Please see the Community Solution Testing Statement
+This Analysis retrieves results of a filesystem scan to attempt detecting Apache Commons Text versions that may be vulnerable to one of the following vulnerabilty CVE-2022-42889 reported in October 2022:
+This Analysis attempts to detect the presence and versions of Apache Commons Text java library, without distinction between vulnerable or updated versions. These results should be considered only a starting point in determining whether a system is actually vulnerable, along with other information such as the version of Java Virtual Machine and specific application or code configurations as referenced in the security bulletins above.
]]>pulls back
+]]>
The `ProductState` should be a bit set of some sort that contains info about the state of the AV products detected.
]]>+
References:
+http://helpx.adobe.com/creative-cloud/packager/update-server-setup-tool.html
+http://helpx.adobe.com/creative-cloud/packager/provisioning-toolkit-enterprise.html
+http://helpx.adobe.com/creative-cloud/packager/preparing-deploy.html
+http://helpx.adobe.com/creative-cloud/packager/creative-cloud-packager.html
+ + +]]>
+
References:
+http://helpx.adobe.com/creative-cloud/packager/update-server-setup-tool.html
+http://helpx.adobe.com/creative-cloud/packager/provisioning-toolkit-enterprise.html
+http://helpx.adobe.com/creative-cloud/packager/preparing-deploy.html
+http://helpx.adobe.com/creative-cloud/packager/creative-cloud-packager.html
+ + +]]>
The latest version of this analysis is found here: http://bigfix.me/analysis/details/2994608
+See the task "Delete start menu shortcuts containing "uninstall"" to delete the shortcuts found in the property "All Users Start Menu "Uninstall" shortcuts" of this analysis. The task is found here: http://bigfix.me/fixlet/details/3657
]]>Please see the Community Solution Testing Statement
+This Analysis retrieves results of a filesystem scan to attempt detecting Apache Commons Text versions that may be vulnerable to one of the following vulnerabilty CVE-2022-42889 reported in October 2022:
+This Analysis attempts to detect the presence and versions of Apache Commons Text java library, without distinction between vulnerable or updated versions. These results should be considered only a starting point in determining whether a system is actually vulnerable, along with other information such as the version of Java Virtual Machine and specific application or code configurations as referenced in the security bulletins above.
]]>Policies queried include:
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>This analysis does not provide the drive letter alongside each property which means that the first row for each property (where applicable) should correspond to the same volume.
+This analysis is only applicable on computers that are Bitlocker capable.
+This analysis uses information provided by the Bitlocker Configuration Probe: Invoke - Bitlocker Configuration Probe - Windows
+Credit, kudos, and compliments to jgstew for providing the basis for this: https://www.bigfix.me/analysis/details/2994754
+Credit, kudos, and compliments to geeksikh for providing the encryption started and finished properties: https://bigfix.me/analysis/details/96
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Bitlocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Bitlocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>This analysis relies on the information provided by the Fixlet: Invoke - Bitlocker Configuration Probe - Windows
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Bitlocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>This analysis requires Fixlet: Invoke - Bitlocker Recovery Password Probe - Windows to be run on the device before it can retrieve the recovery password.
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Bitlocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>+
References:
+https://en.wikipedia.org/wiki/BitLocker
+http://msdn.microsoft.com/en-us/library/windows/desktop/aa376483(v=vs.85).aspx
+http://msdn.microsoft.com/en-us/library/aa376433(v=VS.85).aspx
+ +]]>
http://www.msfn.org/board/topic/152622-hotfixes-for-faster-windows-7-bootstartup/
+ +For best performance, "Size of RdyBoostBootPlan" should be less than 524288.
]]>This analysis relies on Fixlet: Invoke - Certificate Store Probe - Windows in the C3-Inventory site
+Information on using this content is available here: https://github.com/strawgate/C3-Inventory/wiki/Certificate-Store
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>References:
+http://ask-leo.com/how_do_i_see_the_results_of_a_chkdsk_that_ran_on_boot.html
+http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
+http://kmwoley.com/blog/?p=441
+http://superuser.com/questions/214209/where-are-the-results-of-chkdsk-located-in-windows-7
+http://ericphelps.com/uncheck/index.htm
+https://www.raymond.cc/blog/how-to-recover-chk-files-created-by-chkdsk-and-scandisk/
++
]]>
+
]]>
+
References:
+http://technet.microsoft.com/en-us/library/cc779260(v=ws.10).aspx
+http://support.bigfix.com/inspectors/World%20Objects_Any.html
+ +http://web.mit.edu/kerberos/krb5-1.5/krb5-1.5.4/doc/krb5-admin/Clock-Skew.html
+]]>
This analysis scraps information put in place by Fixlet: Invoke - Windows Cached Credentials Probe - Windows
+Information provided by this fixlet is useful in determining which user accounts need password resets if a machine is compromised.
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Windows-Credentials
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>http://bigfix.me/fixlet/details/6060
+]]>
This analysis attempts to pull back a lot of data about devices on a Windows system.
+Latest version found here: http://bigfix.me/analysis/details/2994593
+See this relevance for raw data from the "active devices" inspector: http://bigfix.me/relevance/details/2998470
]]>Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/EMET
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/EMET
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>The applied group policies and enforced group policies properties show the name of the group policy object, at what level the policy is linked (Site, Domain, OU) and at what OU in active directory the policy is linked at.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This is meant to supliment the analysis "Hard Drive Audit - Universal" : http://bigfix.me/cdb/analysis/2994530
]]>]]>
The best way to determine if a battery needs replaced is to look at the following properties: "% battery life in capacity", "Battery Status", and "Battery Manufacture Date"
+In the case of Dell Systems, the best data will be returned if Dell Command | Monitor (also known as OMCI) is installed. See the fixlet available here to install Dell OMCI: http://bigfix.me/fixlet/details/3918
+There is a related analysis for Apple OS X systems available here: http://bigfix.me/analysis/details/2994537
++
References:
+http://dmtf.org/sites/default/files/standards/documents/DSP0134_2.8.0.pdf
+http://bigfix.me/relevance/details/2999628
+ +http://msdn.microsoft.com/en-us/library/aa394074%28v=vs.85%29.aspx
+ ++
]]>
From here: http://bigfix.me/cdb/analysis/49
]]>]]>
version query based on https://support.microsoft.com/de-at/help/4023262/how-to-verify-that-ms17-010-is-installed
]]>Use this Analysis to detect the file version of your Srv.sys, and determine whether it is up-to-date to protect against WannaCry vulnerability.
THIS CONTENT IS PROVIDED BY THE AUTHOR "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
]]>Use this Analysis to detect the file version of your Srv.sys, and determine whether it is up-to-date to protect against WannaCry vulnerability.
THIS CONTENT IS PROVIDED BY THE AUTHOR "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
]]>Use this Analysis to detect the file version of your Srv.sys, and determine whether it is up-to-date to protect against WannaCry vulnerability.
THIS CONTENT IS PROVIDED BY THE AUTHOR "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
]]>Use this Analysis to detect the file version of your Srv.sys, and determine whether it is up-to-date to protect against WannaCry vulnerability.
THIS CONTENT IS PROVIDED BY THE AUTHOR "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
]]>+
The latest version of this analysis can be found here: http://bigfix.me/analysis/details/2994623
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This analysis may not be accurate in all cases and may need some refinement for Win8 and the newest version of office.
]]>+
References:
+ +http://support.microsoft.com/kb/243215
+ +http://www.whitemiceconsulting.com/2011/10/changing-terminal-services-license-mode.html
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>You can take this data and manually create fixlets for each of these features.
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This analysis contains information about the Microsoft Windows operating system on BES Client computers. This is an expanded version of the analysis provided by IBM.
+Since this information does not change much and its evaluation can be resource intensive, most of these properties are only evaluated once per day.
+After activating this analysis, you will see the following properties:
+Note: Many of these properties access the Windows Management Interface (WMI) to obtain the hardware properties. The WMI is not usually available on Win9x and WinNT computers so some properties may report back "N/A" on those operating systems.
+Note: Some computers may have broken WMI libraries. Inconsistent results and undesired side effects may occur when the BES Client evaluates a WMI query. If you have known problems with WMI in your environment, do not activate this analysis.
+
metric <integer> of operating system
+http://support.bigfix.com/inspectors/System%20Objects_Win.html#operating%20system
+http://msdn.microsoft.com/en-us/library/windows/desktop/ms724385(v=vs.85).aspx
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Based upon this: http://bigfix.me/cdb/analysis/20
Pull back status on the PowerShell installation on this system.
]]>
+
Related:
+ ++
References:
+http://www.stigviewer.com/stig/windows_7/2014-04-02/finding/V-21963
+http://www.scaprepo.com/view.jsp?id=CCE-18881-3
+]]>
For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>If the "smbios" inspector works on other OSes other than Windows, then this analysis should work there too.
+This analysis can be found here: http://bigfix.me/analysis/details/2994573
]]>Note: Currently the Relevance for this Analysis pulls all endpoints with any windows OS. if you are going to target just a subset of devices change the Relevance to Computer groups (manual or Dynamic), By Active Directory OU, etc. to filter to the devices you want.
]]>Specifically providing information on the states of the following settings
+For general information or to report issues with C3 Remote Control content please visit GitHub here: https://github.com/strawgate/C3-Remote-Control
]]>For outgoing remote assistance requests: Who they were to, who made the request, and what time
+For incoming remote assistance requests: Who received it, and what time (not possible to tell who made the request)
+For general information or to report issues with C3 Remote Control content please visit GitHub here: https://github.com/strawgate/C3-Remote-Control
]]>For ALL incoming connections that are established the following is collected:
+For incoming connections where control is granted, the following is collected:
+For all sessions, the following is collected:
+For general information or to report issues with C3 Remote Control content please visit GitHub here: https://github.com/strawgate/C3-Remote-Control
]]>+
Remote Assistance is by default not enabled or installed on Windows Server Operating Systems
+For general information or to report issues with C3 Remote Control content please visit GitHub here: https://github.com/strawgate/C3-Remote-Control
]]>NOTE: Due to issues with how BigFix parses the event log: https://forum.bigfix.com/t/the-event-record-inspector-is-returning-an-error-for-the-description-of-the-event/17006 this will NOT return results for users resuming their RDP sessions. This will only return results for users starting brand new user sessions over RDP.
