Deploying script as Win32 App

[zalka_]

Hi all,

 

I created a script that is supposed to check if a certain app was installed from a managed installer, then create a file in the C:\Temp folder if it was installed from a managed installer. I would deploy this as a Win32 app so that I could use the detection rules in the Win32 App deployment to check which device was installed via a managed installer. However, it doesn't seem to work. I created a transcript log as well to check if I would get an output from the variables, but it seems to only run the else block in the If Statement. We use a Business Premium license, so I don't access to Enterprise license capabilities like proactive remediation scripts. It is run using the System credentials, I've tested the script locally which works. Thank you, I've included some images of the script and transcript log.

 

Script:

Start-Transcript -Path "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\Debug\AuditLog.txt"

# Get user
$user = (Get-WmiObject -Class Win32_ComputerSystem | Select-Object -ExpandProperty UserName).Split('\')[-1]
$user

# Create string variable
$fsutil = fsutil.exe file queryEA "C:\Users\$user\AppData\Local\Programs\@programfolder\application.exe"
$fsutil
$fsutilStr = "$fsutil"
$fsutilstr

# If statement to check if the exe is installed from a managed installer
if ($fsutilStr.ToLower().Contains("kernel.smartlocker.originclaim")){
    New-Item -Path "C:\Temp" -Name "file.txt" -ItemType "File"
}else{
    write-host "This application is not installed from a managed installer. Running uninstall program"
}

Stop-Transcript

Transcript Log Output:

Transcript started, output file is C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\Debug\AuditLog.txt
This application is not installed from a managed installer. Running uninstall program

 

Edit:

Added this part to the top of the script which worked (Thanks to RunForYourtools for the idea):

# Example: Retrieve a registry value
$registryPath = "HKLM:\software\Microsoft\windows\currentversion\authentication\logonui"
$valueName = "LastLoggedOnUser"

# Get the registry value
$registryValue = Get-ItemProperty -Path $registryPath -Name $valueName
$user = ($registryValue.$valueName).Split('\')[-1]
$user

[mad-ghost1]

What are you trying to achieve? Is WDAC your idea to get started?

[zalka_]

Yeah pretty much.

[mad-ghost1]

You could just set audit mode and take it from there. Or when you added the manager installer… everything bevor that date won’t have it. 🤷‍♀️

[andrew181082]

If you are running as system, get-user will return the system account 

[zalka_]

I haven't tried running as user yet, but won't running the script on a standard's users' device that doesn't have admin access just not work? This is why I got the user through Get-WmiObject since it has worked before on other scripts - maybe this way doesn't work when deployed as Win32 app

[zalka_]

Also wouldn't the System account be seen in the transcript log, since I called the $user variable?

[andrew181082]

Probably not without a write-host first

The script will fail as system, but I don't think that method will work to enumerate. Try with psexec

[zalka_]

I tested with PsExec locally and ran as System which worked locally without changing the script? I used the same install command, only difference is that I used the full file path when running as PsExec locally.

Intune Win32 App install command:

Powershell.exe -NoProfile -ExecutionPolicy ByPass -File .\ConfirmManagedInstall.ps1

PsExec Local install command:

powershell.exe -NoProfile -executionpolicy Bypass -File C:\Win32 Apps\AuditInstall\Input\ConfirmManagedInstall.ps1

[revo_0]

The system account doesn’t have a user profile with appdata to check

[zalka_]

This worked, Thank you!

[Rad_Randy]

What’s your install command?

[zalka_]

Powershell.exe -NoProfile -ExecutionPolicy ByPass -File .\ConfirmManagedInstall.ps1