +1,34 @@ +name: printer_install_macos.sh +description: Installs network printer via IPP using lpadmin on macOS +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Installs network printers on macOS using CUPS/lpadmin. Supports PPD files for full driver functionality. Can install from local PPD or download from a URL. + + Usage Notes + ----------- + - Downloads driver package if URL provided + - Sets up PPD file (local or downloaded) + - Removes existing printers with same name before installing + - Installs each configured printer via lpadmin + - Supports lpd, ipp, and ipps protocols + - Default: lpd protocol, local PPD source, sharing disabled, abort-job error policy + + Requirements + ------------ + - macOS 10.12 or later + - Root/sudo privileges + - PPD file for the printer model + - Network access to printers and PPD URL (if using URL) + - PRINTERS: Array of "hostname|location|display_name" entries + - PROTOCOL: lpd, ipp, or ipps + - PPD_SOURCE: "local" or "url" + - PPD_PATH / PPD_URL: PPD file path or download URL + - DRIVER_URL: Optional driver package URL +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMyNw +lastPushedChecksum: "sha256:629c0f1457ee7d88" +lastPushedMetaChecksum: "sha256:6293f73c0f7de6ac" \ No newline at end of file diff --git a/scripts/printers_remove_all.level.yaml b/scripts/printers_remove_all.level.yaml new file mode 100644 index 0000000..e9c49b4 --- /dev/null +++ b/scripts/printers_remove_all.level.yaml @@ -0,0 +1,32 @@ +name: printers_remove_all.ps1 +description: Removes all printers, drivers, and ports from Windows +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Removes ALL installed printers, their associated ports, and unused printer drivers from Windows. Use with caution -- this is a destructive operation that cannot be undone. + + Usage Notes + ----------- + - Enumerates and removes all installed printers + - Removes orphaned TCP/IP printer ports (optional) + - Removes unused printer drivers (optional) + - $removeDrivers: Control driver removal (default: true) + - $removePorts: Control orphaned port removal (default: true) + + Requirements + ------------ + - Windows 10/11 or Windows Server + - Administrator privileges + - Print Spooler service running + + Security + -------- + - Destructive operation -- removes ALL printers + - Cannot be undone without reinstalling printers +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMyOA +lastPushedChecksum: "sha256:f5ff959c9835072b" +lastPushedMetaChecksum: "sha256:49ece219c140a966" \ No newline at end of file diff --git a/scripts/public_ip_export_superops.level.yaml b/scripts/public_ip_export_superops.level.yaml new file mode 100644 index 0000000..e859287 --- /dev/null +++ b/scripts/public_ip_export_superops.level.yaml @@ -0,0 +1,30 @@ +name: public_ip_export_superops.ps1 +description: Fetches public IP info from wtfismyip.com and syncs to SuperOps +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Queries wtfismyip.com/json to retrieve public IP address, ISP, geolocation, and hostname information. Formats the results into a readable multiline string and sends it to a SuperOps custom field for network visibility and auditing. + + Usage Notes + ----------- + - Queries wtfismyip.com/json for public IP details + - Parses JSON response and formats into readable multiline text + - Formats IP, Location, Hostname, ISP, Country, and Tor Exit status + - Sends formatted text to SuperOps "Public IP" custom field + - Uses Invoke-RestMethod (no external binaries required) + + Requirements + ------------ + - SuperOps PowerShell module must be available and authenticated + - Internet connectivity to reach wtfismyip.com + - Windows with PowerShell 5.1+ or PowerShell 7+ + - SuperOps custom field "Public IP" (Multiline Text) must exist in tenant + - $apiUrl: wtfismyip.com JSON endpoint + - $customFieldName: SuperOps custom field name +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMyOQ +lastPushedChecksum: "sha256:79f6d5c2dcf1ae22" +lastPushedMetaChecksum: "sha256:72ac6bd29023777f" \ No newline at end of file diff --git a/scripts/public_ip_export_superops_macos.level.yaml b/scripts/public_ip_export_superops_macos.level.yaml new file mode 100644 index 0000000..60e9ba4 --- /dev/null +++ b/scripts/public_ip_export_superops_macos.level.yaml @@ -0,0 +1,27 @@ +name: public_ip_export_superops_macos.sh +description: Fetches public IP info from wtfismyip.com and outputs formatted results +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Queries wtfismyip.com/json to retrieve public IP address, ISP, geolocation, and hostname information. Formats the results into readable stdout output. Note: macOS/Linux SuperOps agents do not support Send-CustomField, so results are output only. + + Usage Notes + ----------- + - Queries wtfismyip.com/json for public IP details + - Parses JSON response using python3 + - Formats IP, Location, Hostname, ISP, Country, and Tor Exit status + - Outputs to stdout (no custom field sync on macOS/Linux) + - Curl timeout: 30 seconds + + Requirements + ------------ + - curl and python3 installed (both pre-installed on macOS) + - Internet connectivity to reach wtfismyip.com + - API_URL: wtfismyip.com JSON endpoint (hardcoded) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMzMA +lastPushedChecksum: "sha256:c115a7ff0b97c23b" +lastPushedMetaChecksum: "sha256:deb7b3f42214fdf0" \ No newline at end of file diff --git a/scripts/restic_b2_backup_install.level.yaml b/scripts/restic_b2_backup_install.level.yaml new file mode 100644 index 0000000..34e2112 --- /dev/null +++ b/scripts/restic_b2_backup_install.level.yaml @@ -0,0 +1,40 @@ +name: restic_b2_backup_install.ps1 +description: Installs Restic, configures B2 repository, schedules daily backups +shell: POWERSHELL +runAs: SYSTEM +timeout: 1800 +readme: | + Purpose + ------- + All-in-one installer for Restic backup to Backblaze B2 with immutable storage. Downloads Restic via winget, initializes an encrypted B2 repository scoped to the machine hostname, generates a daily backup script with embedded credentials, and creates a Windows Scheduled Task. Designed for deployment via SuperOps RMM to client workstations and servers. + + Usage Notes + ----------- + - Validates all hardcoded inputs are non-empty before proceeding + - Installs Restic via winget, copies binary to managed install directory + - ACL-locks install directory to SYSTEM + Administrators only + - Initializes B2 repository (skips if already exists) + - Generates daily backup script with embedded credentials and retention policy + - Creates Windows Scheduled Task for daily execution at 02:00 as SYSTEM + - Runs dry-run backup to verify B2 connectivity and path access + - Default backup paths: Documents, Desktop, Downloads, Pictures, Videos + - Default excludes: temp files, cache directories, OneDrive, Recycle Bin + - Retention policy: 7 daily, 4 weekly, 6 monthly snapshots + + Requirements + ------------ + - Windows 10/11 or Windows Server 2016+ + - Administrator privileges (runs as SYSTEM via RMM) + - winget (App Installer) available on the system + - Network access to Backblaze B2 + - SuperOps runtime variables: B2KeyId, B2AppKey, B2BucketName, RepoPassword, ClientName + + Security + -------- + - B2 credentials are embedded in the generated backup script + - Install directory is ACL-locked to SYSTEM + Administrators + - Repo password encrypts all backup data at rest +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMzMQ +lastPushedChecksum: "sha256:c09fd6b042b511b6" +lastPushedMetaChecksum: "sha256:1ec2c009ba0dbbfd" \ No newline at end of file diff --git a/scripts/rustic_backup.level.yaml b/scripts/rustic_backup.level.yaml new file mode 100644 index 0000000..f082bc6 --- /dev/null +++ b/scripts/rustic_backup.level.yaml @@ -0,0 +1,33 @@ +name: rustic_backup.ps1 +description: Runs rustic backup, prune, and integrity check using existing profile +shell: POWERSHELL +runAs: SYSTEM +timeout: 7200 +readme: | + Purpose + ------- + Scheduled backup runner for Rustic. Reads configuration from the TOML profile written by rustic_install.ps1 and executes a full backup cycle: backup snapshot, retention prune, and a lightweight integrity check on a random 1% data subset. Intended to be invoked by the Windows Scheduled Task created during installation, or manually via SuperOps RMM. + + Usage Notes + ----------- + - No runtime variables required — all configuration is read from the TOML profile + - Validates rustic.exe and rustic.toml exist (exits 1 if missing) + - Ensures log directory exists before running + - Sets RUSTIC_CONFIG_FILE environment variable, clears it in a finally block + - Backup step is fatal: exits 1 if rustic backup fails (no snapshot was created) + - Prune step is non-fatal: warns and continues if rustic forget --prune fails + - Integrity check is non-fatal: warns and continues if rustic check fails + - Integrity check scope: --read-data-subset=1/100 (1% of data per run) + - Reports duration and per-step status in the final summary + + Requirements + ------------ + - rustic_install.ps1 must have been run successfully on this machine + - rustic.exe at C:\ProgramData\Limehawk\Rustic\bin\rustic.exe + - rustic.toml at C:\ProgramData\Limehawk\Rustic\rustic.toml + - Windows 10/11 or Windows Server 2016+ + - Administrator privileges (runs as SYSTEM via RMM or Scheduled Task) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMzMg +lastPushedChecksum: "sha256:37d4d46a94882a30" +lastPushedMetaChecksum: "sha256:0fa3173759925e88" \ No newline at end of file diff --git a/scripts/rustic_backup_unix.level.yaml b/scripts/rustic_backup_unix.level.yaml new file mode 100644 index 0000000..02c5401 --- /dev/null +++ b/scripts/rustic_backup_unix.level.yaml @@ -0,0 +1,36 @@ +name: rustic_backup_unix.sh +description: Runs rustic backup, prune, and integrity check (Linux/macOS) +shell: BASH +runAs: SYSTEM +timeout: 7200 +readme: | + Purpose + ------- + Executes a full Rustic backup cycle on Linux and macOS: runs a backup against the configured repository, applies retention policy with prune, and performs a partial integrity check on the repository. Reads all configuration from /etc/rustic/rustic.toml. Intended to be run on a schedule (systemd timer or launchd plist) or invoked directly via SuperOps RMM. + + Usage Notes + ----------- + - Verifies rustic binary (/usr/local/bin/rustic) and config (/etc/rustic/rustic.toml) exist before running + - Exports RUSTIC_CONFIG_FILE to direct rustic to the TOML configuration + - Backup step is fatal: script exits 1 if rustic backup fails + - Retention (forget --prune) and integrity check (check --read-data-subset=1/100) are non-fatal: failures emit a warning but do not abort + - Integrity check scope: --read-data-subset=1/100 (1% of data per run) + - Reports total duration in the final status block + - No runtime variables required; all settings come from the TOML config + + Requirements + ------------ + - Linux or macOS + - Root privileges (runs as root via RMM) + - rustic installed at /usr/local/bin/rustic + - /etc/rustic/rustic.toml configured by rustic_install_unix.sh + - Network access to the configured backup backend + + Security + -------- + - No credentials are printed to console output + - All secrets remain in /etc/rustic/rustic.toml (chmod 600) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMzMw +lastPushedChecksum: "sha256:a10b4b3cc851a31b" +lastPushedMetaChecksum: "sha256:8f421517af16e5ab" \ No newline at end of file diff --git a/scripts/rustic_install.level.yaml b/scripts/rustic_install.level.yaml new file mode 100644 index 0000000..8f7c8ce --- /dev/null +++ b/scripts/rustic_install.level.yaml @@ -0,0 +1,46 @@ +name: rustic_install.ps1 +description: Installs Rustic, configures backend repository, schedules daily backups +shell: POWERSHELL +runAs: SYSTEM +timeout: 1800 +readme: | + Purpose + ------- + All-in-one installer for Rustic backup with multi-backend support (B2, S3, local, SFTP, REST). Downloads the Rustic binary from GitHub releases (SHA256-verified), generates a TOML configuration profile with backend-specific settings, initializes an encrypted repository scoped to the machine hostname, deploys a daily backup runner script, and creates a Windows Scheduled Task. Designed for deployment via SuperOps RMM to client workstations and servers. + + Usage Notes + ----------- + - Validates all hardcoded inputs including backend-specific conditional requirements + - Downloads Rustic v0.11.1 from GitHub releases with SHA256 verification + - Skips download if correct version is already installed + - ACL-locks install directory to SYSTEM + Administrators only + - Generates TOML config profile tailored to the selected backend type + - Initializes encrypted repository (skips if already exists) + - Generates daily backup script with log rotation (keeps 30 days) + - Backup script runs: backup, forget --prune, check --read-data-subset + - Creates Windows Scheduled Task for daily execution as SYSTEM + - Runs dry-run backup to verify connectivity and path access + - Default backup paths: Documents, Desktop, Downloads, Pictures, Videos + - Default excludes: temp files, cache directories, OneDrive, Recycle Bin, large binaries, dev artifacts + - Retention policy: 7 daily, 4 weekly, 6 monthly snapshots + + Requirements + ------------ + - Windows 10/11 or Windows Server 2016+ + - Administrator privileges (runs as SYSTEM via RMM) + - tar.exe available (built into Windows 10 1803+) + - Network access to GitHub releases and the configured backend + - SuperOps runtime variables: YourBackendType, YourBackendPath, YourRepoPassword, YourClientName + - Conditional: YourBackendKeyId, YourBackendAppKey (B2/S3), YourBackendRegion (S3) + - Optional: YourBackupPaths, YourExcludePatterns, YourBackupHour + + Security + -------- + - Backend credentials are embedded in the TOML config file + - Install directory is ACL-locked to SYSTEM + Administrators + - Repo password encrypts all backup data at rest + - No secrets printed to console output +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMzNA +lastPushedChecksum: "sha256:c11a00e8cfcc8fb6" +lastPushedMetaChecksum: "sha256:f6bdfccb02668f80" \ No newline at end of file diff --git a/scripts/rustic_install_unix.level.yaml b/scripts/rustic_install_unix.level.yaml new file mode 100644 index 0000000..18a96eb --- /dev/null +++ b/scripts/rustic_install_unix.level.yaml @@ -0,0 +1,48 @@ +name: rustic_install_unix.sh +description: Installs Rustic, configures backend repository, schedules daily backups +shell: BASH +runAs: SYSTEM +timeout: 1800 +readme: | + Purpose + ------- + All-in-one installer for Rustic backup on Linux and macOS with multi-backend support (B2, S3, local, SFTP, REST). Detects OS and architecture, downloads the Rustic binary from GitHub releases (SHA256-verified), generates a TOML configuration profile with backend-specific settings, initializes an encrypted repository scoped to the machine hostname, deploys a daily backup runner script, and creates a systemd timer (Linux) or launchd plist (macOS). Designed for deployment via SuperOps RMM. + + Usage Notes + ----------- + - Detects OS (Linux/macOS) and architecture (x86_64/aarch64/arm64/armv7l) + - Downloads