+For general information or to report issues with C3 Remote Control content please visit GitHub here: https://github.com/strawgate/C3-Remote-Control
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>NOTE: This is "BETA" code and is not fully tested or in full production. This is an attempt to gather helpful feedback on the status of SUA on the client.
+NOTE: This has only been tested on Windows, but should work on other OSes with minor adjustments.
+]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>To define a service as, "Monitored" for use by this fixlet:
+This action will then check those services to make sure they are running.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Services - Log On As - Windows - Provides the account that the service operates under. For the majority of services this will be a NT Authority\System
+Services - Log On As Domain Account - Windows - Provides the services on the system that are running as a domain account
+Services - Log On As Local Account - Windows - Provides the services on the system that are running as a local account on the system
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This analysis provides stability information for Windows devices.
+Kudos, compliments, and credit for the majority of this analysis to: jgstew
+The original analysis this is based off of is available here: https://bigfix.me/analysis/details/2994781
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>+
Latest version found here: http://bigfix.me/analysis/details/2994619
++
Related:
+http://bigfix.me/relevance/details/2157
+Found the Windows Error Reporting locations here: http://www.sevenforums.com/tutorials/4567-problem-reports-solutions-clear-history.html
+C:\Users\Default\AppData\Local\Microsoft\Windows\WER\ReportQueue
+C:\Users\<username>\AppData\Local\Microsoft\Windows\WER\ReportQueue
+C:\ProgramData\Microsoft\Windows\WER\ReportQueue
+]]>
Can run sfc using this task: http://bigfix.me/cdb/fixlet/1369
]]>Report on Windows TSM Statuses.
+Taken with thanks from JGStew at bigfix.me
+Learn more about this analysis online: http://bigfix.me/cdb/analysis/62
Customized slightly by Jason Walker, 2013-04-22; added TSM Client Acceptor to services list for relevance; fixed some issues with tabs and comments ("*") and trimming the results.
The latest version of this Analysis can be found here: http://bigfix.me/analysis/details/2994620
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>The WMI Analysis may also prove useful: WMI - Windows
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Credit, kudos, and thanks to jgstew: https://bigfix.me/relevance/details/3007539
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This Analysis also provides the following general information for users of the system:
+Note: OS Upgrades may reset last logon timestamp to the date of the upgrade.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Special thanks to Jason Walker for helping with the Windows VPN file parsing.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>The information in wmi root\dcim\sysman is part of a standard, so this analysis should work for more than just Dell systems as long as the non-Dell systems have similar functionality and reporting mechanisms installed.
++
References:
+ +https://support.bigfix.com/inspectors/WMI%20Objects_Any.html
+http://schemas.dmtf.org/wbem/cim-html/2/CIM_BIOSAttribute.html
+http://schemas.dmtf.org/wbem/cim-html/2/CIM_BIOSEnumeration.html
+]]>
Windows 8 and higher: Windows Defender
+Managed version: System Center Endpoint Protection, formerly ForeFront
+Windows Vista and Windows 7 also have something called "Windows Defender" which was much more limited than MSE. Windows 8 has both of these 'products' rolled into one name.
++
Latest Version of this Analysis can be found here: http://bigfix.me/analysis/details/2994633
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>
This analysis contains information about system requirements for upgrading computers from Windows 10 to Windows 11.
This analysis applies to Windows 10 systems only.
+System requirements:
+Important Note: Graphics Card Check requires a to evaluate. Please run this task on all of your Windows 10 devices.
+* We have observed in our testing that Windows 10 can be upgraded to 11 in virtual environments with WDDM 1.1 and 1.4 without any issues.
1. If the task "Deploy ComplianceWhitelist File" has not yet been run, the Status may show "No Compliance Whitelist on Endpoint"
2. The file ComplianceWhitelist.txt should be created on the BES Server prior to running the above task
3. If the names of the files in the "Deploy Compliance Whitelist File" task and the "Enforce Compliance" Fixlet have been changed, those changes should also be made in this analysis otherwise the analysis may show a status of "No Whitelist File on Endpoint"
+
+
Properties Description:
++
|
+ Status |
+
+ Unauthorized Admins |
+
+ Name/PWD Age of Admins |
+
+ Whitelist files Match |
|
+ Compliant: All users in the Administrators group are in the ComplianceWhitelist.txt file Not-Compliant: There are users in the local Administrators group that are NOT in the ComplianceWhitelist.txt file. |
+
+ If the status shows Not-Compliant this field will show which users are in the endpoint's local Administrators group that are NOT in the ComplianceWhitelist.txt file. |
+
+ Displays the members of local Administrators group as well as the age of the passwords for each of those users. This can be useful in determining if any admin-user is violating corporate password policy and creating a potential vulnerability. |
+
+ Compares the hash of the ComplianceWhitelist.txt file on that endpoint with the hash of the backup file created by the 'Deploy Whitelist' task. If there is a mismatch then it is likely someone has modified the primary Whitelist file to fool the policy |
+
|
+ Primary File hash |
+
+ Backup File hash |
+
+ Primary File Date |
+
+ Backup File Date |
|
+ The sha1 hash of the primary ‘whitelist’ file. A difference between this and the hash on other clients or this client’s backup file likely indicates that someone has made unauthorized changes to this file. |
+
+ The sha1 hash of the backup ‘whitelist’ file. If someone makes unauthorized changes to the primary whitelist file there will likely be a difference between the hashes of the primary and the backup files. |
+
+ The modification date of the primary whitelist file. If the file has a different date than the ‘official’ whitelist file, it will allow an operator to detect that the file on this computer may not be the same as the 'official' version. |
+The modification date of the backup whitelist file. If the file has a different date than the ‘official’ whitelist file or the primary whitelist file, it will allow an operator to detect that the file(s) on this computer may not be the same as the 'official' version. |
This should be able to retrieve power settings for Windows Vista and higher. It has been tested with Windows 7, Windows 2008, and Windows 2008 R2.
]]>]]>
When prompted you can provide an application full path or an URL:
+URL example
+++
Application example:
+++C:\Program Files\Notepad++\notepad++.exe
When prompted for the name you can enter any valid filename (Warn: no checks are done)
+Note: If you use the same name of an existing Public Desktop shortcut, it will be replaced. If you use the same name of a Private Desktop shortcut, two shortcuts will exist on User's desktop.
]]>This currently handles 2 different versions of the Cisco VPN client. Others could be added.
+This could also detect when there is an issue much earlier to trigger the KMS checkin.
]]>Please see the Community Solution Testing Statement
+This Task performs a filesystem scan on Windows systems to attempt detecting Apache Commons Text versions vulnerable to CVE-2022-42889.
++
This Task performs a filesystem search across all fixed disks on Windows platforms, to locate Apache Commons Text JAR files, either directly on the filesystem or embedded in a .WAR archive file. In the case any .WAR file is found on the system, the 'unzip.exe' utility is used to perform a listing of files inside the archive to locate Apache Commons Text-related .JAR files. Specifically, this Task searches for any versions of commons-text-1.10.0.jar.
+Scan results are stored in a "Scans" subdirectory beneath the "BES Client" folder. 'apache-commons-text.log' contains the full script output for potential debugging or diagnosis, and 'apache-commons-text.txt' contains a listing of detected files in one of the forms
+The first sample entry indicates a detected jar file directly in the filesystem, while the second entry indicates a detected .jar file embedded within a .WAR archive.
+This Task has several known limitations:
+This detection method uses Windows batch scripts with no external utility aside from 'unzip.exe'. Results of the scan may be retrieved using the related Analysis.
]]>The script was written for imaging, therefore the relevance is True. We are only working with Appx files in Windows 10, however, the rule collection types should be very similar. In this example, I only want the Administrator account to have access to Settings and block access for all other users. Since Applocker rules go based on User or Group SID, I am using powershell to pull the SID of the Administrator user that is then applied to the windows.immersivecontrolpanel.appx rule. All of the other rulles apply to everyone.
+The XML part of the script gets messed up when being displayed on Bigfix.me, therefore I have provided it below. If you download the .bes file it will be correct.
+<AppLockerPolicy Version="1">
<RuleCollection Type="Exe" EnforcementMode="NotConfigured" />
<RuleCollection Type="Msi" EnforcementMode="NotConfigured" />
<RuleCollection Type="Script" EnforcementMode="NotConfigured" />
<RuleCollection Type="Dll" EnforcementMode="NotConfigured" />
<RuleCollection Type="Appx" EnforcementMode="Enabled">
<FilePublisherRule Id="f9e7ee63-13da-4646-8f44-f8bed6c4e75e" Name="windows.immersivecontrolpanel, from Microsoft Corporation" Description="" UserOrGroupSid="{{0}" Action="Allow">
<Conditions>
<FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="windows.immersivecontrolpanel" BinaryName="*">
<BinaryVersionRange LowSection="*" HighSection="*" />
</FilePublisherCondition>
</Conditions>
</FilePublisherRule>
<FilePublisherRule Id="6e977e00-e0e1-4b26-a163-9ba2c251e5c5" Name="Microsoft.BioEnrollment, from Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
<Conditions>
<FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.BioEnrollment" BinaryName="*">
<BinaryVersionRange LowSection="*" HighSection="*" />
</FilePublisherCondition>
</Conditions>
</FilePublisherRule>
</RuleCollection>
</AppLockerPolicy>
]]>
bcdedit /set hypervisorlaunchtype auto
++
For user on 64bit systems
+EDIT: Please note that powershell is not required. instead you can use "waithidden" with the command to make this function. You however do still need to have the wow redirection for 64bit.
