Proactive Remediation Scripts in Intune..the saga continues. Detect and delete a Windows Scheduled Task
Just a couple of months back I had blogged about fixing Broken Device Sync using Proactive remediation scripts in Intune. Today I am going to cover a use case involving detecting a schedule task and deleting it using Proactive remediation scripts feature in Intune.
That's it for now. I will end this blog by saying that with the power of PowerShell and Proactive Remediation scripts feature, use cases are limitless.
A little background on the use case -
If you have been working with Lenovo devices, then you may have come across Glance by Mirametrix pre-installed on some of the models. Glance uses the built-in camera to provide some security features like Presence Detection, Privacy alerts etc. However, the software can also result in intrusive behavior and cause disruption to end user's over all experience. A customer I recently worked with wanted to get rid of this software and part of the solution was to delete the Schedule task that is responsible for re-installing the software after the reboot. Head over to this link for more details.
Coming to the solution -
As you would know by now that for Proactive remediation scripts feature to work, you need a Detection script and a Remediation script to be in place.
For Detection, this is what I am using - (Make a note of the exit codes as the execution of the Remediation script is dependent on them. Exit code 1 will trigger the execution of the Remediation script.)
# Define Variables
$taskName,$taskExists,$curTskStat,$errMsg = "","",""
# Main script
$taskName = "GlanceDiscovery"
$taskExists = Get-ScheduledTask | Where-Object {$_.TaskName -like $taskName }
if(-not ($taskExists)) {
Write-Host "Glance is not installed on the machine"
exit 0
}
Try{
$curTskStat = $taskname.State
}
Catch{
$errMsg = $_.Exception.Message
Write-Error $errMsg
exit 1
}
If ($curTskStat -eq "Ready"){
Write-Output $curTskStat
exit 1
}
Else{
If($curTskStat -eq "Disabled"){
Write-Output $curTskStat
exit 1
}
Else{
Write-Error "Error: " + $errMsg
exit 1
}
}
For Remediation, I am using a one liner to keep things simple -
Unregister-ScheduledTask -TaskName "GlanceDiscovery" -Confirm:$false
Now it is time to import the scripts in Intune.
1. Sign-in to the https://endpoint.microsoft.com
2. Browse to Reports – Proactive Remediations – Create a Script Package
3. Fill the relevant fields like Name, Description, Publisher etc and hit Next.
4. In the settings section, select the relevant Detection and Remediation scripts as covered above in the blog.
5. Run the script in 64-bit Powershell and leave the rest of the options to Default.
6. Assign the scope tags if required and then assign to device based group. You can define the frequency of the execution of the Proactive script. I set to run Daily against production devices to suit my requirements.
The Intune management extension agent checks with Intune once every hour and after every reboot for any new scripts or changes. The run results can be monitored directly in Intune under Reports->Endpoint Analytics-><Name of your Proactive Script>
You can switch to Device Status and then add the columns to get more details related to Pre & Post Detection and Remediation status.
You can filter further against specific Remediation Status.
If there are no errors then a successful Post remediation detection output will be captured.
Until next time..
Hi, How did you go about removing the actual software after the remediation script? :)
ReplyDeleteAt the time of writing this blog, there was no automated way of removing the app. It has to be manually un-installed.
DeleteWouldn't a powershell oneliner like "Get-AppxPackage -AllUsers -Name MirametrixInc.GlancebyMirametrix | Remove-AppxPackage" work for removal?
ReplyDelete