Rustic v0.11.1 from GitHub releases with SHA256 verification + - Skips download if correct version is already installed + - Config directory chmod 700, config file chmod 600 + - Generates TOML config profile tailored to the selected backend type + - Initializes encrypted repository (skips if already exists) + - Generates daily backup script with log rotation (deletes logs older than 30 days) + - Backup script runs: backup, forget --prune, check --read-data-subset + - Linux: creates systemd timer and service for daily execution + - macOS: creates launchd plist in /Library/LaunchDaemons for daily execution + - Runs dry-run backup to verify connectivity and path access + - Default backup paths (Linux): /home, /etc, /var/lib + - Default backup paths (macOS): /Users, /etc + - Default excludes: temp files, caches, .DS_Store, dev artifacts, large binaries + - Retention policy: 7 daily, 4 weekly, 6 monthly snapshots + + Requirements + ------------ + - Linux (glibc or musl) or macOS 11+ + - Root privileges (runs as root via RMM) + - curl and tar installed + - Network access to GitHub releases and the configured backend + - SuperOps runtime variables: YourBackendType, YourBackendPath, YourRepoPassword, YourClientName + - Conditional: YourBackendKeyId, YourBackendAppKey (B2/S3), YourBackendRegion (S3) + - Optional: YourBackupPaths, YourExcludePatterns, YourBackupHour + + Security + -------- + - Backend credentials are embedded in the TOML config file + - Config directory is chmod 700, config file is chmod 600 + - Repo password encrypts all backup data at rest + - No secrets printed to console output +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMzNQ +lastPushedChecksum: "sha256:6f06c1d9e9f5d54b" +lastPushedMetaChecksum: "sha256:10efc9d95cc47f03" \ No newline at end of file diff --git a/scripts/rustic_restore.level.yaml b/scripts/rustic_restore.level.yaml new file mode 100644 index 0000000..9c7a7b1 --- /dev/null +++ b/scripts/rustic_restore.level.yaml @@ -0,0 +1,30 @@ +name: rustic_restore.ps1 +description: Restores files from a rustic backup snapshot to a local destination +shell: POWERSHELL +runAs: SYSTEM +timeout: 7200 +readme: | + Purpose + ------- + Targeted file restore from a rustic backup snapshot. Operator provides a snapshot ID (or "latest"), a source path within the snapshot, and a local destination path via SuperOps runtime variables. Uses the existing rustic binary and TOML configuration deployed by rustic_install.ps1. + + Usage Notes + ----------- + - Snapshot ID defaults to "latest" if left empty or unreplaced + - All settings are in the TOML profile deployed by rustic_install.ps1 + - Lists available snapshots before restoring so the operator can confirm the correct snapshot + - Creates the destination directory if it does not exist + - Runs: rustic restore ":" + - Sets RUSTIC_CONFIG_FILE environment variable and clears it after execution + + Requirements + ------------ + - Windows 10/11 or Windows Server 2016+ + - Administrator privileges (runs as SYSTEM via RMM) + - rustic_install.ps1 previously deployed (binary and config must exist) + - SuperOps runtime variables: YourRestorePath, YourDestination + - Optional: YourSnapshotId (defaults to "latest") +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMzNg +lastPushedChecksum: "sha256:59f81da920ec0a94" +lastPushedMetaChecksum: "sha256:4a497d7cd476607c" \ No newline at end of file diff --git a/scripts/rustic_restore_unix.level.yaml b/scripts/rustic_restore_unix.level.yaml new file mode 100644 index 0000000..ff210f3 --- /dev/null +++ b/scripts/rustic_restore_unix.level.yaml @@ -0,0 +1,36 @@ +name: rustic_restore_unix.sh +description: Restores files from a rustic backup snapshot (Linux/macOS) +shell: BASH +runAs: SYSTEM +timeout: 7200 +readme: | + Purpose + ------- + Targeted file and directory restore from a rustic backup snapshot on Linux and macOS. Reads the existing rustic TOML configuration to connect to the configured backend, lists available snapshots for reference, then restores the specified path from a chosen snapshot (or "latest") to a given destination directory. Designed for deployment via SuperOps RMM. + + Usage Notes + ----------- + - Defaults SNAPSHOT_ID to "latest" if left empty or unreplaced + - Hardcoded paths: rustic binary at /usr/local/bin/rustic, config at /etc/rustic/rustic.toml + - Lists available snapshots before restoring (informational; non-fatal if it fails) + - Creates the destination directory automatically if it does not exist + - Runs: rustic restore ":" "" + - Restored files inherit the permissions stored in the snapshot + + Requirements + ------------ + - rustic installed at /usr/local/bin/rustic (deploy rustic_install_unix.sh first) + - /etc/rustic/rustic.toml configured with valid backend credentials + - Linux or macOS with root privileges + - Network access to the configured backend + - SuperOps runtime variables: YourRestorePath, YourDestination + - Optional: YourSnapshotId (defaults to "latest") + + Security + -------- + - No credentials are passed on the command line + - rustic reads backend credentials exclusively from the TOML config file +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMzNw +lastPushedChecksum: "sha256:83c3c35a5f0ba9bc" +lastPushedMetaChecksum: "sha256:1dddd71f8d0a0778" \ No newline at end of file diff --git a/scripts/rustic_uninstall.level.yaml b/scripts/rustic_uninstall.level.yaml new file mode 100644 index 0000000..1252eb3 --- /dev/null +++ b/scripts/rustic_uninstall.level.yaml @@ -0,0 +1,30 @@ +name: rustic_uninstall.ps1 +description: Removes rustic binary, config, scheduled task, and logs +shell: POWERSHELL +runAs: SYSTEM +timeout: 300 +readme: | + Purpose + ------- + Removes all local Rustic components from the machine: the Windows Scheduled Task and the entire install directory (binary, config, backup script, and logs). Does NOT delete the remote backup repository. Safe to run even if components are already absent — partial removal is acceptable. + + Usage Notes + ----------- + - No runtime variables required + - Install directory: C:\ProgramData\Limehawk\Rustic + - Scheduled task name: Limehawk Rustic Backup + - Removes the scheduled task if it exists + - Removes the install directory and all contents recursively + - Reports found/not-found for each component before acting + - Always exits 0 — cleanup is idempotent + - Remote backup repository and its data are not affected + - Config files (which contain backend credentials) are deleted locally + + Requirements + ------------ + - Windows 10/11 or Windows Server 2016+ + - Administrator privileges (runs as SYSTEM via RMM) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMzOA +lastPushedChecksum: "sha256:3e899b4f1ae514a7" +lastPushedMetaChecksum: "sha256:0522707d97bb82c5" \ No newline at end of file diff --git a/scripts/rustic_uninstall_unix.level.yaml b/scripts/rustic_uninstall_unix.level.yaml new file mode 100644 index 0000000..e50f826 --- /dev/null +++ b/scripts/rustic_uninstall_unix.level.yaml @@ -0,0 +1,31 @@ +name: rustic_uninstall_unix.sh +description: Removes rustic binary, config, schedule, and logs (Linux/macOS) +shell: BASH +runAs: SYSTEM +timeout: 300 +readme: | + Purpose + ------- + Removes all components installed by rustic_install_unix.sh. Detects OS (Linux/macOS), stops and disables the backup schedule (systemd timer on Linux, launchd plist on macOS), removes the Rustic binary and backup runner script, and deletes the configuration directory and log directory. The remote backup repository is NOT touched. + + Usage Notes + ----------- + - No runtime variables required + - Hardcoded paths: /usr/local/bin/rustic, /usr/local/bin/rustic-backup.sh, /etc/rustic, /var/log/rustic + - Detects OS (Linux/macOS) automatically + - Linux: stops and disables rustic-backup.timer and rustic-backup.service, then reloads systemd daemon + - macOS: unloads and removes /Library/LaunchDaemons/io.limehawk.rustic-backup.plist + - Removes binary, runner script, config directory, and log directory + - Each path is reported as found/removed or not found + - Partial removal is acceptable; script always exits 0 + - Remote backup repository and its data are NOT deleted + - Config files (which contain backend credentials) are deleted + + Requirements + ------------ + - Linux or macOS + - Root privileges (runs as root via RMM) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDMzOQ +lastPushedChecksum: "sha256:6361db8bf61c78a0" +lastPushedMetaChecksum: "sha256:285b39bbc6c9010c" \ No newline at end of file diff --git a/scripts/sentinelone_install.level.yaml b/scripts/sentinelone_install.level.yaml new file mode 100644 index 0000000..b45825c --- /dev/null +++ b/scripts/sentinelone_install.level.yaml @@ -0,0 +1,35 @@ +name: sentinelone_install.ps1 +description: Silently installs SentinelOne endpoint agent with site token +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Installs SentinelOne endpoint agent silently using a site token. Downloads the installer from ConnectWise CDN (or custom URL) and performs installation with verification. Skips if already installed. The installed version will auto-update based on your S1 console Auto-Upgrade Policy settings, so the initial installer version does not matter. + + Usage Notes + ----------- + - Checks if SentinelOne is already installed (optional skip) + - Auto-detects 32-bit vs 64-bit OS + - Supports EXE or MSI installer ($UseExe toggle, MSI recommended) + - Downloads installer from ConnectWise CDN or custom URL + - Verifies installation success with multiple retry attempts + - Cleans up temporary files after completion + + Requirements + ------------ + - Windows 10/11 or Windows Server + - Administrator privileges + - PowerShell 5.1 or later + - Network access to download URL (ConnectWise CDN or custom) + - $SiteToken: SentinelOne site token (get from S1 Console > Sentinels > Site Info) + + Security + -------- + - Site token is embedded in script -- protect accordingly + - Default CDN URL uses HTTPS +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM0MA +lastPushedChecksum: "sha256:3a0ca6654acf5982" +lastPushedMetaChecksum: "sha256:761f0587b986e04b" \ No newline at end of file diff --git a/scripts/sentinelone_services_start.level.yaml b/scripts/sentinelone_services_start.level.yaml new file mode 100644 index 0000000..ef14f35 --- /dev/null +++ b/scripts/sentinelone_services_start.level.yaml @@ -0,0 +1,29 @@ +name: sentinelone_services_start.ps1 +description: Ensures all SentinelOne services are running on Windows +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Checks the status of all SentinelOne services on Windows systems and ensures they are running. Enables disabled services and starts stopped services. Useful for troubleshooting SentinelOne agent issues where services may have been stopped or disabled. + + Usage Notes + ----------- + - No inputs required -- automatically checks all SentinelOne services + - Services checked: LogProcessorService, SentinelAgent, SentinelHelperService, SentinelStaticEngine + - Sets disabled services to Automatic startup type + - Starts stopped services + - No action taken if service is already running + - Reports final status for all services + - Service changes are permanent until manually reversed + + Requirements + ------------ + - Windows PowerShell 5.1 or PowerShell 7+ + - Administrator privileges (required for service management) + - SentinelOne agent must be installed +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM0MQ +lastPushedChecksum: "sha256:4f61d11ab3baffb7" +lastPushedMetaChecksum: "sha256:d21d4b9997ba8bff" \ No newline at end of file diff --git a/scripts/sentinelone_uninstall_linux.level.yaml b/scripts/sentinelone_uninstall_linux.level.yaml new file mode 100644 index 0000000..a9a508e --- /dev/null +++ b/scripts/sentinelone_uninstall_linux.level.yaml @@ -0,0 +1,27 @@ +name: sentinelone_uninstall_linux.sh +description: Uninstalls SentinelOne agent from Linux using passphrase +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Uninstalls the SentinelOne agent from Linux systems using the sentinelctl command. Verifies the agent is installed and sentinelctl is available before attempting removal. + + Usage Notes + ----------- + - No hardcoded inputs required + - Verifies root privileges before proceeding + - Checks if sentinelctl command is available in PATH + - Runs sentinelctl uninstall to remove the agent + - Agent may have tamper protection enabled which could block removal + + Requirements + ------------ + - Linux system with SentinelOne agent installed + - Root/sudo privileges + - sentinelctl must be in PATH (/usr/local/bin or /opt/sentinelone/bin) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM0Mg +lastPushedChecksum: "sha256:14d539a27befd82d" +lastPushedMetaChecksum: "sha256:a67fedd0e755613b" \ No newline at end of file diff --git a/scripts/shutdown_toggle.level.yaml b/scripts/shutdown_toggle.level.yaml new file mode 100644 index 0000000..477071f --- /dev/null +++ b/scripts/shutdown_toggle.level.yaml @@ -0,0 +1,28 @@ +name: shutdown_toggle.ps1 +description: Toggles scheduled shutdown with warning message +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Schedules a system shutdown with a warning message, or cancels an existing scheduled shutdown if one is already pending. Acts as a toggle -- run once to schedule, run again to cancel. + + Usage Notes + ----------- + - Default shutdown delay: 60 seconds (configurable via $shutdownTime variable) + - Checks if a shutdown is already scheduled before acting + - If scheduled: cancels the pending shutdown + - If not scheduled: schedules a new shutdown with on-screen warning countdown + - Shutdown can always be canceled by running the script again + + Requirements + ------------ + - Windows 10/11 or Windows Server + - Administrator privileges + - shutdown.exe (standard Windows component) + - $shutdownTime: time in seconds before shutdown (default: 60) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM0Mw +lastPushedChecksum: "sha256:469ca706feb53740" +lastPushedMetaChecksum: "sha256:b5d59a060e176044" \ No newline at end of file diff --git a/scripts/speedtest_export_superops.level.yaml b/scripts/speedtest_export_superops.level.yaml new file mode 100644 index 0000000..f20b04e --- /dev/null +++ b/scripts/speedtest_export_superops.level.yaml @@ -0,0 +1,31 @@ +name: speedtest_export_superops.ps1 +description: Runs Ookla Speedtest and syncs results to SuperOps custom fields +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and runs Ookla Speedtest CLI, captures network performance metrics, and synchronizes the results to SuperOps custom fields for monitoring and reporting. Designed for RMM automation to track internet connectivity quality. + + Usage Notes + ----------- + - Automatically downloads and extracts Speedtest CLI ZIP if not already present + - Executes speedtest with JSON output (auto-accepts license and GDPR terms) + - Calculates speeds in Mbps with full decimal precision + - Sends four custom fields to SuperOps: Download Speed, Upload Speed, ISP, Speedtest URL + - Reports detailed metrics to console including ping, jitter, packet loss, and server info + - Downloads from