]]>The BigSpeak Audio Health Dashboard enables Text To Speech (TTS) to notify operators of the current health status of their Bigfix environment.
This example only provides part of the ‘BES Relay Health’ section of the ‘Deployment Health Checks’ dashboard, However you could build out the rest of the dashboard, or utilize this example in a whole different way.
The Checks that this example will report on are:
++
Every hour (by default), the native windows TTS engine will inform you as follows:
+"This is a Bigfix Audio Alert"
++
"The current Bigfix status for Number of Clients Per Relay is FAIL"
"The current Bigfix status for Relay Version is WARNING"
"The current Bigfix status for Relay Version is FAIL"
"The current Bigfix status for Relay Service Stopped is FAIL"
"The current Bigfix status for Download Folders is FAIL"
"The current Bigfix status for Relay Disk Space is FAIL"
There are two tasks which are needed:
++
Initial Setup:
+Note: This has only been tested on Windows 7.
++
+
Deploy: BigSpeak Audio Health Dashboard Scheduled Task Setup v1.0
++
Deploy: BigSpeak Audio Health Dashboard (This Task)
++
NOTE: This task will run as a policy. It will become relevant when the file ‘bread.crumb’ exist which is created by the scheduled taks every hour.
]]> << Enter the IEM Server Operator Name
<< Enter the IEM Server Operator Password
<< Enter the account name to run the scheduled task
<< Enter the account password to run the scheduled task
_____________________________________________________________________________________________________
BigSpeak Audio Health Dashboard
+The BigSpeak Audio Health Dashboard enables Text To Speech (TTS) to notify operators of the current health status of their Bigfix environment.
This example only provides part of the ‘BES Relay Health’ section of the ‘Deployment Health Checks’ dashboard, However you could build out the rest of the dashboard, or utilize this example in a whole different way.
The Checks that this example will report on are:
++
Every hour (by default), the native windows TTS engine will inform you as follows:
+"This is a Bigfix Audio Alert"
++
"The current Bigfix status for Number of Clients Per Relay is FAIL"
"The current Bigfix status for Relay Version is WARNING"
"The current Bigfix status for Relay Version is FAIL"
"The current Bigfix status for Relay Service Stopped is FAIL"
"The current Bigfix status for Download Folders is FAIL"
"The current Bigfix status for Relay Disk Space is FAIL"
There are two tasks which are needed:
++
Initial Setup:
+Note: This has only been tested on Windows 7.
++
+
Deploy: BigSpeak Audio Health Dashboard Scheduled Task Setup v1.0
++
Deploy: BigSpeak Audio Health Dashboard
++
<< Enter the IEM Server Operator Name
<< Enter the IEM Server Operator Password
<< Enter the account name to run the scheduled task
<< Enter the account password to run the scheduled task
_____________________________________________________________________________________________________
BigTweet
+This requires two tasks. 1)BigTweet Scheduled Task Setup v2.1 & 2)BigTweet v2.1
+BigTweet allows you to interface with Twitter and their free highly scalable SMS system for notifications.
+This example will use a BigFix Rest API Query within a scheduled task to report on the number of fixlets that are relevant in a specific site. If relevant fixlets are found, it will send a tweet (using twt) which will notify you via text messaging.
+Setup:
++
Note: By Default, this is scheduled to run once every hour.
]]>This requires two tasks. 1)BigTweet Scheduled Task Setup v2.1 & 2)BigTweet v2.1
+BigTweet allows you to interface with Twitter and their free highly scalable SMS system for notifications.
+This example will use a BigFix Rest API Query within a scheduled task to report on the number of fixlets that are relevant in a specific site. If relevant fixlets are found, it will send a tweet (using twt) which will notify you via text messaging.
+Setup:
++
Note: By Default, the is scheduled to run once every hour.
]]>]]>
This task enforces a winodws firewall filter to disable Regsvr32 from connecting to remote locations.
Note: The task is released in https://bigfix.me/, which is not an official release channel of IBM BigFix. We highly suggest testing the content before deploying to production. Use of the content is done at the user's own risk and the user will be solely responsible for any damage to any computer system or loss of data that results from use of the content.
Warning: This fixlet will enable the windows firewall and add necessary rule to block outbound connection for Regsvr32.exe
Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to "true" or by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Java 8u121 (see https://www.oracle.com/java/technologies/javase/8u121-relnotes.html) protects against remote code execution by defaulting "com.sun.jndi.rmi.object.trustURLCodebase" and "com.sun.jndi.cosnaming.object.trustURLCodebase" to "false".
+While it is very much advised to update all affected applications to make use of the corrected Log4j 2.15.0 or higher; or update the individual application to configure log4j2.formatMsgNoLookups=true, there is at least some measure of attack surface reduction that can be performed system-wide by applying the value to the JAVA_TOOL_OPTIONS environment variable.
+This method is limited, as any Java application may override the JAVA_TOOL_OPTIONS environment as part of its startup, but this Fixlet may provide some measure of improvement. Additionaly these may only be effective with specific versions of Java or Log4j.
+Guidance on these values is taken from
+This Fixlet applies the following Envrionment Variable values on Windows:
++ ++ +
++ +
+++
Important Notes
+This fixlet is based on the following post on bigfix.me:
https://bigfix.me/fixlet/details/3670
+ ++ +
++ +
++
Important Notes
++ ++ +
++ +
++
Important Notes
+This appears to be caused by large Component-Based Servicing logs. These are stored at C:\Windows\Logs\CBS. The current log file is named "cbs.log". When "cbs.log" reaches a certain size, a cleanup process renames the log to "CbsPersist_YYYYMMDDHHMMSS.log" and then attempts to compress it into a .cab file.
However, when the cbs.log reaches a size of 2 GB before that cleanup process compresses it, the file is to large to be handled by the makecab.exe utility. The log file is renamed to CbsPersist_date_time.log, but when the makecab process attempts to compress it the process fails (but only after consuming some 100 MB under \Windows\Temp). After this, the cleanup process runs repeatedly (approx every 20 minutes in my experience). The process fails every time, and also consumes a new ~ 100 MB in \Windows\Temp before dying. This is repeated until the system runs out of drive space.
++
This Action will remove the log files that are too large to be handled by makecab.exe. Any \Windows\Logs\CBS\CbsPersist_XXX.log file larger than 1,000 MB is removed, as well as any cab_ files from C:\Windows\Temp.
]]>This appears to be caused by large Component-Based Servicing logs. These are stored at C:\Windows\Logs\CBS. The current log file is named "cbs.log". When "cbs.log" reaches a certain size, a cleanup process renames the log to "CbsPersist_YYYYMMDDHHMMSS.log" and then attempts to compress it into a .cab file.
However, when the cbs.log reaches a size of 2 GB before that cleanup process compresses it, the file is to large to be handled by the makecab.exe utility. The log file is renamed to CbsPersist_date_time.log, but when the makecab process attempts to compress it the process fails (but only after consuming some 100 MB under \Windows\Temp). After this, the cleanup process runs repeatedly (approx every 20 minutes in my experience). The process fails every time, and also consumes a new ~ 100 MB in \Windows\Temp before dying. This is repeated until the system runs out of drive space.
++
This Action will remove the log files that are too large to be handled by makecab.exe. Any \Windows\Logs\CBS\CbsPersist_XXX.log file larger than 1,000 MB is removed, as well as any cab_ files from C:\Windows\Temp.
]]>Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>AppX - Audit
+Executables - Audit
+Installers - Audit
+Scripts - Audit
+This will only take effect if the current enforcement mode is undefined. Once an enforcement mode is defined it's not advisable to try to change it without first reseting the Applocker configuration.
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>AppX - Enforced
+Executables - Enforced
+Installers - Enforced
+Scripts - Enforced
+This will only take effect if the current enforcement mode is undefined. Once an enforcement mode is defined it's not advisable to try to change it without first reseting the Applocker configuration.
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Executables
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Scripts
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Executables
+Installers
+Scripts
+AppX
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Installers
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Executables
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Scripts
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>AppX
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Executables
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Installers
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Configure Autologon!
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
AppX - Audit
+Executables - Audit
+Installers - Audit
+Scripts - Audit
+This will only take effect if the current enforcement mode is undefined. Once an enforcement mode is defined it's not advisable to try to change it without first reseting the Applocker configuration.
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>AppX - Enforced
+Executables - Enforced
+Installers - Enforced
+Scripts - Enforced
+This will only take effect if the current enforcement mode is undefined. Once an enforcement mode is defined it's not advisable to try to change it without first reseting the Applocker configuration.
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Executables
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Scripts
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Installers
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Executables
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Scripts
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>
The rule self describes as: Allow Everyone to run Scripts in the Program Files Directory
Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>
The rule self describes as: Allow Everyone to run Scripts in the Windows Directory except Temp.
Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>The rule self describes as: Allow Everyone to run Scripts in their profiles except for AppData
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>AppX
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Executables
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Installers
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Note: This Fixlet should be thoroughly tested in your environment before using as it edits the Windows Bootloader to disable credential guard. For this reason, this fixlet has NO DEFAULT ACTION.
+For more information on Credential Guard please see: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard
]]>Credential Guard requires the following:
+The following features are recommended for Credential Guard:
+Before you can enable Credential Guard you must activate Virtualization Based Security using Secure Boot or Secure Boot and DMA. To do this please use:
+++Fixlet: Config - Virtualization Based Security - Using Secure Boot - Windows
+Fixlet: Config - Virtualization Based Security - Using Secure Boot and DMA - Windows
You also must enable Hyper-V and Isolated User Mode. To do this please use:
+++Fixlet: Config - Isolated User Mode - Enable - Windows
+Fixlet: Config - Hyper-V Platform - Enable - Windows
For more information on Credential Guard please see: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard
]]>It takes into account the following items:
+Actioning this Fixlet against a vulnerable device will disable SMBv3 Compression.
+NOTE: This will only protect a SMBv3 Server and will not protect a SMBv3 Client. This remediation prevents the "Wormable" part of CVE-2020-0796.
+This remediation is made available with no warranty expressed or otherwise and should be tested before being applied to any production or otherwise important systems.
]]>login.live.com
login.microsoftonline.com
login.skype.com
login.yahoo.com
secure.skype.com
twitter.com
facebook.com
For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Exploit Action:
Kill program on exploit detection
Advanced Settings:
Enable DeepHook, AntiDetours, and BannedFunction settings
Reporting:
Report Telemetry
Show Tray Icon
Log to Event log
Mitigations:
Application Opt In to DEP
Application Opt In to SEHOP
Application Opt In to ASLR
Enable Certificate Pinning
Audit Untrusted Font Detection
For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Specifically it configures EMET to detect exploits for the following applications:
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Specifically it configures EMET to detect exploits for the following applications:
+This Fixlet in particular excludes ALL EAF configurations.
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Specifically it configures EMET to detect exploits for the following applications:
+Please note, EAF+ has been disabled for Google Chrome due to issues with the latest versions of Chrome and Windows 10.
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Specifically it configures EMET to detect exploits for the following applications:
+This Fixlet in particular excludes ALL EAF configurations.
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Remote Control content please visit GitHub here: https://github.com/strawgate/C3-Remote-Control
]]>For general information or to report issues with C3 Power Management content please visit GitHub here: https://github.com/strawgate/C3-Power-Management
]]>For general information or to report issues with C3 Power Management content please visit GitHub here: https://github.com/strawgate/C3-Power-Management
]]>Specifically, this fixlet configures it to monitor the following Processes:
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Credential Guard requires the following:
+For more information on Credential Guard please see: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/remote-credential-guard
]]>Kudos, Compliments, and Thanks to @jgstew for providing the source content for this fixlet: https://bigfix.me/fixlet/details/21368
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>]]>
+
References:
+http://technet.microsoft.com/en-us/library/cc962417.aspx
+]]>
+
References:
+http://technet.microsoft.com/en-us/library/cc962417.aspx
+]]>
+
References:
+http://msdn.microsoft.com/en-us/library/ms940877(v=winembedded.5).aspx
+]]>
This task allows you to configure a policy for your environment.
]]>This task allows you to configure a policy for your environment.
]]>OOB this task configures both "ibm.com" and "red.com" as my list. If you want to configure your own list, do the following:
+1. Using a test box, configure your compatibility list exactly the way you want it to be on your endpoints.
2. Export the following registry key: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\BrowserEmulation\ClearableListData
3. Copy/Past that reg file into the actionscript of this task.
4. Modify the overall relevance #2 with your list. It's easy to do if you've gotten this far.
Save and launch against your target endpoints.
+Remember this configures the currently logged in user. So if you have endpoints with multiple users, this task may run more than once as each user logs in.
]]>For Windows: These keys are located in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
+For Non-Windows: These will be stored within Client Settings.
]]>NOTE: This is Relevant if the current state of "Remote Desktop" is disabled; but the fixlet only changes the local configuration. If the firewall rule set is controlled through Group Policy, this fixlet does not override.
]]>NOTE: This is Relevant if the current state of "Remote Desktop" is disabled; but the fixlet only changes the local configuration. If the firewall rule set is controlled through Group Policy, this fixlet does not override.
]]>Prompts for:
+]]>
But 3024777 itself fails to install in many instances.
+This Fixlet is to manually uninstall KB3004394 so 3024777 stops appearing Relevant.
]]>This action will prompt you for the domain and username you would like to add to the local administrators group. This prompt occurs before you select the computers you will target with the action.
+Please enter this in the following format without quotes: DOMAIN\admin_username
+Example: TESTDOMAIN\admin_abc123
+Note: Check your spelling! Take care to apply to the computer you mean to!
+This task should report completed once the username can be found in the administrators group.
]]>This Fixlet configures ActiveSetup to disable SSLv3 in Internet Explorer, to mitigate the "POODLE" vulnerability. As an ActiveSetup component, this runs one time for each user at their next logon time.
+The ActiveSetup script edits HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols.
]]>This will generate a DISM.txt file in the client path. This file will contain the Enabled/Disabled state of all the available features.
+This will also enable many of the feature on/off tasks that are included in this custom site.
+This task also generates a diffDISM.txt file in the client path. This file lists a difference between the features available and the "missing" fixlets in the site. IE: We can't cover every single feature the instant it comes out. This results file is pulled into an analysis so new fixlets can be created (manually) for features we don't already have fixlets for.
+Source: http://bigfix.me/features/
]]>This fixlet will delete an Identity Finder (IDF) temp file if there is one that is over 2GB in size. This is to address a specific issue that was experienced with Identity Finder that most likely no longer applies. This will not be relevant on most computers and only be relevant if there is at least one IDF temp file over 2GB in size located in the user's temp folder for IDF. This fixlet does not clear out all Identity Finder temp files.
]]>Users without Admin rights cannot delete these shortcuts, and they cannot actually uninstall most programs either. Programs can be uninstalled through the "Add/Remove Programs" UI instead of using these shortcuts.
+To see what this task will delete, see the property "All Users Start Menu "Uninstall" shortcuts" in the analysis "All Users - Files & Shortcuts - Desktop & Start Menu - Windows"
+]]>
Requires .Net 4.5
]]>+
This Task will make each of the targeted computers a "ALWAYS On Profile" computer.
+Configure a computer's power profile to never enter the system Standby, Hibernate, or hard-disk power management modes actions that would turn the computer off.
To support WannaCry2.0 SMB workaround if you cannot apply MS17-010 patch.
+ +Recommended you apply MS17-010 using the published Fixlets.
]]>Recommended you apply MS17-010 using the published Fixlets.
]]>Recommended you apply MS17-010 using the published Fixlets.
| Use this Fixlet to disable solution to CVE-2017-8529. |
Network adapters can be configured to wake a computer from standby if they receive a Wake-on-LAN Magic Packet.
This Fixlet will disable the ability for network adapters to wake the computer from standby.
Note: This does not affect a computers ability to Wake-on-LAN from the powered off or Hibernate power state.
Note: This Task is not applicable on computers designated as Last Man Standing.
Repartitioning will probably fail on dynamic and dynamic disks, but should work on both GPT and MBR.
+If you change the drive name (line 22) or drive letter (line 23), please also update the relevance to match.
]]>To support WannaCry2.0 SMB workaround if you cannot apply MS17-010 patch.
+ +Recommended you apply MS17-010 using the published Fixlets.
]]>Recommended you apply MS17-010 using the published Fixlets.
]]>Recommended you apply MS17-010 using the published Fixlets.
| Use this Fixlet to enable solution to CVE-2017-8529. |
http://technet.microsoft.com/en-us/library/cc785435(v=ws.10).aspx]]>
Please be sure to set "Users" tab to "Run when at least one of the selected users is logged on, and only display the user interface to those users" and "Local users"
+Windows Lifecycle Fact Sheet: https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet, Some additional server dates excluding 2016: https://support.microsoft.com/en-us/lifecycle/search/1163
+Google Docs: Reference and Relevance Worksheet
+Windows 2000, XP, Vista - All support has ended
+Windows Server 2008 - Standard is EOS, SP2 and R2 SP1 extended support ends Tue January 14 2020
+Windows 7 - Mainstream support ended, service pack 1 extended support ends Tue January 14 2020
+Windows 8 - Mainstream support ended, 8.1 requires Update 1 (KB2919355) for support, 8.1 Update 1 extended support ends Tue January 10 2023
+Windows 10 - Mainstream (1507, 1511) support ended. 1607 end of support on Tue April 10 2018. 1703 end of support on Tue Oct 9 2018. 1709 end of support on Tue April 9 2019.
+NOTE: value "ReleaseID" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" of native registry may be a better way of retrieving OS version numbers. Revised to this method. LTSB completely excluded at this time. Enterprise and Educational is included with their 6 month extensions set to the 6 month later Patch Tuesday.
]]>+
Action 1:
Compares users who are Members of the local Administrators group on a computer with a "Compliant Admins" Whitelist file that exists on the client. It then instructs the endpoint to remove any users that are NOT on the Compliance White List from the Local Administrators group.
Action 2:
Prompts for a User ID that is then removed from the local "Administrators" group of the target endpoint.
+
Note:
1. Before running this task you must create the file "ComplianceWhitelist.txt" on the BES Server in the following directory: "<BES Server>\wwwrootbes\CustomDownloads\ComplianceWhitelist"
2. The Task "Deploy ComplianceWhitelist File" must be run before this Fixlet will work properly.
This script contains two actions that can be used to fix WMI errors on Windows systems.
WMI Simple should be the first one used as it does not impact the system that much and seems to fix most issues.
WMI Advanced should only be used if the WMI Simple does not fix the issue. This will require a reboot
Both wmi_simple and wmi_advanced were provided from a source at Microsoft, but I am unable to find that source.
The purpose is to provide a means of inspecting the Local Group Policy configuration in other Fixlets/Tasks. Originally we had a large number of Fixlets reading values from Registry.pol files directly; but the Relevance for doing so was complex, resource-intensive, and prone to causing issues due to file locking of the Registry.pol files.
+This Task will search for both Computer, User, and MLGPO instances of Registry.pol, export them to text files via Microsoft's "LGPO.exe" utility, and import the results into the Registry under a number of keys. Currently these are exported to HKLM\Software\BES_LGPO with subkeys for "Machine", "User", and (potentially) for each MLGPO-defined policy.
+MLGPO reference: https://technet.microsoft.com/en-us/library/cc766291%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396
+This Fixlet adds data at HKLM\Software\BES_LGPO subkeys:
+Beneath each of these Keys are a number of Values. The Value Name corresponds to the registy key & value that the LGPO configures; and the Value Data corresponds to the Data Type and Value that the LGPO applies. Example
+[HKEY_LOCAL_MACHINE\SOFTWARE\BES_LGPO\User]
+Software\Policies\Microsoft\Windows\Control Panel\Desktop\ScreenSaveActive
+REG_SZ:"SZ:1"
++
This Task should be run as a repeating Policy to ensure the registry values are updated periodically. The registry values output will be used by a number of Security Policy fixlets. This should also be added as a task in any Baseline that changes Local Group Policy settings, to ensure the new values are captured after the settings are applied.