https://install.speedtest.net/app/cli/ + - Extraction path: $env:TEMP\SpeedtestCLI + + Requirements + ------------ + - SuperOps PowerShell module must be available and authenticated + - Internet connectivity for downloading CLI and running speedtest + - Write permissions to $env:TEMP directory + - Windows with PowerShell 5.1+ or PowerShell 7+ + - SuperOps custom fields must exist: Download Speed (Decimal), Upload Speed (Decimal), ISP (Short Text), Speedtest URL (Short Text) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM0NA +lastPushedChecksum: "sha256:f0b07e25413d5fec" +lastPushedMetaChecksum: "sha256:6afc2af3e746c7ed" \ No newline at end of file diff --git a/scripts/splashtop_business_install.level.yaml b/scripts/splashtop_business_install.level.yaml new file mode 100644 index 0000000..7f8a21c --- /dev/null +++ b/scripts/splashtop_business_install.level.yaml @@ -0,0 +1,27 @@ +name: splashtop_business_install.ps1 +description: Installs Splashtop Business client via winget +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Installs the Splashtop Business client application using winget (Windows Package Manager). This is the end-user remote access client, not the streamer agent. + + Usage Notes + ----------- + - Uses winget to install Splashtop.SplashtopBusiness package + - Detects SYSTEM vs user context for winget path resolution + - Handles already-installed case gracefully + - Silent installation with automatic agreement acceptance + + Requirements + ------------ + - Windows OS + - Administrator privileges + - Winget installed (run winget_setup.ps1 if needed) + - Internet connectivity +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM0NQ +lastPushedChecksum: "sha256:de86051d4da42af9" +lastPushedMetaChecksum: "sha256:c9ccc5444c61bb30" \ No newline at end of file diff --git a/scripts/splashtop_business_install_macos.level.yaml b/scripts/splashtop_business_install_macos.level.yaml new file mode 100644 index 0000000..4aeb410 --- /dev/null +++ b/scripts/splashtop_business_install_macos.level.yaml @@ -0,0 +1,26 @@ +name: splashtop_business_install_macos.sh +description: Downloads and installs Splashtop Business client on macOS +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and installs the Splashtop Business client application on macOS. The Business client allows users to connect to remote computers with Splashtop Streamer installed. + + Usage Notes + ----------- + - Downloads installer DMG from official Splashtop servers (v3.7.2.0) + - Mounts the DMG, installs the package, then unmounts + - Installer DMG is removed after installation + - Mount directory: /Volumes/Splashtop Business + + Requirements + ------------ + - macOS + - Root/sudo privileges + - Internet connectivity +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM0Ng +lastPushedChecksum: "sha256:687707d59ce4a3d6" +lastPushedMetaChecksum: "sha256:6f39428aeaa9c473" \ No newline at end of file diff --git a/scripts/splashtop_service_restart.level.yaml b/scripts/splashtop_service_restart.level.yaml new file mode 100644 index 0000000..3d165e7 --- /dev/null +++ b/scripts/splashtop_service_restart.level.yaml @@ -0,0 +1,27 @@ +name: splashtop_service_restart.ps1 +description: Restarts Splashtop Remote Service to resolve connectivity issues +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Restarts the Splashtop Remote Service to resolve connectivity or performance issues with Splashtop remote access. + + Usage Notes + ----------- + - Validates service name input and checks service exists + - Default service: SplashtopRemoteService + - Restarts the service and waits 3 seconds + - Reports final service status (Running or warning) + + Requirements + ------------ + - Windows OS + - Administrator privileges + - Splashtop Streamer installed + - $serviceName: name of the Splashtop service to restart +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM0Nw +lastPushedChecksum: "sha256:af58133e2ca89fc7" +lastPushedMetaChecksum: "sha256:ca5ff6d66ef74047" \ No newline at end of file diff --git a/scripts/splashtop_service_restart_macos.level.yaml b/scripts/splashtop_service_restart_macos.level.yaml new file mode 100644 index 0000000..fecb810 --- /dev/null +++ b/scripts/splashtop_service_restart_macos.level.yaml @@ -0,0 +1,26 @@ +name: splashtop_service_restart_macos.sh +description: Restarts Splashtop Streamer service on macOS +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Restarts the Splashtop Streamer service on macOS when remote access becomes unresponsive or connections fail. Useful for resolving connectivity issues without requiring a full system reboot. + + Usage Notes + ----------- + - Validates that the plist path is configured and exists + - Uses launchctl to manage the service lifecycle + - Unloads the Splashtop launch daemon (stops it), then reloads it (starts it) + - Plist path: /Library/LaunchDaemons/com.splashtop.streamer-for-admin.plist + + Requirements + ------------ + - macOS operating system + - Root/sudo privileges + - Splashtop Streamer installed +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM0OA +lastPushedChecksum: "sha256:e0bc68bd45e5ac0e" +lastPushedMetaChecksum: "sha256:7b2c9fbaea16af16" \ No newline at end of file diff --git a/scripts/splashtop_streamer_install.level.yaml b/scripts/splashtop_streamer_install.level.yaml new file mode 100644 index 0000000..1a23694 --- /dev/null +++ b/scripts/splashtop_streamer_install.level.yaml @@ -0,0 +1,27 @@ +name: splashtop_streamer_install.ps1 +description: Silently installs Splashtop Streamer agent for remote access +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Silently installs or upgrades the Splashtop Streamer agent for remote access. Configured to hide the system tray icon by default. + + Usage Notes + ----------- + - Validates installer path is provided and file exists + - Runs silent installation with parameters: prevercheck, no confirmation, hidden window, hidden tray icon + - Installer must be pre-staged at the specified path before running + - Default path: C:\temp\Splashtop_Streamer_Windows_DEPLOY_INSTALLER.exe + + Requirements + ------------ + - Windows OS + - Administrator privileges + - Splashtop deploy installer downloaded to specified path + - $installerPath: full path to the Splashtop Streamer deploy installer EXE +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM0OQ +lastPushedChecksum: "sha256:ba206f1ad3a5419d" +lastPushedMetaChecksum: "sha256:f2888088f12693e5" \ No newline at end of file diff --git a/scripts/splashtop_streamer_install_debian_amd64.level.yaml b/scripts/splashtop_streamer_install_debian_amd64.level.yaml new file mode 100644 index 0000000..ae6f26e --- /dev/null +++ b/scripts/splashtop_streamer_install_debian_amd64.level.yaml @@ -0,0 +1,28 @@ +name: splashtop_streamer_install_debian_amd64.sh +description: Installs Splashtop Streamer on Debian/Ubuntu AMD64 systems +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and installs the Splashtop Streamer agent on Debian/Ubuntu systems running AMD64 architecture. + + Usage Notes + ----------- + - Updates package lists before installation + - Downloads tarball from official Splashtop servers (v3.7.2.0) + - Extracts to /opt/splashtop install directory + - Installs deb package with automatic dependency resolution + - Cleans up downloaded tarball after installation + + Requirements + ------------ + - Debian/Ubuntu Linux (AMD64 architecture) + - Root/sudo privileges + - Internet connectivity + - wget and tar packages +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM1MA +lastPushedChecksum: "sha256:0d1eb15b627f4539" +lastPushedMetaChecksum: "sha256:97c2d5a9a1c8fb74" \ No newline at end of file diff --git a/scripts/splashtop_streamer_install_debian_arm64.level.yaml b/scripts/splashtop_streamer_install_debian_arm64.level.yaml new file mode 100644 index 0000000..2c74c36 --- /dev/null +++ b/scripts/splashtop_streamer_install_debian_arm64.level.yaml @@ -0,0 +1,28 @@ +name: splashtop_streamer_install_debian_arm64.sh +description: Installs Splashtop Streamer on Debian/Ubuntu ARM64 systems +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and installs the Splashtop Streamer agent on Debian systems running ARM64 architecture (e.g., Raspberry Pi, ARM servers). + + Usage Notes + ----------- + - Updates package lists and installs prerequisites (wget, tar) + - Downloads tarball from official Splashtop servers (v3.7.2.0) + - Extracts to /opt/splashtop install directory + - Installs deb package with automatic dependency resolution + - Enables and starts systemd service (splashtop-streamer.service) + - Cleans up downloaded tarball after installation + + Requirements + ------------ + - Debian Linux (ARM64 architecture) + - Root/sudo privileges + - Internet connectivity +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM1MQ +lastPushedChecksum: "sha256:4fb1452893ccc28c" +lastPushedMetaChecksum: "sha256:fe7c924f979e90b5" \ No newline at end of file diff --git a/scripts/splashtop_streamer_install_macos.level.yaml b/scripts/splashtop_streamer_install_macos.level.yaml new file mode 100644 index 0000000..a5c8ac1 --- /dev/null +++ b/scripts/splashtop_streamer_install_macos.level.yaml @@ -0,0 +1,26 @@ +name: splashtop_streamer_install_macos.sh +description: Downloads and installs Splashtop Streamer agent on macOS +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and installs the Splashtop Streamer agent on macOS for remote access capabilities. The Streamer runs on computers to allow remote connections from Splashtop Business clients. + + Usage Notes + ----------- + - Downloads installer DMG to /tmp/splashtop_streamer.dmg + - Installer URL points to v3.7.0.0 + - Mounts DMG, installs package, then unmounts and cleans up + - Installer is removed after installation + + Requirements + ------------ + - macOS + - Root/sudo privileges + - Internet connectivity +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM1Mg +lastPushedChecksum: "sha256:7962109ca8b9e885" +lastPushedMetaChecksum: "sha256:4306f91b36daf03a" \ No newline at end of file diff --git a/scripts/splashtop_uninstall.level.yaml b/scripts/splashtop_uninstall.level.yaml new file mode 100644 index 0000000..743c288 --- /dev/null +++ b/scripts/splashtop_uninstall.level.yaml @@ -0,0 +1,26 @@ +name: splashtop_uninstall.ps1 +description: Uninstalls Splashtop Streamer using Windows MSI service +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Uninstalls Splashtop Streamer from a Windows system using the Windows Installer service (MSI uninstall). + + Usage Notes + ----------- + - Searches for Splashtop Streamer in installed products + - Retrieves the product GUID automatically + - Executes silent uninstall via CIM method + - Product name can be customized via $productName variable + + Requirements + ------------ + - Windows OS + - Administrator privileges + - Splashtop Streamer installed +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM1Mw +lastPushedChecksum: "sha256:0800aca199e5aa18" +lastPushedMetaChecksum: "sha256:debb96d46a80206e" \ No newline at end of file diff --git a/scripts/splashtop_uninstall_macos.level.yaml b/scripts/splashtop_uninstall_macos.level.yaml new file mode 100644 index 0000000..d1a8543 --- /dev/null +++ b/scripts/splashtop_uninstall_macos.level.yaml @@ -0,0 +1,26 @@ +name: splashtop_uninstall_macos.sh +description: Completely removes Splashtop Streamer and all components from macOS +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Completely removes Splashtop Streamer from macOS including all related files, launch daemons, kernel extensions, and preferences. Performs a thorough cleanup of all Splashtop components. + + Usage Notes + ----------- + - Kills all running Splashtop processes + - Unloads launch daemons and agents + - Removes Splashtop Streamer, Splashtop Streamer for Business, and SplashtopRemote applications + - Removes kernel extensions, audio plugins, preferences, caches, and package receipts + - Data removal is permanent + + Requirements + ------------ + - macOS + - Root/sudo privileges +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM1NA +lastPushedChecksum: "sha256:b9213924115309e4" +lastPushedMetaChecksum: "sha256:9301e2495aeb9189" \ No newline at end of file diff --git a/scripts/start_menu_tiles_clear.level.yaml b/scripts/start_menu_tiles_clear.level.yaml new file mode 100644 index 0000000..654d62b --- /dev/null +++ b/scripts/start_menu_tiles_clear.level.yaml @@ -0,0 +1,27 @@ +name: start_menu_tiles_clear.ps1 +description: Removes all pinned app tiles from Windows 10 Start menu +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Removes all default pinned app tiles from the Windows 10 Start menu by modifying the registry. Restarts Explorer to apply changes immediately. Creates a clean Start menu without pre-configured tiles. + + Usage Notes + ----------- + - Must run in user context (not SYSTEM) to affect user's Start menu + - Modifies tile collection registry data then restarts Explorer + - Waits briefly for system to stabilize before restarting Explorer + - Opens Start menu after restart to initialize new layout + - Only affects current user's Start menu + - Registry modification is reversible + + Requirements + ------------ + - Windows 10 (does not apply to Windows 11) + - Registry access to HKCU +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM1NQ +lastPushedChecksum: "sha256:e5c2f1f84776bf20" +lastPushedMetaChecksum: "sha256:bcb32d4287d20577" \ No newline at end of file diff --git a/scripts/stdrename_install_toggle.level.yaml b/scripts/stdrename_install_toggle.level.yaml new file mode 100644 index 0000000..90411e8 --- /dev/null +++ b/scripts/stdrename_install_toggle.level.yaml @@ -0,0 +1,26 @@ +name: stdrename_install_toggle.ps1 +description: Toggles installation of stdrename file renaming utility +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Toggles installation of stdrename, a command-line file and folder renaming utility. If installed, uninstalls it. If not installed, downloads and installs it. Installs to System32 for system-wide availability. + + Usage Notes + ----------- + - Toggle behavior: if installed it uninstalls, if not installed it installs + - Downloads from GitHub releases (latest version) + - Installs to C:\Windows\System32 for PATH accessibility + + Requirements + ------------ + - Windows 10/11 + - Admin privileges (writing to System32) + - Internet connectivity for download + - $DownloadUrl and $InstallPath variables defined in script +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM1Ng +lastPushedChecksum: "sha256:6fb3442faa559a1f" +lastPushedMetaChecksum: "sha256:9b34f30babe918f9" \ No newline at end of file diff --git a/scripts/superops_agent_alt_path_uninstall_macos.level.yaml b/scripts/superops_agent_alt_path_uninstall_macos.level.yaml new file mode 100644 index 0000000..5d4ba2f --- /dev/null +++ b/scripts/superops_agent_alt_path_uninstall_macos.level.yaml @@ -0,0 +1,25 @@ +name: superops_agent_alt_path_uninstall_macos.sh +description: Uninstalls SuperOps agent from alternate /Library/limehawk path +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Uninstalls the SuperOps agent from macOS systems by executing the agent's built-in uninstall script