+v1.1: Updated to handle XP/2003 using ImportRegPol.exe rather than LGPO.exe
]]>To support WannaCry2.0 SMB workaround if you cannot apply MS17-010 patch.
+ +Recommended you apply MS17-010 using the published Fixlets.
]]>To support WannaCry2.0 SMB workaround if you cannot apply MS17-010 patch.
+ +Recommended you apply MS17-010 using the published Fixlets.
]]>To support WannaCry2.0 SMB workaround if you cannot apply MS17-010 patch.
+ +Recommended you apply MS17-010 using the published Fixlets.
]]>To support WannaCry2.0 SMB workaround if you cannot apply MS17-010 patch.
+ +Recommended you apply MS17-010 using the published Fixlets.
]]>]]>
]]>
For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This fixlet by itself does not remove their administartive rights when the expiration time passes. Removing their access requires the, "Invoke - Remove Expired Users from Temporary Administrators - Windows" fixlet to be run as a policy action.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Applicability Note: This Fixlet will only be relevant if the currently logged on user is not a part of the Administrators group. This Fixlet will not be relevant if the currently logged on user is a part of a group that is part of the Administrators Group. This Fixlet will not be relevant if there are no logged on users or if there is more than one logged on user.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Applicability Note: This Fixlet will not be relevant if the currently logged on user is a part of the Remote Desktop Users group or the Administrators Group. This Fixlet will not be relevant if the currently logged on user is a part of a group that is part of the Administrators Group or the Remote Desktop Users group. This Fixlet will not be relevant if there are no logged on users or if there is more than one logged on user.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This fixlet by itself does not remove their administartive rights when the expiration time passes. Removing their access requires the, "Invoke - Remove Expired Users from Temporary Administrators - Windows" fixlet to be run as a policy action.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Application Usage content please visit GitHub here: https://github.com/strawgate/C3-Application-Usage
]]>Fixlets are placed in the BES Client Directory under __BESData\__Global\ApplockerGeneratedRules
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Creates a Volume-Status.txt file in __BESData.
+Example
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Bitlocker
]]>The recovery password generated by action 1 is available via the Analysis: Bitlocker - Recovery Password - Windows
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Bitlocker
]]>If you choose to encrypt using the TPM and a random recovery password you should enable Analysis: Bitlocker - Recovery Password - Windows
+The following Exit Codes can be returned:
+10 - Encryption was Terminated for some reason
+20 - Encryption was Terminated due to a bootable CD/DVD in the system
+30 - Encryption was Terminated due to a lack of a numerical password on the system
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Bitlocker
]]>Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Bitlocker
]]>Creates a Volume-RecoveryPwd.txt file in __BESData. If there is already a file it checks to see if the recovery key has changed. If it has changed it archives the old one and writes the new recovery key to disk
+Example
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Bitlocker
]]>This should be performed immediately after any TPM/Recovery issues on an endpoint.
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Bitlocker
]]>Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Bitlocker
]]>Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Bitlocker
]]>This fixlet will always be relevant on a Windows system.
+Information on using this content is available here: https://github.com/strawgate/C3-Inventory/wiki/Certificate-Store
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>DelProf2 is free for Non-Profit and Higher Education. For instructions on licensing it for private organizations please visit their homepage: https://helgeklein.com/free-tools/delprof2-user-profile-deletion-tool/
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>DelProf2 is free for Non-Profit and Higher Education. For instructions on licensing it for private organizations please visit their homepage: https://helgeklein.com/free-tools/delprof2-user-profile-deletion-tool/
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>DelProf2 is free for Non-Profit and Higher Education. For instructions on licensing it for private organizations please visit their homepage: https://helgeklein.com/free-tools/delprof2-user-profile-deletion-tool/
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This fixlet by itself does not remove their administartive rights when the expiration time passes. Removing their access requires the, "Invoke - Remove Expired Users from Temporary Administrators - Windows" fixlet to be run as a policy action.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This fixlet by itself does not remove their administartive rights when the expiration time passes. Removing their access requires the, "Invoke - Remove Expired Users from Temporary Administrators - Windows" fixlet to be run as a policy action.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This fixlet has generic relevance and should not be set to re-apply without a delay.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Application Usage content please visit GitHub here: https://github.com/strawgate/C3-Application-Usage
]]>For general information or to report issues with C3 Application Usage content please visit GitHub here: https://github.com/strawgate/C3-Application-Usage
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>NOTE: Performing a group policy refresh may cause a explorer to flash during a user session and it may drop a connected user's remote desktop session.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Securely Domain Join a Windows Computer!
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
Reseting the Kernel kext can often reduce the boot time of a Mac device but should only be done as a troubleshooting measure. The first reboot after reseting the kernel kext may take a little while longer.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Your system WILL NOT BOOT after running this fixlet unless you use a related Vendor-Specific command to switch the machine to boot using UEFI.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Your system WILL NOT BOOT after running this fixlet unless you use a related Vendor-Specific command to switch the machine to boot using UEFI.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Power Management content please visit GitHub here: https://github.com/strawgate/C3-Power-Management
]]>For general information or to report issues with C3 Power Management content please visit GitHub here: https://github.com/strawgate/C3-Power-Management
]]>For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Applicability Note: This Fixlet will be relevant only if the currently logged on user is explicitly a member of the Administrators group. This Fixlet will not be relevant if there are no logged on users or if there is more than one logged on user.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Applicability Note: This Fixlet will be relevant if the currently logged on user is explicitely a member of the Remote Desktop Users group. This Fixlet will not be relevant if there are no logged on users or if there is more than one logged on user.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>NOTE: Setting this fixlet to reapply will cause it to constantly reset the WMI repository. Apply once and DO NOT reapply.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>The script used by this fixlet stops short of extracting the password hash and ONLY extracts the user name associated with the cached credential.
+This script is paired with the Analysis: Credentials - Cached Login Creds - Windows
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Windows-Credentials
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>For more information on the Windows Update Troubleshooter see:
+ +For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>+++
+ +
+ ++ + + ++ + ++ + +
Important Notes
+| When you run an application that requires date interpretation and that uses the new APIs on a computer that is running Windows 7 or Windows Server 2008 R2, the following issues may occur: +
Note: Affected computers may report back as 'Pending Restart' once the update has run successfully, but will not report back their final status until the computer has been restarted. |
This fixlet uses Local Group Policy to set per-user registry entries. These entries disable RTF processing in MS Word. See the MS KB2953095.
+NOTE: This may report back as "failed" but actually succeed due to difficulties with writing relevance to detect the local GPO change.
+The changes are made the binary file located here: C:\Windows\System32\GroupPolicy\User\Registry.pol
+]]>
Version 8.1.634.0 of Tivoli Endpoint Manager is now available!
The latest version of Tivoli Endpoint Manager provides several enhancements and fixes. Click on the link below for more information on changes in Tivoli Endpoint Manager 8.1.
Windows Installer 3.1 or greater must be installed to perform this upgrade. Use the action below to install Windows Installer 3.1. Once this is complete, you can use to upgrade Tivoli Endpoint Manager Servers and Consoles to version 8.1.634.0.
Note: Affected computers may report back as 'Pending Restart' once the patch has run successfully, but the vulnerability will not be closed until the affected computer is restarted.
If you have any issues during the upgrade, you may want to review the manual upgrade instructions below to help resolve the issues.
Version 8.1.634.0 of Trend Micro Endpoint Security Platform is now available!
The latest version of Trend Micro Endpoint Security Platform provides several enhancements and fixes. Click on the link below for more information on changes in Trend Micro Endpoint Security Platform 8.1.
Windows Installer 3.1 or greater must be installed to perform this upgrade. Use the action below to install Windows Installer 3.1. Once this is complete, you can use to upgrade Trend Micro Endpoint Security Platform Servers and Consoles to version 8.1.634.0.
Note: Affected computers may report back as 'Pending Restart' once the patch has run successfully, but the vulnerability will not be closed until the affected computer is restarted.
If you have any issues during the upgrade, you may want to review the manual upgrade instructions below to help resolve the issues.
LGPO can configure Registry policies, apply Secedit templates, and configure Advanced Audit Policies. Existing policy settings can be exported or imported from text.
+This example fixlet demonstrates the use of LGPO by configuring the Security Event Log maximum size to 80 MB.
+The LGPO zip file includes a PDF explaining its use.
]]>This is considered a brute force search since it recursively looks at every file.
+Be careful to try and be specific with which folder to start your search. If you start at the "c:\" folder, the scan is likely to take a very long time... and this task waits for that search to complete... thus your client will be stalled until this search is finished.
+The results file is saved in the "parent folder of the client" and named "OfflineFiles.csv".
]]>NOTE: detection for logged in user.
+Vendor KB on locky - here
+Blog on Locky - here.
+ Ransomware called Locky spreads via a malicious macro in a Word document. The malware demands a ransom of half a Bitcoin for the key to unlock the encrypted files. Locky has infected machines in Europe, Russia, Pakistan, Mali, and the US.
-http://www.theregister.co.uk/2016/02/17/locky_ransomware/
-http://www.computerworld.com/article/3033941/security/locky-ransomware-which-inf
ects-like-dridex-hits-the-unlucky.html
-http://arstechnica.com/security/2016/02/locky-crypto-ransomware-rides-in-on-mali
cious-word-document-macro/
-http://www.darkreading.com/vulnerabilities---threats/advanced-threats/here-comes
-locky-a-brand-new-ransomware-threat/d/d-id/1324371?
note: this fixlet is not tested against locky or variants. mileage may vary.