from an alternate path (/Library/limehawk). Use this for agents installed to the alternate limehawk path instead of the default SuperOps path. + + Usage Notes + ----------- + - Uses uninstall script at /Library/limehawk/uninstall.sh + - Executes with sudo privileges + - Reports completion status after uninstall + + Requirements + ------------ + - macOS operating system + - Sudo privileges + - Uninstall script must exist at /Library/limehawk/uninstall.sh +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM1Nw +lastPushedChecksum: "sha256:8863ba4e5a0a2968" +lastPushedMetaChecksum: "sha256:8a18ecff63084297" \ No newline at end of file diff --git a/scripts/superops_agent_install.level.yaml b/scripts/superops_agent_install.level.yaml new file mode 100644 index 0000000..7f68d49 --- /dev/null +++ b/scripts/superops_agent_install.level.yaml @@ -0,0 +1,28 @@ +name: superops_agent_install.ps1 +description: Downloads and installs SuperOps RMM agent on Windows +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and installs the SuperOps RMM agent on Windows using the MSI installer. Designed for automated deployment where the agent download URL is provided as an environment variable. + + Usage Notes + ----------- + - AGENT_URL environment variable must be set by RMM platform + - Uses silent installation mode (/qn) for unattended deployment + - Automatically accepts license agreement + - Downloads installer to current working directory + - Cleans up installer file after successful installation + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges + - Internet access + - AGENT_URL environment variable set by RMM platform +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM1OA +lastPushedChecksum: "sha256:52ab8410999a4df7" +lastPushedMetaChecksum: "sha256:53916519f3b9b717" \ No newline at end of file diff --git a/scripts/superops_agent_install_macos.level.yaml b/scripts/superops_agent_install_macos.level.yaml new file mode 100644 index 0000000..99422b2 --- /dev/null +++ b/scripts/superops_agent_install_macos.level.yaml @@ -0,0 +1,29 @@ +name: superops_agent_install_macos.sh +description: Downloads and installs SuperOps RMM agent on macOS via PKG +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Downloads and installs the SuperOps RMM agent on macOS systems using the PKG installer format. Designed for automated deployment where the package download URL is provided as an environment variable. + + Usage Notes + ----------- + - PKGURL environment variable must be set by RMM platform + - Downloads PKG to /Users/Shared directory + - Uses macOS installer command with -dumplog for detailed logging + - Installs silently to root (/) target + - Installer handles cleanup after installation + + Requirements + ------------ + - macOS + - Sudo privileges + - Internet access + - PKGURL environment variable set by RMM platform + - curl command (standard on macOS) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM1OQ +lastPushedChecksum: "sha256:6fc3490acf5c28f8" +lastPushedMetaChecksum: "sha256:d222a493646d4c3f" \ No newline at end of file diff --git a/scripts/superops_agent_legacy_uninstall.level.yaml b/scripts/superops_agent_legacy_uninstall.level.yaml new file mode 100644 index 0000000..b083120 --- /dev/null +++ b/scripts/superops_agent_legacy_uninstall.level.yaml @@ -0,0 +1,26 @@ +name: superops_agent_legacy_uninstall.ps1 +description: Uninstalls legacy SuperOps agent via WMI IdentifyingNumber +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Uninstalls the legacy SuperOps agent on Windows systems using the product's IdentifyingNumber. Intended for environments where the agent cannot be uninstalled via standard methods or newer uninstallers. + + Usage Notes + ----------- + - No inputs required - IdentifyingNumber is hardcoded + - Queries WMI Win32_Product class to locate and uninstall + - Designed for silent, unattended execution + - Use this for older SuperOps agent installations + + Requirements + ------------ + - PowerShell 2.0 or later + - Administrative privileges + - WMI service must be running +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM2MA +lastPushedChecksum: "sha256:b7ce686565594ba9" +lastPushedMetaChecksum: "sha256:596c2c959ad1c2bd" \ No newline at end of file diff --git a/scripts/superops_agent_reinstall_macos.level.yaml b/scripts/superops_agent_reinstall_macos.level.yaml new file mode 100644 index 0000000..71e7317 --- /dev/null +++ b/scripts/superops_agent_reinstall_macos.level.yaml @@ -0,0 +1,31 @@ +name: superops_agent_reinstall_macos.sh +description: Uninstalls and reinstalls SuperOps RMM agent on macOS +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Performs a complete reinstallation of the SuperOps RMM agent on macOS by uninstalling the current agent and installing a new version from a provided URL. Useful for agent upgrades or fixing corrupted installations. + + Usage Notes + ----------- + - PKGURL environment variable must be set by RMM platform + - Uses background process to handle reinstall after uninstall + - Downloads new agent to /tmp directory + - 5-second polling interval for uninstall completion + - Uses official SuperOps uninstall script at /Library/superops/uninstall.sh + - Monitors agent processes to ensure clean uninstall before installing + + Requirements + ------------ + - macOS + - Sudo privileges + - Internet access + - SuperOps RMM agent currently installed + - PKGURL environment variable set by RMM platform + - curl command (standard on macOS) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM2MQ +lastPushedChecksum: "sha256:174ea4eea6e05f07" +lastPushedMetaChecksum: "sha256:3244aa9e885c8897" \ No newline at end of file diff --git a/scripts/superops_agent_uninstall.level.yaml b/scripts/superops_agent_uninstall.level.yaml new file mode 100644 index 0000000..67ac56e --- /dev/null +++ b/scripts/superops_agent_uninstall.level.yaml @@ -0,0 +1,26 @@ +name: superops_agent_uninstall.ps1 +description: Uninstalls SuperOps RMM agent using official or registry method +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Uninstalls the SuperOps RMM agent from Windows systems. Attempts to use the vendor's official uninstall program first, then falls back to registry-based MSI uninstallation if the official uninstaller is not found. + + Usage Notes + ----------- + - No inputs required - auto-detects installed SuperOps agent + - Searches for SuperOps uninstall.exe in common installation directories + - Falls back to registry search (including WOW6432Node) for MSI uninstall information + - Executes MSI uninstall with silent parameters (/qn /norestart) if needed + + Requirements + ------------ + - Windows PowerShell 5.1 or later + - Administrator privileges + - SuperOps RMM agent currently installed +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM2Mg +lastPushedChecksum: "sha256:76c7e150cfacff89" +lastPushedMetaChecksum: "sha256:77311cc9d07e964c" \ No newline at end of file diff --git a/scripts/superops_agent_uninstall_alt.level.yaml b/scripts/superops_agent_uninstall_alt.level.yaml new file mode 100644 index 0000000..b904201 --- /dev/null +++ b/scripts/superops_agent_uninstall_alt.level.yaml @@ -0,0 +1,28 @@ +name: superops_agent_uninstall_alt.ps1 +description: Uninstalls SuperOps agent via WMI/CIM with diagnostic reporting +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Performs a quiet uninstallation of the SuperOps RMM Agent using the MSI ProductCode GUID. Reports which uninstall method (WMI or CIM) was used, provides diagnostic information, and checks for leftover services to suggest manual cleanup commands. + + Usage Notes + ----------- + - No runtime inputs required - ProductCode GUID is hardcoded + - Tries WMI first, falls back to CIM if WMI fails + - Reports product details (name, version, publisher, method used) + - Missing product treated as success (already removed) + - Post-uninstall service check displays cleanup commands if needed + - Designed for execution inside SuperOps RMM + + Requirements + ------------ + - PowerShell 5.1+ + - Run as Administrator + - Windows operating system +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM2Mw +lastPushedChecksum: "sha256:d389b242c9fa2afc" +lastPushedMetaChecksum: "sha256:eec19bb4840dff42" \ No newline at end of file diff --git a/scripts/superops_agent_uninstall_linux.level.yaml b/scripts/superops_agent_uninstall_linux.level.yaml new file mode 100644 index 0000000..edf80a4 --- /dev/null +++ b/scripts/superops_agent_uninstall_linux.level.yaml @@ -0,0 +1,28 @@ +name: superops_agent_uninstall_linux.sh +description: Uninstalls SuperOps RMM agent from Linux using vendor script +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Uninstalls the SuperOps RMM agent from Linux systems by executing the agent's built-in uninstall script. Provides a clean removal of the agent and all associated components. + + Usage Notes + ----------- + - Uses official SuperOps uninstall script at /opt/superopsrmm/uninstall.sh + - Sets executable permissions on the uninstall script before running + - Validates script existence before execution + - All-or-nothing: any failure stops the script immediately + + Requirements + ------------ + - Bash shell + - Linux operating system + - Root/sudo privileges + - SuperOps RMM agent must be installed + - Uninstall script must exist at /opt/superopsrmm/uninstall.sh +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM2NA +lastPushedChecksum: "sha256:2009c72750ce9121" +lastPushedMetaChecksum: "sha256:f9008353821bfc43" \ No newline at end of file diff --git a/scripts/superops_agent_uninstall_macos.level.yaml b/scripts/superops_agent_uninstall_macos.level.yaml new file mode 100644 index 0000000..0777b3c --- /dev/null +++ b/scripts/superops_agent_uninstall_macos.level.yaml @@ -0,0 +1,28 @@ +name: superops_agent_uninstall_macos.sh +description: Uninstalls SuperOps RMM agent from macOS using vendor script +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Uninstalls the SuperOps RMM agent from macOS systems by executing the agent's built-in uninstall script. Provides a clean removal of the agent and all associated components. + + Usage Notes + ----------- + - Uses official SuperOps uninstall script at /Library/superops/uninstall.sh + - Executes with sudo privileges + - Validates script existence before execution + - All-or-nothing: any failure stops the script immediately + + Requirements + ------------ + - Bash shell + - macOS operating system + - Sudo privileges + - SuperOps RMM agent must be installed + - Uninstall script must exist at /Library/superops/uninstall.sh +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM2NQ +lastPushedChecksum: "sha256:1f2ddeee28510922" +lastPushedMetaChecksum: "sha256:f5ace28a184bd5b2" \ No newline at end of file diff --git a/scripts/superops_service_restart.level.yaml b/scripts/superops_service_restart.level.yaml new file mode 100644 index 0000000..8da973e --- /dev/null +++ b/scripts/superops_service_restart.level.yaml @@ -0,0 +1,30 @@ +name: superops_service_restart.ps1 +description: Restarts RMM agent services with automatic RMM execution detection +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Restarts RMM agent services on Windows systems. Automatically detects if the + script is being executed by the RMM agent itself and uses a safe background + restart approach to avoid terminating mid-execution. + + Usage Notes + ----------- + - Set service filter via $YourServiceFilterHere (e.g., "limehawk") + - Filter converted to wildcard pattern *filter* for service discovery + - When running from RMM agent: spawns background process with 30-second delay + - When running manually: restarts services directly and waits for completion + - Reports status of each service after restart + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges + - PowerShell 5.1+ + - Target RMM agent installed (matching services must exist) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM2Ng +lastPushedChecksum: "sha256:21071e206631d4f0" +lastPushedMetaChecksum: "sha256:b164d6950b1ebfca" \ No newline at end of file diff --git a/scripts/superops_tray_icon_show_always.level.yaml b/scripts/superops_tray_icon_show_always.level.yaml new file mode 100644 index 0000000..38a8210 --- /dev/null +++ b/scripts/superops_tray_icon_show_always.level.yaml @@ -0,0 +1,29 @@ +name: superops_tray_icon_show_always.ps1 +description: Configures Windows to always show SuperOps tray icon +shell: POWERSHELL +runAs: CURRENT_USER +timeout: 900 +readme: | + Purpose + ------- + Configures Windows system tray settings to always show the SuperOps RMM agent tray icon. Ensures the SuperOps icon remains visible in the system tray notification area rather than being hidden in the overflow. + + Usage Notes + ----------- + - MUST RUN AS LOGGED-IN USER - NOT SYSTEM + - Modifies HKCU registry which is per-user + - Running as SYSTEM will modify SYSTEM's registry, not the user's + - Sets IsPromoted=1 for SuperOps notification entries + - Exits gracefully (exit 0) if registry path does not exist yet + - No restart required - changes take effect on next tray icon update + + Requirements + ------------ + - Windows 11 (build 22000 or later) - older Windows not supported + - PowerShell 5.1 or later + - Must run as logged-in user (not SYSTEM) + - SuperOps agent must be installed +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM2Nw +lastPushedChecksum: "sha256:60705b6f854e0ad7" +lastPushedMetaChecksum: "sha256:f9f2aee50948f820" \ No newline at end of file diff --git a/scripts/synology_backup_agent_install.level.yaml b/scripts/synology_backup_agent_install.level.yaml new file mode 100644 index 0000000..ad4b59a --- /dev/null +++ b/scripts/synology_backup_agent_install.level.yaml @@ -0,0 +1,27 @@ +name: synology_backup_agent_install.ps1 +description: Installs Synology Active Backup for Business Agent via winget +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Installs the Synology Active Backup for Business Agent on Windows using winget. This agent enables centralized backup management from a Synology NAS. + + Usage Notes + ----------- + - Validates winget availability before installation + - Installs silently using winget package manager + - Package ID: Synology.ActiveBackupForBusinessAgent + - After installation, connect to your Synology NAS to configure backup tasks + + Requirements + ------------ + - Windows 10 1809+ or Windows 11 + - Administrator privileges + - winget (App Installer) installed + - Synology NAS with Active Backup for Business package +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM2OA +lastPushedChecksum: "sha256:71047d6fc64e0624" +lastPushedMetaChecksum: "sha256:3146194ade7788b0" \ No newline at end of file diff --git a/scripts/synology_backup_agent_install_linux.level.yaml b/scripts/synology_backup_agent_install_linux.level.yaml new file mode 100644 index 0000000..ee41776 --- /dev/null +++ b/scripts/synology_backup_agent_install_linux.level.yaml @@ -0,0 +1,30 @@ +name: synology_backup_agent_install_linux.sh +description: Installs Synology Active Backup for Business Agent on Linux +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Installs the Synology Active Backup for Business Agent on Linux