]]>This will create a file (c:\wannacry_files.txt) for the search results. There is a corresponding property (Wanna Cry Files - C: Drive) that will parse this file for any files that are found and report the results back up.
+This file is expected to have the following two lines. Anymore than that is bad.
+ Volume in drive C has no label.
Volume Serial Number is 7A01-AEAF
There are three expected results returned by the property:
+Wanna Cry Encrypted files found (this is bad)
+No Encrypted Files Found (results file exists, nothing bad found, scan could still be running though)
+Scan Results File Not Found (this means you have not executed this task yet)
+]]>
]]>
]]>
By default, systems on standby that are woken by a Wake-on-LAN or Wake-from-Standby event will go back to sleep in two minutes if the system does not receive any user input. This may cause a condition called "PC Narcolepsy" where the computer will fall back asleep before tasks can be run on that system.
Use this Fixlet to configure the amount of time the system will stay awake after recieving a Wake-on-LAN or Wake-from-Standby event on Windows Vista and Windows 7 systems. This setting is called the "System Unattended Sleep Timeout".
Note: This task only changes the System Unattended Sleep Timeout setting on the current power profile. If the power profile is changed, this task may need to be reapplied.
By default, systems on standby that are woken by a Wake-on-LAN or Wake-from-Standby event will go back to sleep in two minutes if the system does not receive any user input. This may cause a condition called "PC Narcolepsy" where the computer will fall back asleep before tasks can be run on that system.
+Use this Fixlet to configure the amount of time the system will stay awake after recieving a Wake-on-LAN or Wake-from-Standby event on Windows Vista, 7 and 8 systems. This setting is called the "System Unattended Sleep Timeout".
+Note: This task only changes the System Unattended Sleep Timeout setting on the current power profile. If the power profile is changed, this task may need to be reapplied.
By default this fixlet will remain open, reapply when relevant, and prompt the user to restart 4 hours after the action has finished.
]]>+
After removing Last Man Standing settings, selected computers will no longer be excluded from Power Management tasks, however they will still be configured to never enter standby, and to function as a Wake on LAN forwarders.
Note: It will set the Power Scheme to Balanced Power Schecme if the active power scheme is "Last Man Standing"
]]>The task will only be relevant to activated Windows workstations. It will evaluate as successful after it becomes no longer relevant.
]]>WMIC computersystem where caption='currentname' rename newname+
Example: If the current computer name is XP-PC, to change it to Windows7-PC, we can run the below command.
wmic computersystem where caption='xp-pc' rename windows7-pc+
After running the command, you need to reboot the computer to make the changes effective.
+This command works on XP, Vista, Windows 7 and also on Server 2003 and Server 2008 editions.
]]>Use this Fixlet to revoke the eDellRoot Certificate.
THIS CONTENT IS PROVIDED BY THE AUTHOR "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
]]>This task is to prevent the MS11-021 patch bug from causing Microsoft Excel to open slowly and or crash as defind in the following article:
+The Office File Validation Add-In for Office 2003 and Office 2007 has appeared on Microsoft
+Update (
KB2501584) as an important update. However, it has a negative effect when opening large +.XLS files from network shares using Excel 2003. Some large files that have opened in seconds
+before the add-in is installed now take ten minutes afterwards. The same file copied to the
+local drive will open in seconds again. This is admitted in KB2501584 under known issues: "Opening files from a
+network share that have many charts or points of data will take longer to open in Office
+2003".
+Please see Microsoft Support article http://support.microsoft.com/kb/2570623 for more information.
]]>This task requires a reboot upon completion. This task has been tested in 32 bit Windows 7.
]]>+
References:
+https://technet.microsoft.com/library/security/2871997
+http://support.microsoft.com/kb/262841
+]]>
+
References:
+http://bigfix.me/fixlet/details/633
+]]>
15 bad attempts in 10 minutes triggers 10 minute lockout.
]]>*** Files need to be the same picture, just different names ***
]]>Works utilizing one of two methods:
By making these names all match computers should appear in SEP and Secunia using their Sharing Name.
+Note: The script will replace any spaces in the Sharing Name with hyphens!
]]>+
| (UTC-12:00) International Date Line West | +Dateline Standard Time |
| (UTC-11:00) Coordinated Universal Time-11 | +UTC-11 |
| (UTC-11:00) Samoa | +Samoa Standard Time |
| (UTC-10:00) Hawaii | +Hawaiian Standard Time |
| (UTC-09:00) Alaska | +Alaskan Standard Time |
| (UTC-08:00) Baja California | +Pacific Standard Time (Mexico) |
| (UTC-08:00) Pacific Time (US & Canada) | +Pacific Standard Time |
| (UTC-07:00) Arizona | +US Mountain Standard Time |
| (UTC-07:00) Chihuahua, La Paz, Mazatlan | +Mountain Standard Time (Mexico) |
| (UTC-07:00) Mountain Time (US & Canada) | +Mountain Standard Time |
| (UTC-06:00) Central America | +Central America Standard Time |
| (UTC-06:00) Central Time (US & Canada) | +Central Standard Time |
| (UTC-06:00) Guadalajara, Mexico City, Monterrey | +Central Standard Time (Mexico) |
| (UTC-06:00) Saskatchewan | +Canada Central Standard Time |
| (UTC-05:00) Bogota, Lima, Quito | +SA Pacific Standard Time |
| (UTC-05:00) Eastern Time (US & Canada) | +Eastern Standard Time |
| (UTC-05:00) Indiana (East) | +US Eastern Standard Time |
| (UTC-04:30) Caracas | +Venezuela Standard Time |
| (UTC-04:00) Asuncion | +Paraguay Standard Time |
| (UTC-04:00) Atlantic Time (Canada) | +Atlantic Standard Time |
| (UTC-04:00) Cuiaba | +Central Brazilian Standard Time |
| (UTC-04:00) Georgetown, La Paz, Manaus, San Juan | +SA Western Standard Time |
| (UTC-04:00) Santiago | +Pacific SA Standard Time |
| (UTC-03:30) Newfoundland | +Newfoundland Standard Time |
| (UTC-03:00) Brasilia | +E. South America Standard Time |
| (UTC-03:00) Buenos Aires | +Argentina Standard Time |
| (UTC-03:00) Cayenne, Fortaleza | +SA Eastern Standard Time |
| (UTC-03:00) Greenland | +Greenland Standard Time |
| (UTC-03:00) Montevideo | +Montevideo Standard Time |
| (UTC-02:00) Coordinated Universal Time-02 | +UTC-02 |
| (UTC-02:00) Mid-Atlantic | +Mid-Atlantic Standard Time |
| (UTC-01:00) Azores | +Azores Standard Time |
| (UTC-01:00) Cape Verde Is. | +Cape Verde Standard Time |
| (UTC) Casablanca | +Morocco Standard Time |
| (UTC) Coordinated Universal Time | +UTC |
| (UTC) Dublin, Edinburgh, Lisbon, London | +GMT Standard Time |
| (UTC) Monrovia, Reykjavik | +Greenwich Standard Time |
| (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna | +W. Europe Standard Time |
| (UTC+01:00) Belgrade, Bratislava, Budapest, Ljubljana, Prague | +Central Europe Standard Time |
| (UTC+01:00) Brussels, Copenhagen, Madrid, Paris | +Romance Standard Time |
| (UTC+01:00) Sarajevo, Skopje, Warsaw, Zagreb | +Central European Standard Time |
| (UTC+01:00) West Central Africa | +W. Central Africa Standard Time |
| (UTC+01:00) Windhoek | +Namibia Standard Time |
| (UTC+02:00) Amman | +Jordan Standard Time |
| (UTC+02:00) Athens, Bucharest, Istanbul | +GTB Standard Time |
| (UTC+02:00) Beirut | +Middle East Standard Time |
| (UTC+02:00) Cairo | +Egypt Standard Time |
| (UTC+02:00) Damascus | +Syria Standard Time |
| (UTC+02:00) Harare, Pretoria | +South Africa Standard Time |
| (UTC+02:00) Helsinki, Kyiv, Riga, Sofia, Tallinn, Vilnius | +FLE Standard Time |
| (UTC+02:00) Jerusalem | +Israel Standard Time |
| (UTC+02:00) Minsk | +E. Europe Standard Time |
| (UTC+03:00) Baghdad | +Arabic Standard Time |
| (UTC+03:00) Kuwait, Riyadh | +Arab Standard Time |
| (UTC+03:00) Moscow, St. Petersburg, Volgograd | +Russian Standard Time |
| (UTC+03:00) Nairobi | +E. Africa Standard Time |
| (UTC+03:30) Tehran | +Iran Standard Time |
| (UTC+04:00) Abu Dhabi, Muscat | +Arabian Standard Time |
| (UTC+04:00) Baku | +Azerbaijan Standard Time |
| (UTC+04:00) Port Louis | +Mauritius Standard Time |
| (UTC+04:00) Tbilisi | +Georgian Standard Time |
| (UTC+04:00) Yerevan | +Caucasus Standard Time |
| (UTC+04:30) Kabul | +Afghanistan Standard Time |
| (UTC+05:00) Ekaterinburg | +Ekaterinburg Standard Time |
| (UTC+05:00) Islamabad, Karachi | +Pakistan Standard Time |
| (UTC+05:00) Tashkent | +West Asia Standard Time |
| (UTC+05:30) Chennai, Kolkata, Mumbai, New Delhi | +India Standard Time |
| (UTC+05:30) Sri Jayawardenepura | +Sri Lanka Standard Time |
| (UTC+05:45) Kathmandu | +Nepal Standard Time |
| (UTC+06:00) Astana | +Central Asia Standard Time |
| (UTC+06:00) Dhaka | +Bangladesh Standard Time |
| (UTC+06:00) Novosibirsk | +N. Central Asia Standard Time |
| (UTC+06:30) Yangon (Rangoon) | +Myanmar Standard Time |
| (UTC+07:00) Bangkok, Hanoi, Jakarta | +SE Asia Standard Time |
| (UTC+07:00) Krasnoyarsk | +North Asia Standard Time |
| (UTC+08:00) Beijing, Chongqing, Hong Kong, Urumqi | +China Standard Time |
| (UTC+08:00) Irkutsk | +North Asia East Standard Time |
| (UTC+08:00) Kuala Lumpur, Singapore | +Singapore Standard Time |
| (UTC+08:00) Perth | +W. Australia Standard Time |
| (UTC+08:00) Taipei | +Taipei Standard Time |
| (UTC+08:00) Ulaanbaatar | +Ulaanbaatar Standard Time |
| (UTC+09:00) Osaka, Sapporo, Tokyo | +Tokyo Standard Time |
| (UTC+09:00) Seoul | +Korea Standard Time |
| (UTC+09:00) Yakutsk | +Yakutsk Standard Time |
| (UTC+09:30) Adelaide | +Cen. Australia Standard Time |
| (UTC+09:30) Darwin | +AUS Central Standard Time |
| (UTC+10:00) Brisbane | +E. Australia Standard Time |
| (UTC+10:00) Canberra, Melbourne, Sydney | +AUS Eastern Standard Time |
| (UTC+10:00) Guam, Port Moresby | +West Pacific Standard Time |
| (UTC+10:00) Hobart | +Tasmania Standard Time |
| (UTC+10:00) Vladivostok | +Vladivostok Standard Time |
| (UTC+11:00) Magadan | +Magadan Standard Time |
| (UTC+11:00) Solomon Is., New Caledonia | +Central Pacific Standard Time |
| (UTC+12:00) Auckland, Wellington | +New Zealand Standard Time |
| (UTC+12:00) Coordinated Universal Time+12 | +UTC+12 |
| (UTC+12:00) Fiji | +Fiji Standard Time |
| (UTC+13:00) Nuku'alofa | +Tonga Standard Time |
]]>
More info here: https://www.microsoft.com/en-us/WindowsForBusiness/upgrade-analytics
+]]>
For more details see http://www-01.ibm.com/support/docview.wss?uid=swg27043767
]]>For more details see http://www-01.ibm.com/support/docview.wss?uid=swg27043767
]]>For more details see http://www-01.ibm.com/support/docview.wss?uid=swg27043767
]]>For more details see http://www-01.ibm.com/support/docview.wss?uid=swg27043767
]]>For more details see http://www-01.ibm.com/support/docview.wss?uid=swg27043767
]]>This fixlet will handle a few cases:
+1. If print spooler service is running and not set to disabled, it will stop it first then set service to disabled
+2. If print spooler is not running but service is not set to disabled, it will simply set service to disabled
]]>Developer Documentation for System Restore Off
Author(s): Sean Seymour
Document Version: 2.3
Last Updated: 04/05/2016
System Restore has been found to cause issues with disk space on certain devices and issues with restoring old versions of programs on other devices. This package fixes the System Restore state if it has been disabled incorrectly, then deletes all system restore points and disables it correctly. On Windows 7 devices, it also disables the built in scheduled task that periodically creates restore points.