systems. Includes prerequisite checks for architecture, kernel headers, and required tools. + + Usage Notes + ----------- + - Downloads agent from global.download.synology.com + - Agent version: 2.7.1-3235 + - Architecture: x86_64 only + - Package format: deb (Debian/Ubuntu) + - Verifies kernel headers and required tools before installation + - Cleans up temporary files after installation + + Requirements + ------------ + - Debian 10/11/12 or Ubuntu 16.04-24.04 (x86_64 only) + - Root/sudo privileges + - linux-headers for current kernel + - make 4.1+, dkms 2.2.0.3+, gcc 4.8.2+ + - unzip, curl or wget +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM2OQ +lastPushedChecksum: "sha256:d25da66ea53f3a05" +lastPushedMetaChecksum: "sha256:5a69a5cf5651e9ab" \ No newline at end of file diff --git a/scripts/terminated_user_lockout.level.yaml b/scripts/terminated_user_lockout.level.yaml new file mode 100644 index 0000000..aed72c7 --- /dev/null +++ b/scripts/terminated_user_lockout.level.yaml @@ -0,0 +1,30 @@ +name: terminated_user_lockout.ps1 +description: Immediately locks out a terminated user — resets password, disables account, locks workstation, forces logoff +shell: POWERSHELL +runAs: SYSTEM +timeout: 1800 +readme: | + Purpose + ------- + Performs a full local lockout for a terminated employee in a single pass. Locks the workstation, resets the local account password to a random value, disables the account, and forces logoff of all active sessions. + + Usage Notes + ----------- + - Validates username input + - Locks workstation if target user has active console session + - Resets password to a random 32-character string (never logged) + - Disables the local user account + - Logs off all active sessions + - Preserves user profile and all files on disk + - Account can be re-enabled with Enable-LocalUser (new password required) + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges + - PowerShell 5.1+ + - $TerminatedUsername: local username to lock out (SuperOps runtime variable) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM3MA +lastPushedChecksum: "sha256:a2fc53f08fbbf738" +lastPushedMetaChecksum: "sha256:3146db3911a79e6e" \ No newline at end of file diff --git a/scripts/time_sync_fix.level.yaml b/scripts/time_sync_fix.level.yaml new file mode 100644 index 0000000..2c1655c --- /dev/null +++ b/scripts/time_sync_fix.level.yaml @@ -0,0 +1,29 @@ +name: time_sync_fix.ps1 +description: Fixes Windows time synchronization by resetting NTP configuration +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Fixes Windows time synchronization by setting the timezone, resetting the Windows Time service, configuring NTP servers, and forcing a time sync. Resolves common time drift and synchronization issues. + + Usage Notes + ----------- + - Sets timezone (configurable via $TimeZone variable) + - Unregisters and re-registers w32time service + - Configures SpecialPollInterval to 86400 seconds (24 hours) + - Sets service triggers for network connectivity + - Uses pool.ntp.org servers by default + - Forces immediate time resync + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges + - Network connectivity to NTP servers + - $TimeZone and $NtpServers variables defined in script +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM3MQ +lastPushedChecksum: "sha256:2a5b7085817c1386" +lastPushedMetaChecksum: "sha256:59750e210cec6130" \ No newline at end of file diff --git a/scripts/time_utc_set.level.yaml b/scripts/time_utc_set.level.yaml new file mode 100644 index 0000000..57da64b --- /dev/null +++ b/scripts/time_utc_set.level.yaml @@ -0,0 +1,25 @@ +name: time_utc_set.ps1 +description: Fixes time drift on Windows/Linux dual-boot systems +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Configures Windows to use UTC for the hardware clock instead of local time. This prevents the clock from being wrong when switching between Windows and Linux on dual-boot systems, as Linux uses UTC by default. + + Usage Notes + ----------- + - Sets RealTimeIsUniversal DWORD to 1 in HKLM\System\CurrentControlSet\Control\TimeZoneInformation + - No configurable inputs required + - Run once after installing Windows on a dual-boot system + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges (required for HKLM registry access) + - Windows 10/11 +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM3Mg +lastPushedChecksum: "sha256:4a8bd8317bc76df9" +lastPushedMetaChecksum: "sha256:0ad7080096c9e58e" \ No newline at end of file diff --git a/scripts/ubuntu_debian_update_verbose.level.yaml b/scripts/ubuntu_debian_update_verbose.level.yaml new file mode 100644 index 0000000..0ed8efa --- /dev/null +++ b/scripts/ubuntu_debian_update_verbose.level.yaml @@ -0,0 +1,30 @@ +name: ubuntu_debian_update_verbose.sh +description: Updates all packages on Ubuntu/Debian with verbose output +shell: BASH +runAs: SYSTEM +timeout: 10800 +readme: | + Purpose + ------- + Automates system package updates for Ubuntu/Debian systems with verbose output and error handling. Updates package lists, upgrades installed packages, removes unused dependencies, and cleans package cache. Provides color-coded status messages and reboot detection. + + Usage Notes + ----------- + - Run with sudo or as root + - Configure options at top of script: + - ENSURE_APT_UTILS: Install apt-utils if missing + - ENABLE_FULL_UPGRADE: Use dist-upgrade instead of upgrade + - ENABLE_AUTOREMOVE: Remove unused packages after upgrade + - ENABLE_CACHE_CLEAN: Clean apt cache to free disk space + - ENABLE_COLOR_OUTPUT: Use colored terminal output + + Requirements + ------------ + - Root/sudo access required + - Ubuntu or Debian-based Linux distribution + - Network connectivity to package repositories + - apt package manager +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM3Mw +lastPushedChecksum: "sha256:cb32e47af9465ca4" +lastPushedMetaChecksum: "sha256:832c0b229748f99e" \ No newline at end of file diff --git a/scripts/user_accounts_report.level.yaml b/scripts/user_accounts_report.level.yaml new file mode 100644 index 0000000..8205dfc --- /dev/null +++ b/scripts/user_accounts_report.level.yaml @@ -0,0 +1,27 @@ +name: user_accounts_report.ps1 +description: Generates report of local user accounts and group memberships +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Generates a comprehensive report of all local user accounts, their group memberships, login sessions, and user profiles on the system. Provides a single view of all user-related information for auditing and troubleshooting. + + Usage Notes + ----------- + - No inputs required - reports on current system state + - Reports all local users including disabled accounts + - Shows group membership for each user + - Displays active login sessions + - Lists user profile folders with last use time and size + + Requirements + ------------ + - Windows 10/11 or Windows Server + - PowerShell 5.1+ + - Admin privileges recommended for full details +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM3NA +lastPushedChecksum: "sha256:5aff121cdaf29830" +lastPushedMetaChecksum: "sha256:45743dae6ae0c17c" \ No newline at end of file diff --git a/scripts/usmt_lan_migrate.level.yaml b/scripts/usmt_lan_migrate.level.yaml new file mode 100644 index 0000000..f150bf5 --- /dev/null +++ b/scripts/usmt_lan_migrate.level.yaml @@ -0,0 +1,37 @@ +name: usmt_lan_migrate.ps1 +description: LAN profile migration over USMT, store moved via LocalSend or path +shell: POWERSHELL +runAs: SYSTEM +timeout: 3600 +readme: | + Purpose + ------- + Migrates a Windows local-account user profile from an OLD laptop to a NEW laptop across the same local network using USMT. The same script is dropped on both machines; a role selector decides whether the machine is the Sender (old) or the Receiver (new). The compressed USMT migration store (USMT.MIG) is moved between machines by LocalSend (primary) or a plain file path (UNC/SMB/USB) fallback. Carries profile data and settings only, not installed applications. Targets are local accounts in a workgroup; Entra/Azure AD accounts are out of scope. + + Usage Notes + ----------- + - Interactive by default (menu asks role first: OLD/Sender vs NEW/Receiver), or unattended via the hardcoded CONFIG block at the top of the script. + - Sender: installs USMT + LocalSend CLI, picks the profile, runs a scanstate /p space estimate, then scanstate with compression ON to produce a single USMT.MIG, then sends the store. + - Receiver: installs USMT + LocalSend CLI, opens a temporary firewall rule and receives the store (or reads it from a path), optionally creates the target local account, then runs loadstate with /mu source:target mapping. Unattended runs still require -Force/config flag before the destructive loadstate. + - Compression is forced ON so the store is one clean USMT.MIG for a single LocalSend transfer. + - For very large profiles (>20 GB) over WiFi, the path transport (wired/USB/UNC) is recommended; the Sender warns when the estimate is large. + - LocalSend CLI used: 0w0mewo/localsend-cli (Go), release v0.0.7, port 53317. send --ip -f ; recv -d ; scan -t . Verified against the CLI command source, not the stub official README. + - Default staging/store path: C:\MigrationStore + + Requirements + ------------ + - Windows 10/11 or Windows Server, PowerShell 5.1+ + - Administrator privileges (loadstate, account creation, firewall rule, scanstate) + - Both machines on the same subnet (LocalSend discovery uses mDNS) + - Internet connectivity on first run (USMT + LocalSend CLI download) + - Sufficient disk for the migration store on both ends + + Security + -------- + - No secrets in logs: the encryption key and new-account password are never printed and never written to backup_info.json (the key is recorded only as the literal "[ENCRYPTED]" marker). + - The temporary inbound firewall rule for the LocalSend port is always removed in a finally block, even on failure. + - LocalSend transfer is HTTPS by default. +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM3NQ +lastPushedChecksum: "sha256:fc591c1e7cec5da2" +lastPushedMetaChecksum: "sha256:5df630b2eefb6644" \ No newline at end of file diff --git a/scripts/usmt_profile_migrate.level.yaml b/scripts/usmt_profile_migrate.level.yaml new file mode 100644 index 0000000..f3c5d2c --- /dev/null +++ b/scripts/usmt_profile_migrate.level.yaml @@ -0,0 +1,29 @@ +name: usmt_profile_migrate.ps1 +description: Interactive USMT backup/restore for remote terminal sessions +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Interactive USMT (User State Migration Tool) backup and restore utility for remote terminal sessions. Enables backing up user profiles from one machine and restoring them to another, including documents, settings, and application data. + + Usage Notes + ----------- + - Run interactively via menu-driven interface + - Backup options: Documents, Desktop, Downloads, Pictures, Music, Videos, Favorites/Bookmarks, AppData, Printers, Wallpaper settings + - Optional encryption for backup security + - Restore options: merge to existing account or create new local account + - USMT tools are auto-downloaded if not present + - Default store path: C:\MigrationStore + + Requirements + ------------ + - Windows 10/11 or Windows Server + - Administrator privileges required + - Internet connectivity for initial USMT download + - Sufficient disk space for migration store +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM3Ng +lastPushedChecksum: "sha256:d397fd188deca05c" +lastPushedMetaChecksum: "sha256:2e087a2a73503345" \ No newline at end of file diff --git a/scripts/webview2_repair_install.level.yaml b/scripts/webview2_repair_install.level.yaml new file mode 100644 index 0000000..576a2b3 --- /dev/null +++ b/scripts/webview2_repair_install.level.yaml @@ -0,0 +1,31 @@ +name: webview2_repair_install.ps1 +description: Detects and repairs broken Microsoft Edge WebView2 Runtime installs +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Detects broken installations of the Microsoft Edge WebView2 Runtime where the registry still references a version that no longer exists on disk, and repairs them by removing stale ClientState keys and reinstalling the current Evergreen Runtime via Microsoft's official bootstrapper. + + Usage Notes + ----------- + - Validates input parameters before proceeding + - Detects existing WebView2 install across HKLM 64-bit, HKLM 32-bit, HKCU + - Verifies the on-disk install folder matches the registry version + - Removes stale ClientState registry keys when the install is broken (or when forced) + - Downloads the Evergreen bootstrapper to TEMP and runs it silently with /silent /install + - Re-verifies the install via registry and filesystem after the bootstrapper completes + - Cleans up the installer file on success + - Download URL: https://go.microsoft.com/fwlink/p/?LinkId=2124703 + - Force Reinstall: false + + Requirements + ------------ + - Windows PowerShell 5.1 or later + - Administrator privileges (required for HKLM key removal and system-wide install) + - Internet connectivity to go.microsoft.com +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM3Nw +lastPushedChecksum: "sha256:eb622de3ac3b06f0" +lastPushedMetaChecksum: "sha256:12630399b7d7c829" \ No newline at end of file diff --git a/scripts/wifi_adapters_disable.level.yaml b/scripts/wifi_adapters_disable.level.yaml new file mode 100644 index 0000000..3b4ff66 --- /dev/null +++ b/scripts/wifi_adapters_disable.level.yaml @@ -0,0 +1,27 @@ +name: wifi_adapters_disable.ps1 +description: Disables all physical and virtual Wi-Fi network adapters +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Identifies and disables all physical and virtual Wi-Fi network adapters on a Windows system. Enforces a wired-only network policy by ensuring that wireless connectivity is turned off while leaving Ethernet adapters enabled. + + Usage Notes + ----------- + - Checks for administrative privileges before proceeding + - Enumerates all network adapters including hidden ones + - Categorizes adapters as Wi-Fi, Wired, or Other + - Displays detailed list of all adapters for review + - Disables all Wi-Fi adapters; Ethernet/wired adapters are not affected + + Requirements + ------------ + - Windows 10/11 or Windows Server + - Administrator privileges + - Get-NetAdapter cmdlet available +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM3OA +lastPushedChecksum: "sha256:16dd67e48b67ceaf" +lastPushedMetaChecksum: "sha256:78f8840e065d4f86" \ No newline at end of file diff --git a/scripts/wifi_passwords_show.level.yaml b/scripts/wifi_passwords_show.level.yaml new file mode 100644 index 0000000..69c4fcb --- /dev/null +++ b/scripts/wifi_passwords_show.level.yaml @@ -0,0 +1,31 @@ +name: wifi_passwords_show.ps1 +description: Retrieves and displays all saved Wi-Fi network passwords +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Retrieves and displays all saved Wi-Fi network profiles and their passwords stored on the Windows system. Useful for recovering forgotten passwords or auditing saved wireless credentials. + + Usage Notes + ----------- + - Queries all saved wireless network profiles via netsh + - Retrieves the password (key content) for each profile + - Displays