· Any device with System Restore Information > 10 MB
· Any Win7+ device that has registry data or scheduled tasks indicating System Restore is active (details below)
+Some temporary files are created, then executed and deleted.
From the BigFix console, Take Action on the System Restore Off fixlet. The client will run the actionscript, which does the following:
· Sets HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DiskPercent to 1
· Temporarily sets HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR to 0
· If the System Restore service is running, restarts it. Otherwise it sets the System Restore service to automatically start then starts it
· Disables the System Restore service via WMI, which also deletes all System Restore points and sets the DisableSR registry value back to 1.
· Disables the Microsoft\Windows\SystemRestore\SR scheduled task
· Removes any values in HKLM\Software\Microsoft\Windows NT\CurrentVersion\SPP\Clients
· Attempts to remove existing restore points using vssadmin delete shadows /all /quiet
· Creates a scheduled task to run on the next reboot that:
o Deletes the contents of any remaining System Volume Information folders on the drives’ root folders
o Deletes any temporary files that were created
o Deletes the scheduled task
It’s possible that something in the filesystem continues to use the System Restore files even after a reboot, which would prevent deletion. If this amount of data is more than 10 MB then the result of the BigFix action will show as Failed. In these rare cases I would suggest running the fixlet again. If the issue persists, connect to the device and attempt to delete the existing restore points and disable System Restore manually through the System control panel.
Configure System Restore via the control panel, or create a fixlet to re-enable it.
+· This fixlet requires a restart before completing fully.
+· 04/05/2016, Sean Seymour: Version 2.3 - Fixed a bug in the actionscript command to create the scheduled task that runs after the reboot.
· 03/16/2016, Sean Seymour: Version 2.2 - Added Win7+ info
· 11/03/2015, Sean Seymour: Version 2.1 - Clarified that the DisableSR registry value gets set back to 1.
· 10/28/2015, Sean Seymour: Version 2.0 with updated information regarding the WMI step
· 09/22/2015, Sean Seymour: Version 1.0 of this document created
This task will run the Microsoft System File Checker tool.
+]]>The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Microsoft article indicates this should be ignored: https://support.microsoft.com/en-us/help/4022522/dcom-event-id-10016-is-logged-in-windows-10-windows-server
+Many community forums indicate it may be an actual problem; and the presence of so many error messages from the Event Log hampers troubleshooting in all scenarios.
+ + +The DCOM permissions are controlled by REG_BINARY values in a could of locations.
HKLM\Software\Classes\AppID\{guid}
AccessPermission:REG_BINARY
LaunchPermission:REG_BINARY
Each of these are binary-encoded values representing launch permissions. I've come across some PowerShell snippets that might be used to read and write these values. Changing these values first requires taking ownership of the registry key, as these are owned by TrustedInstaller. Given the complexity of the PowerShell scripts to apply permissions, it appears that it may be simpler to create the appropriate permissions on one host, capture those settings, and simply use reg.exe to distribute that configuration to other hosts.
Task Notes:
+q:
("exists keys %22" & pathname of it & "%22 whose (not exists values %22AccessPermission%22 whose (it as string = %22" & value "AccessPermission" of it as string & "%22) of it OR not exists values %22LaunchPermission%22 whose (it as string = %22" & value "LaunchPermission" of it as string & "%22 ) of it) of native registry") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9CA88EE3-ACB7-47c8-AFC4-AB702511C276}" of native registry +A:
exists keys "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9CA88EE3-ACB7-47c8-AFC4-AB702511C276}" whose (not exists values "AccessPermission" whose (it as string = "01001480bc000000c80000001400000034000000020020000100000011001400040000000101000000000010001000000000000002008800060000000000180003000000010200000000000520000000200200000000180003000000010200000000000f0200000001000000000014000300000001010000000000050a000000000014000300000001010000000000051200000000001400030000000101000000000005130000000000140003000000010100000000000514000000010100000000000512000000010100000000000512000000") of it OR not exists values "LaunchPermission" whose (it as string = "01001480a8000000b4000000140000003400000002002000010000001100140004000000010100000000001000100000000000000200740005000000000018000b00000001020000000000052000000020020000000018000b000000010200000000000f0200000001000000000014000b000000010100000000000504000000000014000b00000001010000000000050a000000000014000b000000010100000000000512000000010100000000000512000000010100000000000512000000" ) of it) of native registryNotes on testing. This task makes changes to some very deep system-level functions so treat it with care!
]]>This requires there to be exactly 1 user logged into the system. It might be possible to do this as the SYSTEM user if executed interactively using something like PSExec or PAExec, but it definitely does not work as the SYSTEM user as executed by BigFix normally.
+DO NOT USE without the consent of the currently logged on user.
+]]>
This task monitors each login and records the most recent logins. This information is stored in the following registry values:
+[HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\userstats\LoggedIn]
+[HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\userstats\LastLoggedInUser]
+[HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\userstats\LastTime]
+[HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\userstats\LogonHistory]
+[HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\userstats\PrimaryUser]
Note: This task will not run on domain controllers.
+
Note: This task will be set as a policy and will run following each logon.
]]>+
This Task performs several cleanup operations to attempt to resolve failing Windows Updates. This should be used with care, and only on systems that are failing to install updates after all other troubleshooting steps have been taken, consider this a last effort before reimaging the problem machine. Making system changes, especially to an already-broken system, may further corrupt the system. Backup any important data before running this task!
++
This Task
++
Logs Generated:
+
Attempts Windows Component Store Cleanup
+DISM.EXE /Online /Cleanup-Image /RestoreHealth /Quiet /NoReboot
+https://docs.microsoft.com/en-us/troubleshoot/windows-server/deployment/fix-windows-update-errors
+Logs Generated:
+The Second action allows specifying a path to a trusted set of Windows installation files to be used to perform a repair, if original Windows installation files are required, for example 'C:\Windows-Media-Source'. The path should be accessible to the LocalSystem WIndows account (network UNC shares are generally not accessible and the media should be copied to a client path before running the action).
+]]>
|
+ The Microsoft .NET Framework 4.8 is a highly compatible, in-place update to the Microsoft .NET Framework 4, Microsoft .NET Framework 4.5, Microsoft .NET Framework 4.5.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6.1, Microsoft .NET Framework 4.6.2, Microsoft .NET Framework 4.7, Microsoft .NET Framework 4.7.1, and Microsoft .NET Framework 4.7.2. The offline package can be used in situations where the web installer cannot be used due to lack of internet connectivity. Note: Affected computers may report back as 'Pending Restart' once the update has run successfully, but will not report back their final status until the computer has been restarted. |
]]>
Source: http://bigfix.me/features/
]]>Revision History
+Revision History
+The Application Identity Service is required for Applocker to work.
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>https://technet.microsoft.com/en-us/library/dd759115(v=ws.11).aspx
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>Consider increasing the applocker log sizes to store more log data regarding Applocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>This occurs can occur if the BigFix Client is stored on a drive other than the system drive but only the system drive is encrypted.