results in a formatted table with SSID and password + + Requirements + ------------ + - Windows 10/11 or Windows Server + - Administrator privileges (for key retrieval) + - Wireless adapter present (or previously present) + + Security + -------- + - Displays sensitive credential information in plain text + - Run only on systems you are authorized to audit + - Passwords are retrieved from Windows credential store +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM3OQ +lastPushedChecksum: "sha256:23635bb4bd6d99f9" +lastPushedMetaChecksum: "sha256:7744b32421d67520" \ No newline at end of file diff --git a/scripts/wifiman_install.level.yaml b/scripts/wifiman_install.level.yaml new file mode 100644 index 0000000..1db8761 --- /dev/null +++ b/scripts/wifiman_install.level.yaml @@ -0,0 +1,26 @@ +name: wifiman_install.ps1 +description: Installs Ubiquiti WiFiman Desktop via winget +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Installs Ubiquiti WiFiman Desktop application using winget. Automatically installs winget if not present on the system. + + Usage Notes + ----------- + - Package ID is hardcoded (UbiquitiInc.WiFimanDesktop) + - Validates input parameters before proceeding + - Checks if winget is installed; installs via PowerShell Gallery if missing + - Installs WiFiman using winget with unattended options + + Requirements + ------------ + - Windows 10 1809+ or Windows 11 + - Administrator privileges + - Internet connectivity +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM4MA +lastPushedChecksum: "sha256:22ab242925134ed1" +lastPushedMetaChecksum: "sha256:8b91771f373e0326" \ No newline at end of file diff --git a/scripts/win11_compatibility_check.level.yaml b/scripts/win11_compatibility_check.level.yaml new file mode 100644 index 0000000..2fa546c --- /dev/null +++ b/scripts/win11_compatibility_check.level.yaml @@ -0,0 +1,25 @@ +name: win11_compatibility_check.ps1 +description: Checks hardware requirements for Windows 11 upgrade +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Checks if the current Windows device meets the hardware requirements for Windows 11 upgrade, including processor (2+ cores, 1GHz+), RAM (4GB+), storage (64GB+), TPM 2.0, Secure Boot capability, and UEFI firmware. + + Usage Notes + ----------- + - Checks processor specifications, RAM capacity, and disk space + - Checks TPM version and Secure Boot status + - Reports pass/fail for each component independently + - Provides overall compatibility verdict with specific issues listed + + Requirements + ------------ + - Windows 10 + - Administrator privileges (for TPM check) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM4MQ +lastPushedChecksum: "sha256:12be2dab9e24d0d4" +lastPushedMetaChecksum: "sha256:9910bc724e201799" \ No newline at end of file diff --git a/scripts/windows11_25h2_install.level.yaml b/scripts/windows11_25h2_install.level.yaml index 2208e1c..ab8cb9f 100644 --- a/scripts/windows11_25h2_install.level.yaml +++ b/scripts/windows11_25h2_install.level.yaml @@ -41,5 +41,5 @@ readme: | - Resume artifacts under ProgramData\Limehawk\windows11_25h2_install cleaned after success groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNzQzMg -lastPushedChecksum: "sha256:e4d0ade6f1a0228e" +lastPushedChecksum: "sha256:d2a0271f2d08f3ee" lastPushedMetaChecksum: "sha256:956c7b96d8299d58" \ No newline at end of file diff --git a/scripts/windows11_compatibility_check.level.yaml b/scripts/windows11_compatibility_check.level.yaml new file mode 100644 index 0000000..2d13519 --- /dev/null +++ b/scripts/windows11_compatibility_check.level.yaml @@ -0,0 +1,33 @@ +name: windows11_compatibility_check.ps1 +description: Checks TPM, SecureBoot, RAM, CPU compatibility for Windows 11 +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Evaluates system compatibility for Windows 11 upgrade by checking hardware requirements including TPM 2.0, Secure Boot, CPU compatibility, RAM, storage, and UEFI firmware. Identifies blockers preventing upgrade and attempts to enable required features where possible. Designed for RMM deployment to assess upgrade readiness across a fleet of devices. + + Usage Notes + ----------- + - Configurable minimum requirements: MinimumRamGB (default 4), MinimumStorageGB (default 64) + - CheckOnly mode for read-only assessment (default: true) + - Optional AttemptAutoFix to enable TPM or Secure Boot if hardware supports it (default: false) + - Checks TPM version/status, Secure Boot, CPU against known compatible list, RAM, storage, and UEFI firmware + - Reports all blockers with specific remediation steps + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges required + - Windows 10 or Windows 11 operating system + - TPM and Secure Boot cmdlets available (built into Windows) + + Security + -------- + - Changing BIOS settings (TPM, Secure Boot) requires system reboot + - Auto-fix operations are potentially disruptive to the system +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM4Mg +lastPushedChecksum: "sha256:c2db40bcd9a3a6cf" +lastPushedMetaChecksum: "sha256:113554ca377d83e9" \ No newline at end of file diff --git a/scripts/windows11_iso_upgrade.level.yaml b/scripts/windows11_iso_upgrade.level.yaml index 34486a7..54f369f 100644 --- a/scripts/windows11_iso_upgrade.level.yaml +++ b/scripts/windows11_iso_upgrade.level.yaml @@ -7,7 +7,7 @@ readme: | Purpose ------- ISO-based silent in-place upgrade to Windows 11, version 25H2, for Level RMM (run as System). This is the fallback path when the enablement package / Windows Update / Installation Assistant routes are unsuitable: it fetches a fresh consumer (Home/Pro/Edu) ISO via Fido, gates on hardware eligibility before any download, then drives setup.exe for an authoritative compat scan and the upgrade itself. Already-25H2 devices are a no-op success. The fleet is Home/Pro only, so the consumer multi-edition ISO is sufficient (the business editions ISO is not obtainable unauthenticated). - + Usage Notes ----------- - No-op success if the registry DisplayVersion already reports 25H2 @@ -22,7 +22,7 @@ readme: | - Consumer editions only (Home / Pro / Edu) - no Enterprise - Microsoft ISO URLs expire ~24h; fetched and consumed in one run - Level timeout: 14400 seconds (4 hours); run as System - + Requirements ------------ - PowerShell 5.1 or later @@ -37,7 +37,7 @@ readme: | - $workDir: working directory for Fido + ISO (C:\ProgramData\Limehawk\windows11_iso_upgrade) - $requiredFreeGB: minimum free space on the system drive (35) - $rebootAfterInstall: schedule reboot after a successful upgrade (true) - + Security -------- - No secrets in logs @@ -46,3 +46,7 @@ readme: | - Microsoft ISO URLs expire ~24h; fetched and consumed in a single run - Default reboots after success (set $rebootAfterInstall = false for maintenance windows) - ISO + Fido.ps1 are deleted from the work dir after a successful upgrade +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNzk2OQ +lastPushedChecksum: "sha256:826e21fcf7732cae" +lastPushedMetaChecksum: "sha256:2b67127477d6ce86" \ No newline at end of file diff --git a/scripts/windows_dark_mode_enable.level.yaml b/scripts/windows_dark_mode_enable.level.yaml new file mode 100644 index 0000000..eb334d3 --- /dev/null +++ b/scripts/windows_dark_mode_enable.level.yaml @@ -0,0 +1,28 @@ +name: windows_dark_mode_enable.ps1 +description: Sets wallpaper and dark mode on non-activated Windows 11 +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Bypasses the locked personalization settings on non-activated Windows 11 by applying wallpaper and dark mode settings directly via registry. Also optionally configures UTC hardware clock for dual-boot Linux compatibility. + + Usage Notes + ----------- + - Downloads wallpaper from configured URL to Public Pictures + - Sets dark mode registry keys for both Apps and System themes + - Sets wallpaper path in registry and applies via UpdatePerUserSystemParameters + - Restarts Explorer to apply theme changes immediately + - Optional UTC clock fix for dual-boot systems (fixUtcClock) + - Configurable inputs: wallpaperUrl, wallpaperPath, enableDarkMode, fixUtcClock + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges (required for UTC clock fix) + - Internet access for wallpaper download +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM4Mw +lastPushedChecksum: "sha256:9d07ef367a12f5b9" +lastPushedMetaChecksum: "sha256:9277a9b1d43842a5" \ No newline at end of file diff --git a/scripts/windows_dism_sfc_chkdsk_run.level.yaml b/scripts/windows_dism_sfc_chkdsk_run.level.yaml new file mode 100644 index 0000000..2375d7b --- /dev/null +++ b/scripts/windows_dism_sfc_chkdsk_run.level.yaml @@ -0,0 +1,36 @@ +name: windows_dism_sfc_chkdsk_run.ps1 +description: Runs DISM, SFC, and chkdsk for Windows system file repair +shell: POWERSHELL +runAs: SYSTEM +timeout: 14400 +readme: | + Purpose + ------- + Runs standard Windows health checks and repair commands including DISM image health scans, disk checks, system file verification, and component cleanup. Designed for unattended execution in RMM environments to perform routine system maintenance and repair operations. + + Usage Notes + ----------- + - Configurable operations via hardcoded flags: RunDismScan, RunDismRestore, RunChkdsk, RunSfc + - DISM RestoreHealth only runs if ScanHealth detects corruption (saves time on healthy systems) + - chkdsk runs against all fixed local drives (DriveType 3) + - ChkdskParameters default to /scan; use /f /r for full check + - RebootWhenCorruptionFound (default: true): 5-minute reboot with user warning only when ScanHealth found corruption AND RestoreHealth succeeded + - Healthy systems and failed repairs never reboot + - Failed operations are reported but script continues to next operation + - DISM operates in online mode against the running Windows installation + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges required + - Windows 8.1/Server 2012 R2 or later for DISM commands + - Sufficient disk space for repair operations + + Security + -------- + - Operations may cause system modifications and require reboots + - Requires elevated permissions to modify system components +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM4NA +lastPushedChecksum: "sha256:b4ad9d2189166041" +lastPushedMetaChecksum: "sha256:b8b34b4001d1223d" \ No newline at end of file diff --git a/scripts/windows_firewall_toggle.level.yaml b/scripts/windows_firewall_toggle.level.yaml new file mode 100644 index 0000000..6e27aa4 --- /dev/null +++ b/scripts/windows_firewall_toggle.level.yaml @@ -0,0 +1,29 @@ +name: windows_firewall_toggle.ps1 +description: Enables or disables Windows Firewall for all profiles +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Toggles Windows Firewall state for all profiles (Domain, Private, Public). If firewall is ON, turns it OFF. If firewall is OFF, turns it ON. + + Usage Notes + ----------- + - No inputs required; automatically detects current state and toggles + - Affects all firewall profiles: Domain, Private, Public + - Verifies new state after toggle + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges required + + Security + -------- + - Disabling firewall reduces system security + - Use with caution in production environments +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM4NQ +lastPushedChecksum: "sha256:3ababf5f681c4117" +lastPushedMetaChecksum: "sha256:14fe87767297b1c7" \ No newline at end of file diff --git a/scripts/windows_laps_entra_configure.level.yaml b/scripts/windows_laps_entra_configure.level.yaml index e3f41aa..8280b91 100644 --- a/scripts/windows_laps_entra_configure.level.yaml +++ b/scripts/windows_laps_entra_configure.level.yaml @@ -7,7 +7,7 @@ readme: | Purpose ------- Configures the built-in Windows LAPS client to rotate the local administrator password and escrow it to Microsoft Entra ID. Applies the LAPS policy via the registry, forces an immediate policy processing pass, and reports the result from the LAPS operational event log so the tech can see whether the Entra escrow succeeded or is pending. Works on Entra ID Free (Microsoft 365 Business Standard) - no Intune subscription required. - + Usage Notes ----------- - All inputs are hardcoded: BackupDirectory (1 = Entra ID), PasswordAgeDays (30), PasswordLength (20), PasswordComplexity (4 = upper+lower+numbers+specials), AdministratorAccountName (empty = built-in Administrator), PasswordEncryptionEnabled (1) @@ -17,16 +17,20 @@ readme: | - Forces an immediate LAPS policy processing pass - Reads Microsoft-Windows-LAPS/Operational and surfaces the latest status line - IMPORTANT: The tenant setting "Enable Microsoft Entra Local Administrator Password Solution (LAPS)" must be set to Yes (Entra admin center -> Devices -> Device settings) for the password to actually escrow to Entra ID - + Requirements ------------ - Windows 11, or Windows 10 patched with the April 2023 (or later) cumulative update that ships the Windows LAPS client - Administrator privileges (RMM runs as SYSTEM) - Device joined to Microsoft Entra ID - Tenant setting "Enable Microsoft Entra Local Administrator Password Solution (LAPS)" = Yes - + Security -------- - The managed password is never read or printed - Escrowed passwords are stored encrypted in Entra ID - Disabling or weakening the policy reduces local-account security +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNzk3MA +lastPushedChecksum: "sha256:70cdd1f031aea21d" +lastPushedMetaChecksum: "sha256:2f3697defacd5999" \ No newline at end of file diff --git a/scripts/windows_product_key_export_superops.level.yaml b/scripts/windows_product_key_export_superops.level.yaml new file mode 100644 index 0000000..d0c2aa2 --- /dev/null +++ b/scripts/windows_product_key_export_superops.level.yaml @@ -0,0 +1,31 @@ +name: windows_product_key_export_superops.ps1 +description: Retrieves Windows product key and syncs to SuperOps custom field +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Retrieves the Windows product key from the local machine's registry by decoding the DigitalProductId value and sends it to a SuperOps custom field for asset management and license tracking. + + Usage Notes + ----------- + - Decodes DigitalProductId from HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion + - Sends product key to SuperOps custom field via Send-CustomField + - CustomFieldName defaults to "Windows Product Key" + - Product key format: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX + + Requirements + ------------ + - PowerShell 5.1 or later + - SuperOps RMM agent installed and module available ($SuperOpsModule) + - Registry access to read Windows product information + + Security + -------- + - Product key is considered sensitive licensing data + - Product key is sent to SuperOps; no secrets appear in local logs +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM4Ng +lastPushedChecksum: "sha256:8c4fd9133fdd413e" +lastPushedMetaChecksum: "sha256:64c9a1b00066f6da" \ No newline at end of file diff --git a/scripts/windows_update_access_restore.level.yaml b/scripts/windows_update_access_restore.level.yaml new file mode 100644 index 0000000..0a5b2a4 --- /dev/null +++ b/scripts/windows_update_access_restore.level.yaml @@ -0,0 +1,24 @@ +name: windows_update_access_restore.ps1 +description: Restores user access to Windows Update settings +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Removes the SetDisableUXWUAccess registry key to restore user access to Windows Update settings in the Settings app. + + Usage Notes + ----------- + - Checks for SetDisableUXWUAccess registry key under HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate + - Removes the key if present; reports success if key did not exist + - Counterpart to windows_update_access_toggle script + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM4Nw +lastPushedChecksum: "sha256:b8d790b668a1b512" +lastPushedMetaChecksum: "sha256:2a13b643717822f7" \ No newline at end of file diff --git a/scripts/windows_update_access_toggle.level.yaml b/scripts/windows_update_access_toggle.level.yaml new file mode 100644 index 0000000..0e402be --- /dev/null +++ b/scripts/windows_update_access_toggle.level.yaml @@ -0,0 +1,25 @@ +name: windows_update_access_toggle.ps1 +description: Toggles user access to Windows Update in Settings app +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Toggles user access to Windows Update settings in the Settings app. If access is currently blocked, it will be enabled. If access is currently allowed, it will be blocked. + + Usage Notes + ----------- + - Checks current state of SetDisableUXWUAccess registry key under HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate + - Toggles the state by adding or removing the key + - Reports new state after toggle + - Use windows_update_access_restore to always enable access + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM4OA +lastPushedChecksum: "sha256:f3e6ce36a0c0a34e" +lastPushedMetaChecksum: "sha256:9315fab47e7ee94e" \ No newline at end of file diff --git a/scripts/windows_update_reset.level.yaml b/scripts/windows_update_reset.level.yaml new file mode 100644 index 0000000..c6b22de --- /dev/null +++ b/scripts/windows_update_reset.level.yaml @@ -0,0 +1,35 @@ +name: windows_update_reset.ps1 +description: Resets Windows Update components and clears cache +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Completely resets Windows Update components by stopping services, clearing caches, resetting security descriptors, re-registering DLLs, and restarting services. Fixes most Windows Update problems. + + Usage Notes + ----------- + - Stops BITS, wuauserv, appidsvc, cryptsvc services + - Flushes DNS cache and clears BITS download queue data + - Renames SoftwareDistribution and catroot2 folders (creates .bak for recovery) + - Resets BITS and wuauserv security descriptors + - Re-registers 30+ Windows Update related DLLs + - Resets Winsock + - Restarts all services after reset + - Optional RebootAfterReset (default: false) + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges + - Internet connectivity for updates after reset + + Security + -------- + - Modifies system registry and service configurations + - Creates .bak folders for recovery of renamed directories +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM4OQ +lastPushedChecksum: "sha256:dc0660ba30a52b1f" +lastPushedMetaChecksum: "sha256:7a248ea5926f32dd" \ No newline at end of file diff --git a/scripts/windowsapps_orphan_cleanup.level.yaml b/scripts/windowsapps_orphan_cleanup.level.yaml new file mode 100644 index 0000000..915085a --- /dev/null +++ b/scripts/windowsapps_orphan_cleanup.level.yaml @@ -0,0 +1,8 @@ +name: windowsapps_orphan_cleanup.ps1 +shell: POWERSHELL +runAs: SYSTEM +timeout: 60 +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNzUxMw +lastPushedChecksum: "sha256:20b9dc388889f488" +lastPushedMetaChecksum: "sha256:fa1374641b509925" \ No newline at end of file diff --git a/scripts/winget_package_install.level.yaml b/scripts/winget_package_install.level.yaml new file mode 100644 index 0000000..d7b72e9 --- /dev/null +++ b/scripts/winget_package_install.level.yaml @@ -0,0 +1,27 @@ +name: winget_package_install.ps1 +description: Installs software package using winget with SuperOps integration +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Installs a software package using winget (Windows Package Manager). Uses SuperOps runtime text replacement for the package name. Handles silent installation with automatic acceptance of agreements. + + Usage Notes + ----------- + - PackageName runtime variable specifies winget package ID (e.g., "Google.Chrome", "Mozilla.Firefox") + - Validates software name input before proceeding + - Searches for package to verify it exists in the repository + - Silent installation mode with machine scope when available + - Accepts package and source agreements automatically + + Requirements + ------------ + - Winget must be installed (use winget_setup first) + - Administrator privileges recommended + - Internet connectivity +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM5MA +lastPushedChecksum: "sha256:81593e032c1092d2" +lastPushedMetaChecksum: "sha256:3720ad0025a0796a" \ No newline at end of file diff --git a/scripts/winget_setup.level.yaml b/scripts/winget_setup.level.yaml new file mode 100644 index 0000000..9937858 --- /dev/null +++ b/scripts/winget_setup.level.yaml @@ -0,0 +1,30 @@ +name: winget_setup.ps1 +description: Installs winget (Windows Package Manager) for RMM environments +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Installs winget (Windows Package Manager) on Windows systems using the most reliable installation method. Optimized for RMM environments running under SYSTEM context. Uses manual AppX installation method which is more reliable than Repair-WinGetPackageManager. Handles all OS versions including Windows 10, 11, and Server 2019+. + + Usage Notes + ----------- + - Uses manual AppX installation method (most reliable for SYSTEM context) + - Downloads winget and dependencies (VCLibs, UI.Xaml) from GitHub + - Configures PATH environment variable automatically + - Skips installation if winget already exists (unless forceReinstall is true) + - Configurable: forceReinstall (boolean), downloadTimeout (default 120s), skipServerCore (boolean) + - Installs for all users when possible + - Cleans up temporary files after installation + + Requirements + ------------ + - Administrator or SYSTEM privileges + - Windows 10 1809+ or Windows Server 2019+ + - Internet connectivity to GitHub + - PowerShell 5.1 or higher +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM5MQ +lastPushedChecksum: "sha256:9c39b0b8e934af79" +lastPushedMetaChecksum: "sha256:df6c4302eaf1984d" \ No newline at end of file diff --git a/scripts/winget_upgrade_all.level.yaml b/scripts/winget_upgrade_all.level.yaml new file mode 100644 index 0000000..11d02b1 --- /dev/null +++ b/scripts/winget_upgrade_all.level.yaml @@ -0,0 +1,28 @@ +name: winget_upgrade_all.ps1 +description: Upgrades all winget-managed packages to latest versions +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Upgrades all winget-managed packages to their latest versions. Includes logging and automatic cleanup of old log files. + + Usage Notes + ----------- + - Checks Windows version requirements before proceeding + - Locates winget executable in WindowsApps directory + - Runs winget upgrade --all with silent options + - Accepts all package agreements automatically + - Logs output to Windows temp directory + - Cleans up logs older than 14 days + + Requirements + ------------ + - Windows 10 1809+ or Windows 11 or Server 2022 + - Administrator privileges + - Winget (App Installer) installed +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM5Mg +lastPushedChecksum: "sha256:a012ab90c5f2a0d1" +lastPushedMetaChecksum: "sha256:8e02e7d5acd2db4d" \ No newline at end of file diff --git a/scripts/winre_partition_resize.level.yaml b/scripts/winre_partition_resize.level.yaml new file mode 100644 index 0000000..e45e2c4 --- /dev/null +++ b/scripts/winre_partition_resize.level.yaml @@ -0,0 +1,35 @@ +name: winre_partition_resize.ps1 +description: Extends WinRE partition by 250MB for Windows updates +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Extends the Windows Recovery Environment (WinRE) partition by 250MB to resolve issues with Windows updates requiring more recovery partition space. This is commonly needed for KB5034441 and similar updates. + + Usage Notes + ----------- + - Examines current disk layout and WinRE status + - Validates requirements (WinRE enabled, sufficient space) + - Backs up existing WinRE partition content to BackupFolder (default: C:\winre_backup) + - Disables WinRE temporarily, shrinks OS partition by 250MB if needed + - Extends or recreates WinRE partition, then re-enables WinRE + - Verifies new configuration after completion + - Reboot recommended before running + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges + - Sufficient free space on OS partition + - WinRE must be enabled before running + + Security + -------- + - Modifies disk partitions; use with caution + - Creates backup of WinRE content before modification +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM5Mw +lastPushedChecksum: "sha256:193e2e8a68f2a4ce" +lastPushedMetaChecksum: "sha256:16d1d403c7cd3d39" \ No newline at end of file diff --git a/scripts/winre_restore.level.yaml b/scripts/winre_restore.level.yaml new file mode 100644 index 0000000..1e439e0 --- /dev/null +++ b/scripts/winre_restore.level.yaml @@ -0,0 +1,33 @@ +name: winre_restore.ps1 +description: Restores Windows Recovery Environment from system image +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Restores Windows Recovery Environment (WinRE) by downloading Winre.wim and ReAgent.xml files from a specified URL and placing them in the Recovery folder. Fixes systems where WinRE has been corrupted or deleted. + + Usage Notes + ----------- + - Configure WinreWimUrl and ReAgentXmlUrl in script before deployment + - Disables WinRE via reagentc /disable before restore + - Downloads files to TEMP then moves to C:\Windows\System32\Recovery + - Re-enables WinRE via reagentc /enable after restore + - Uses curl with retry and timeout for downloads + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges + - Network connectivity to download URLs + - Valid WinRE files hosted at specified URLs + + Security + -------- + - Downloads from specified URLs; ensure URLs are trusted + - Modifies system recovery configuration +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM5NA +lastPushedChecksum: "sha256:2ee202fdbbaf51a9" +lastPushedMetaChecksum: "sha256:295aff01d82520b3" \ No newline at end of file diff --git a/scripts/winreagent_cleanup.level.yaml b/scripts/winreagent_cleanup.level.yaml new file mode 100644 index 0000000..7ce3001 --- /dev/null +++ b/scripts/winreagent_cleanup.level.yaml @@ -0,0 +1,26 @@ +name: winreagent_cleanup.ps1 +description: Cleans up WinREAgent folder to free disk space +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Deletes the C:\$WinREAgent folder which contains temporary Windows Recovery Environment update files. This folder can consume significant disk space and is safe to delete after WinRE updates are complete. + + Usage Notes + ----------- + - FolderPath defaults to C:\$WinREAgent + - Checks if folder exists before attempting deletion + - Deletes folder and all contents recursively + - Handles hidden/system folder attributes + - Exits successfully if folder does not exist + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges recommended +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM5NQ +lastPushedChecksum: "sha256:142834ca4118604e" +lastPushedMetaChecksum: "sha256:7e9b2e2e650ff49e" \ No newline at end of file diff --git a/scripts/wol_enable.level.yaml b/scripts/wol_enable.level.yaml new file mode 100644 index 0000000..57a66de --- /dev/null +++ b/scripts/wol_enable.level.yaml @@ -0,0 +1,35 @@ +name: wol_enable.ps1 +description: Enables Wake-on-LAN settings for Ethernet adapters +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Enables Wake-on-LAN (WOL) in both BIOS/UEFI and Windows NIC settings. Supports Dell, HP, and Lenovo systems with manufacturer-specific BIOS modules. Also enables WOL on all capable network adapters in Windows. + + Usage Notes + ----------- + - Auto-detects system manufacturer via CIM + - Checks and installs required PowerShell modules (NuGet, PSGallery) + - Installs manufacturer-specific BIOS module if needed + - Dell: Uses DellBIOSProvider, sets WakeOnLan to LANOnly + - HP: Uses HPCMSL, sets Wake On Lan to Boot to Hard Drive + - Lenovo: Uses WMI, sets WakeOnLAN to Primary + - Enables MSPower_DeviceWakeEnable on all capable Windows NICs + + Requirements + ------------ + - Windows 10/11 + - Administrator privileges + - Internet connectivity for module installation + - Supported manufacturer: Dell, HP, or Lenovo + + Security + -------- + - Modifies BIOS settings (requires admin) + - Installs PowerShell modules from PSGallery +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM5Ng +lastPushedChecksum: "sha256:2af7e13609778071" +lastPushedMetaChecksum: "sha256:7a03f392ef857aa3" \ No newline at end of file diff --git a/scripts/wol_status_check.level.yaml b/scripts/wol_status_check.level.yaml new file mode 100644 index 0000000..f1e9798 --- /dev/null +++ b/scripts/wol_status_check.level.yaml @@ -0,0 +1,28 @@ +name: wol_status_check.ps1 +description: Checks Wake-on-LAN status at BIOS and OS levels +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Checks the Wake-on-LAN (WOL) status at both BIOS and OS levels. Supports Dell, HP, and Lenovo devices by using manufacturer-specific PowerShell modules to query BIOS settings. + + Usage Notes + ----------- + - Detects device manufacturer (Dell, HP, or Lenovo) + - Installs required PowerShell modules if needed + - Queries BIOS for WOL settings using manufacturer-specific module + - Checks OS-level NIC WOL configuration + - Reports combined BIOS and OS WOL status + + Requirements + ------------ + - Windows 10/11 or Windows Server + - Administrator privileges + - Internet access for module installation + - Supported manufacturer: Dell, HP, or Lenovo +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM5Nw +lastPushedChecksum: "sha256:fd47c8923957702e" +lastPushedMetaChecksum: "sha256:b323a1bc9defad48" \ No newline at end of file diff --git a/scripts/workstation_info_display.level.yaml b/scripts/workstation_info_display.level.yaml new file mode 100644 index 0000000..5db5048 --- /dev/null +++ b/scripts/workstation_info_display.level.yaml @@ -0,0 +1,30 @@ +name: workstation_info_display.ps1 +description: Displays system info popup for user self-service from tray icon +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Collects and displays comprehensive workstation information including operating system details, computer name, current user, CPU specifications, memory capacity, network adapter configuration, and hardware serial number. Designed for quick troubleshooting access via tray icon menu or RMM execution with dual output modes. + + Usage Notes + ----------- + - DisplayMode: "popup" (Windows Forms message box) or "console" (text output for RMM capture) + - IncludeNetwork: whether to include detailed network adapter information (default: true) + - PopupTitle: title text for