+Information on using this content is available here: https://github.com/strawgate/C3-Protect/wiki/Bitlocker
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>The issue originates from the cbs.log file becoming too large to compress into an archive cab causing the files to fill up the Windows Temp directory.
+This fixlet will remove CBS Log files and any cab files from the Windows Temp Directory.
+Kudos and Compliments to Jason Walker for his work on the original fixlet here: https://bigfix.me/fixlet/details/11930
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>By design, neither a remote user, nor an application or service can inject the Secure Attention Sequence. This prevents malicious applications from answering questions on the secure desktop or proceeding through winlogon. This potentially impacts remote assistance and other remote help software because it will prevent a remote user from answering a UAC prompt for elevation instead requiring the user to accept on behalf of the remote user.
+If this fixlet is relevant than Control+Alt+Delete injection is not corrently allowed for remote assistance software. You should enable this via Group Policy under: "Computer Configuration -> Administrative Templates -> Windows Components -> Windows Logon Options" the setting is called, "Disable or enable software Secure Attention Sequence Policy" and should be set to enabled with the dropdown set to "Services"
+For general information or to report issues with C3 Remote Control content please visit GitHub here: https://github.com/strawgate/C3-Remote-Control
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>SystemDrive:\Drivers is typically used by vendor driver installers and various programs. If there is ever a file that is not safe to delete shame on whomever put it here.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>SystemDrive:\Logs is typically used by Intel installers and various programs. If there is ever a log that is not safe to delete shame on whomever put it here.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>SystemDrive:\adobeTemp is typically used by adobe installers. If there is ever a file that is not safe to delete shame on whomever put it here.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This Fixlet removes the folder. This fixlet will fail if the folder is not empty.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Tracing creates detailed log files on the system and may reduce performance of the Group Policy client. This could impact start-up and login time.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Tracing creates detailed log files on the system and may reduce performance of the Group Policy client. This could impact start-up and login times.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Please use the Fixlet: Invoke - Intel SA 00075 Probe - Windows to populate results for a system. You can view more details of this in the Analysis: Vulnerabilities - Intel SA 00075 - Windows
+More information on this vulnerability is available here: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This likely indicates an error with the McAfee client.
]]>This likely indicates an error with the McAfee client.
]]>For general information or to report issues with C3 Patch content please visit GitHub here: https://github.com/strawgate/C3-Patch
]]>For general information or to report issues with C3 Patch content please visit GitHub here: https://github.com/strawgate/C3-Patch
]]>For general information or to report issues with C3 Patch content please visit GitHub here: https://github.com/strawgate/C3-Patch
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This is normally done as a troubleshooting step but is often not undone after troubleshooting.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>This fixlet uses DISM to enable the Remote Assistance feature.
+For general information or to report issues with C3 Remote Control content please visit GitHub here: https://github.com/strawgate/C3-Remote-Control
]]>For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>An example of this would be a C:\* exclusion. This Fixlet only looks at exclusions targeted towards drives that exist on the system.
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>This is a potentially dangerous non-default configuration.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>GP Path: Computer Configuration/Policies/Administrative Templates/System/Remote Assistance
+++Setting Name: Configure Remote Assistance
Required State: Enabled
Required Value: Allow Helpers to remotely control this computer
For general information or to report issues with C3 Remote Control content please visit GitHub here: https://github.com/strawgate/C3-Remote-Control
]]>This Fixlet will be relevant if none of the standard office apps (Access, Excel, Outlook, Powerpoint, or Word) exist on the system but the Office suite still appears in programs and features.
+For general information or to report issues with C3 Patch content please visit GitHub here: https://github.com/strawgate/C3-Patch
]]>This Fixlet will be relevant if none of the standard office apps (Access, Excel, OneNote, Outlook, Powerpoint, Publisher, or Word) exist on the system but the Office suite still appears in programs and features.
+For general information or to report issues with C3 Patch content please visit GitHub here: https://github.com/strawgate/C3-Patch
]]>This Fixlet will be relevant if none of the standard office apps (Access, Excel, OneNote, Outlook, Powerpoint, Publisher, or Word) exist on the system but the Office suite still appears in programs and features.
+For general information or to report issues with C3 Patch content please visit GitHub here: https://github.com/strawgate/C3-Patch
]]>This Fixlet will be relevant if none of the standard office apps (Access, Excel, InfoPath, OneNote, Outlook, Powerpoint, Publisher, or Word) exist on the system but the Office suite still appears in programs and features.
+For general information or to report issues with C3 Patch content please visit GitHub here: https://github.com/strawgate/C3-Patch
]]>This should likely be disabled if using BigFix to perform update installation.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>A large WMI repository can cause lots of seemingly random issues on an endpoint from slow boot time to slow login.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>Failing WMI causes a number of issues from slow login, failing group policy, etc.
+For general information or to report issues with C3 Inventory content please visit GitHub here: https://github.com/strawgate/C3-Inventory
]]>On initial installation of an Anti-virus product the security center may prompt the user indicating a lack of up-to-date definitions.
+For general information or to report issues with C3 Protect content please visit GitHub here: https://github.com/strawgate/C3-Protect
]]>NOTE: This fixlet may appear relevant even if you have the right rules in place. This can commonly happen if you have created custom rules (not using the ones Group Policy generates) or if you are using a third-party Firewall. In this case you can ignore this fixlet once you've confirmed Remote Assistance is working in your environment.
+For general information or to report issues with C3 Remote Control content please visit GitHub here: https://github.com/strawgate/C3-Remote-Control
]]>Win10-1803::STAGE1::Stage Installation Files
+Win10-1803::STAGE2::INSTALL
+Win10-1803::STAGE3::Cleanup
+Win10-1803::STAGE2::INSTALL
+Win10-1803::STAGE3::Cleanup
+Win10-1803::STAGE2::INSTALL
+Win10-1803::STAGE3::Cleanup
+Win10-1809::STAGE1::Stage Installation Files
+Win10-1809::STAGE2::INSTALL
+Win10-1809::STAGE3::Cleanup
+Win10-1809::STAGE2::INSTALL
+Win10-1809::STAGE3::Cleanup
+Win10-1809::STAGE2::INSTALL
+Win10-1809::STAGE3::Cleanup
+There are times when your Windows systems are not joined to a domain and you need to define and use a common user on many systems (e.g.: an specific application user) that cannot be inherited by the Active Directory definition.
+Defining and managing a common local user at scale can be cumbersome or overwhelming.
+This task prompts for user/password combination to define a new windows local user and assigning it to a LocalGroup. Password travels encrypted and is not visible nor reusable.
+User is defined with an attribute to not Expire the given password.
+Error Conditions:
+If the specfied local group doesn't exists or the group is not specified, the command will NOT try to create a new group but will proceed successfully without assigning the user to the group.
Configure telemetry and other settings in your organization (Windows)
https://technet.microsoft.com/en-us/library/mt577208(v=vs.85).aspx
]]>
CVE 2021-36934
+SAM hives readable by everyone account as of Windows 10 (1809)
Current Fixlet relevance includes Windows 10 without limiting to (1809)
Deletes all VSS Shadow copies, as recommended by Microsoft.
Added Windows Server 2019 to relevance after udpates to the Microsoft guidance
++
Please test well before using as this is BigFix.me community content
]]>
This task runs a dxdiag executable to generate results for Video Card Check property in analysis. Please run this task on all of your Windows 10 devices.
Windows Management Framework (WMF) 5.0 brings functionality that has been updated from WMF 4.0. WMF 5.0 is available for installation only on Windows Server 2012 R2, Windows Server 2012, Windows 2008 R2, Windows 8.1, and Windows 7 SP1. Some of the new and updated features in this release include:
Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 R2 SP1, Windows Server 2012, Windows Server 2012 R2
+Size of File:20.7 MB
]]>After the installation of PowerShell in Windows 2008 servers it will be required reboot the server.
]]>After the installation of PowerShell in Windows 2008 servers it will be required reboot the server.
]]>Last tested on Windows 10 v1803 with PowerShell 5.1. This version requires PS 5.0+ due to module usage.
+It will not ask questions, and not provide options - it will simply install everything it is able to install in one round.
+This version will NOT install Windows Feature Updates, such as Windows 10 version 1803 to version 1809.
+By running this task you accept the Microsoft TechNet terms of use.
+Module Credit Michal Gajda, source: https://gallery.technet.microsoft.com/scriptcenter/2d191bcd-3308-4edd-9de2-88dff796b0bc/
]]>There are definitely missing combinations which this will NOT work for.
+The relevance used could be expanded and adapted to work with more KMSkeys.
+This is meant to be taken as a policy action, applied to all computers all of the time.
+Known Issue: the relevance that checks to see if windows is activated doesn't account for MS Office being installed, which may make this not relevant on a machine where it SHOULD be relevant
+]]>
This Fixlet demonstrates opening an XML file with PowerShell, and replacing a value in the XML content.
+Originally written to allow removing an NVidia driver without rebooting. NVidia, in their admin-unfriendliness, decided that uninstalling a driver should immediately trigger a reboot without providing any options to delay the reboot or to warn the user that a reboot is going to occur. There are no command-line parameters available to modify this behavior, but we can skip the reboot by modifying a value in their nv.xml configuration file.
+This fixlet, being an example of the PowerShell usage, generates on-the-fly an XML file similar to NVidia's format, and then uses PowerShell to replace one of the attribute values in that file.
]]>This Fixlet demonstrates opening an XML file with PowerShell, and replacing a value in the XML content.
+Originally written to allow removing an NVidia driver without rebooting. NVidia, in their admin-unfriendliness, decided that uninstalling a driver should immediately trigger a reboot without providing any options to delay the reboot or to warn the user that a reboot is going to occur. There are no command-line parameters available to modify this behavior, but we can skip the reboot by modifying a value in their nv.xml configuration file.
+This fixlet, being an example of the PowerShell usage, generates on-the-fly an XML file similar to NVidia's format, and then uses PowerShell to replace one of the attribute values in that file.
]]>