the popup message box (default: "Workstation Information") + - Uses CIM/WMI queries for hardware and OS data collection + - Network adapter information limited to enabled adapters only + - Memory sizes reported in GB with 2 decimal precision + - Missing or unavailable information reported as N/A + + Requirements + ------------ + - PowerShell 5.1 or later + - Windows with CIM/WMI support + - For popup mode: .NET Framework (included in Windows) + - No special permissions required (runs in user context) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM5OA +lastPushedChecksum: "sha256:330cc5d8ea5101af" +lastPushedMetaChecksum: "sha256:6f267d18c8bc710b" \ No newline at end of file diff --git a/scripts/workstation_info_display_macos.level.yaml b/scripts/workstation_info_display_macos.level.yaml new file mode 100644 index 0000000..1bf19f4 --- /dev/null +++ b/scripts/workstation_info_display_macos.level.yaml @@ -0,0 +1,26 @@ +name: workstation_info_display_macos.sh +description: Displays system info popup dialog for macOS user self-service +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Displays a popup dialog showing system information to the end user on macOS. Designed to be triggered from the RMM tray icon for user self-service. Provides quick access to basic system details without opening System Preferences. + + Usage Notes + ----------- + - Collects OS name/version (sw_vers), computer name (scutil), CPU/RAM (sysctl), IP address (ipconfig) + - Builds and displays an AppleScript dialog with system information + - Runs dialog in background so popup remains after script exits + - Script exits immediately; popup stays open for the user + + Requirements + ------------ + - macOS 10.14 or later + - No special privileges required + - AppleScript/osascript available (included in macOS) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDM5OQ +lastPushedChecksum: "sha256:1308f5b29f92137a" +lastPushedMetaChecksum: "sha256:b4e5067f95e281e0" \ No newline at end of file diff --git a/scripts/workstation_oobe_seal.level.yaml b/scripts/workstation_oobe_seal.level.yaml new file mode 100644 index 0000000..0561294 --- /dev/null +++ b/scripts/workstation_oobe_seal.level.yaml @@ -0,0 +1,37 @@ +name: workstation_oobe_seal.ps1 +description: Seals a configured Win11 image to a silent OOBE via sysprep +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Finishes provisioning an OEM Windows 11 machine that has been configured in audit mode. It removes any stale local admin account left over from a prior run, writes a sysprep answer file that auto-creates a local administrator and silently skips the out-of-box setup screens, then runs sysprep to generalize the image to OOBE and power the machine off. The next power-on runs a silent OOBE that creates the admin account, logs in once, and lands on the desktop. + + Usage Notes + ----------- + - Run interactively in audit mode as the built-in Administrator, NOT pushed by an RMM agent. The runAs enum is set to SYSTEM_USER as the closest match; the real context is the built-in Administrator on the audit-mode desktop from a USB. + - Validates the CONFIG values and rejects the placeholder password + - Removes a stale local admin account (and its profile) if present + - Writes the embedded answer file to C:\Windows\Temp\unattend.xml + - Runs sysprep /oobe /shutdown /unattend:, which generalizes the image and POWERS THE MACHINE OFF + - OOBE screens hidden: EULA, OEM registration, online account, local account, wireless setup + - AutoLogon enabled once (LogonCount = 1) for the new admin + - The OOBE-skip works only because sysprep actively applies the answer file; dropping unattend.xml into C:\Windows\Panther or setting the ChildCompletion registry flag does NOT work on modern Windows 11 + - Edit the CONFIG block before running: $adminName, $adminPassword, $timeZone + + Requirements + ------------ + - Windows 11 (OEM image), sitting in audit mode + - Running interactively as the built-in Administrator (audit-mode desktop) + - PowerShell 5.1+ with an elevated session + + Security + -------- + - The admin password is written in plain text into the answer file (a sysprep requirement). Sysprep deletes the answer file on successful generalize, but treat the configured password as sensitive. + - No working password ships with this script. The default is an obvious placeholder the operator must replace; the script refuses to run until it is changed. + - Change or rotate the OOBE-created admin password after first logon per your provisioning policy. +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDQwMA +lastPushedChecksum: "sha256:131faea0ea03ff73" +lastPushedMetaChecksum: "sha256:38bb682d15a4d427" \ No newline at end of file diff --git a/scripts/workstation_reboot_force.level.yaml b/scripts/workstation_reboot_force.level.yaml new file mode 100644 index 0000000..9dd9479 --- /dev/null +++ b/scripts/workstation_reboot_force.level.yaml @@ -0,0 +1,25 @@ +name: workstation_reboot_force.ps1 +description: Forces an immediate system reboot without user prompts +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Forces an immediate system reboot, closing all applications without saving or prompting. Designed for RMM deployment when a machine needs to be rebooted regardless of user activity or open applications. + + Usage Notes + ----------- + - Initiates forced immediate reboot via shutdown.exe + - Force mode enabled: closes applications without prompting + - Timeout: 0 seconds (immediate reboot) + - Users will lose unsaved work + + Requirements + ------------ + - PowerShell 5.1 or later + - Administrator privileges +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDQwMQ +lastPushedChecksum: "sha256:396ded2032104a45" +lastPushedMetaChecksum: "sha256:2c00b765cd6f6685" \ No newline at end of file diff --git a/scripts/workstation_remote_wipe.level.yaml b/scripts/workstation_remote_wipe.level.yaml new file mode 100644 index 0000000..81ac448 --- /dev/null +++ b/scripts/workstation_remote_wipe.level.yaml @@ -0,0 +1,32 @@ +name: workstation_remote_wipe.ps1 +description: Initiates MDM remote wipe to factory reset Windows device +shell: POWERSHELL +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Initiates a remote wipe of the Windows device using the MDM RemoteWipe CSP. This completely erases all data on the device and resets it to factory state. WARNING: THIS ACTION IS IRREVERSIBLE. ALL DATA WILL BE PERMANENTLY DELETED. + + Usage Notes + ----------- + - Creates CIM session to local MDM namespace + - Retrieves MDM_RemoteWipe instance and invokes doWipeMethod + - Device begins factory reset process immediately + - No configurable settings; wipe executes upon script run + + Requirements + ------------ + - Windows 10/11 (MDM enrolled or Azure AD joined) + - Administrator privileges + - Device must have MDM RemoteWipe capability + + Security + -------- + - Use only on lost/stolen devices or for secure decommissioning + - Cannot be undone once initiated + - Ensure proper authorization before running +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDQwMg +lastPushedChecksum: "sha256:ee9261e6127e7c42" +lastPushedMetaChecksum: "sha256:95746506d05791bb" \ No newline at end of file diff --git a/scripts/workstation_rename_auto.level.yaml b/scripts/workstation_rename_auto.level.yaml index 22d27b3..e28c073 100644 --- a/scripts/workstation_rename_auto.level.yaml +++ b/scripts/workstation_rename_auto.level.yaml @@ -9,7 +9,7 @@ readme: | Renames a Windows device to CLIENT3-USERUUID (exactly 15 chars). CLIENT3 is a 3-char abbreviation of the Level device group name ({{level_group_name}}). USER is the sanitized logged-in username; UUID is the SMBIOS UUID tail. - + Usage Notes ----------- - Device must be in a named Level group (client group) @@ -17,14 +17,18 @@ readme: | - Reboot required for hostname change to take effect - No SuperOps/API — Level inventory follows OS hostname after reboot - Output slots: DesiredHostname, RenameStatus - + Requirements ------------ - Windows 10/11 - Level agent; run as System - Device assigned to a client group variables: -- name: DesiredHostname - description: Built 15-char hostname (CLIENT3-USERUUID) -- name: RenameStatus - description: already_matches | scheduled | no_user | warning | error + - name: DesiredHostname + description: Built 15-char hostname (CLIENT3-USERUUID) + - name: RenameStatus + description: already_matches | scheduled | no_user | warning | error +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDQwMw +lastPushedChecksum: "sha256:aac54867219e84f3" +lastPushedMetaChecksum: "sha256:a67ac845a03c7149" \ No newline at end of file diff --git a/scripts/workstation_rename_auto_macos.level.yaml b/scripts/workstation_rename_auto_macos.level.yaml index 8bf64ab..a0a833e 100644 --- a/scripts/workstation_rename_auto_macos.level.yaml +++ b/scripts/workstation_rename_auto_macos.level.yaml @@ -8,18 +8,22 @@ readme: | ------- Renames a macOS device to CLIENT3-USERUUID (exactly 15 chars). CLIENT3 from Level group name; sets HostName, ComputerName, LocalHostName. - + Usage Notes ----------- - Device must be in a named Level group - Output slots: DesiredHostname, RenameStatus - + Requirements ------------ - macOS 10.14+ - Level agent; run as System (root) variables: -- name: DesiredHostname - description: Built 15-char hostname (CLIENT3-USERUUID) -- name: RenameStatus - description: already_matches | applied | error + - name: DesiredHostname + description: Built 15-char hostname (CLIENT3-USERUUID) + - name: RenameStatus + description: already_matches | applied | error +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDQwNA +lastPushedChecksum: "sha256:df8780e338a26cd4" +lastPushedMetaChecksum: "sha256:816262b32c580d5a" \ No newline at end of file diff --git a/scripts/workstation_rename_manual.level.yaml b/scripts/workstation_rename_manual.level.yaml index 1653c25..a6d3cdb 100644 --- a/scripts/workstation_rename_manual.level.yaml +++ b/scripts/workstation_rename_manual.level.yaml @@ -9,7 +9,7 @@ readme: | Renames a Windows device to CLIENT-USERUUID (exactly 15 chars). The client segment comes from the cf_client_prefix custom field, set once per client group and inherited by every device in it (e.g. BELL -> BELL-MICHELL004). - + Usage Notes ----------- - Set the prefix per client group, not per device: @@ -24,14 +24,18 @@ readme: | is skipped with status no_user when nobody is logged in - Reboot required for hostname change to take effect - Output slots: DesiredHostname, RenameStatus - + Requirements ------------ - Windows 10/11 - Level agent; run as System - cf_client_prefix set on the client group, or device in a named group variables: -- name: DesiredHostname - description: Built 15-char hostname (CLIENT-USERUUID) -- name: RenameStatus - description: already_matches | scheduled | no_user | warning | error + - name: DesiredHostname + description: Built 15-char hostname (CLIENT-USERUUID) + - name: RenameStatus + description: already_matches | scheduled | no_user | warning | error +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDQwNQ +lastPushedChecksum: "sha256:64cf30cf38e8a925" +lastPushedMetaChecksum: "sha256:8ee638961730bf6b" \ No newline at end of file diff --git a/scripts/workstation_rename_manual_macos.level.yaml b/scripts/workstation_rename_manual_macos.level.yaml index 10fc237..6af4f41 100644 --- a/scripts/workstation_rename_manual_macos.level.yaml +++ b/scripts/workstation_rename_manual_macos.level.yaml @@ -9,7 +9,7 @@ readme: | Renames a macOS device to CLIENT-USERUUID. The client segment comes from the cf_client_prefix custom field, set once per client group and inherited by every device in it. Mirrors workstation_rename_manual.ps1 on Windows. - + Usage Notes ----------- - Set the prefix per client group: @@ -19,13 +19,17 @@ readme: | - User segment is the console user; the run is skipped with status no_user when nobody is logged in - Output slots: DesiredHostname, RenameStatus - + Requirements ------------ - macOS 10.14+ - Level agent; run as System (root) variables: -- name: DesiredHostname - description: Built 15-char hostname (CLIENT-USERUUID) -- name: RenameStatus - description: already_matches | applied | no_user | error + - name: DesiredHostname + description: Built 15-char hostname (CLIENT-USERUUID) + - name: RenameStatus + description: already_matches | applied | no_user | error +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDQwNg +lastPushedChecksum: "sha256:47f553bc5a202559" +lastPushedMetaChecksum: "sha256:5609b8c535c88f44" \ No newline at end of file diff --git a/scripts/workstation_screenshot_macos.level.yaml b/scripts/workstation_screenshot_macos.level.yaml new file mode 100644 index 0000000..2673393 --- /dev/null +++ b/scripts/workstation_screenshot_macos.level.yaml @@ -0,0 +1,30 @@ +name: workstation_screenshot_macos.sh +description: Captures screenshot of all displays on macOS +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Captures a screenshot on macOS and saves it with a timestamped filename. Uses the native screencapture utility for silent capture. Designed for RMM deployment to capture system state for troubleshooting. + + Usage Notes + ----------- + - Creates screenshot directory at /tmp/screenshots/ if it does not exist + - Filename format: screenshot_YYYYMMDD_HHMMSS.png + - Silent capture enabled (-x flag, no shutter sound) + - Screenshots saved to /tmp (auto-cleaned on reboot) + + Requirements + ------------ + - macOS 10.12 or later + - screencapture utility (standard macOS component) + - Screen Recording permission may be required (System Preferences > Security) + + Security + -------- + - May capture sensitive on-screen content +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDQwNw +lastPushedChecksum: "sha256:68e461f9f17d2d4c" +lastPushedMetaChecksum: "sha256:3146d24ddd1b608a" \ No newline at end of file diff --git a/scripts/workstation_uptime_reboot_macos.level.yaml b/scripts/workstation_uptime_reboot_macos.level.yaml new file mode 100644 index 0000000..622ae67 --- /dev/null +++ b/scripts/workstation_uptime_reboot_macos.level.yaml @@ -0,0 +1,28 @@ +name: workstation_uptime_reboot_macos.sh +description: Reboots macOS when uptime exceeds configured threshold +shell: BASH +runAs: SYSTEM +timeout: 900 +readme: | + Purpose + ------- + Automatically reboots a macOS or Linux system if the uptime exceeds a specified threshold (default: 14 days). Useful for ensuring systems are restarted periodically to apply updates and clear memory. + + Usage Notes + ----------- + - Detects operating system (Linux or macOS) + - Compares current uptime against threshold + - Reboots if threshold exceeded, otherwise exits cleanly + - Default maximum uptime: 14 days + - Linux: Reads uptime from /proc/uptime + - macOS: Uses sysctl kern.boottime + + Requirements + ------------ + - macOS or Linux with /proc/uptime (Linux) or sysctl (macOS) + - Root/sudo privileges for reboot + - max_uptime_days: Days before triggering reboot (default: 14) +groupId: Z2lkOi8vbGV2ZWwvU2NyaXB0R3JvdXAvNTQ2NDU +scriptId: Z2lkOi8vbGV2ZWwvU2NyaXB0LzEyNDQwOA +lastPushedChecksum: "sha256:3ba41914e543c9d9" +lastPushedMetaChecksum: "sha256:0781436877e2f134" \ No newline at end of file