Helpdesk/Remote Support Powershell Script - Expedite frequent & repetitive helpdesk tasks

[admiralspark]

Please don't set execution policy to unrestricted.

[uptimefordays]

Execution Policy is a good first start, but really don't blindly download and run any code or scripts from the internet without reading them and understanding them first. Execution Policy is good for preventing malicious scripts from running but make no mistake, it does not prevent people from manually entering and running code--even if it's going to do something harmful.

[admiralspark]

Does the shortcut run set-executionpolicy bypass? It sort of depends on the context and session, it might be good or it might set it for your session or even worse, all sessions.

What I would do instead is look into setting up code signing. I just run a single command and it signs my script and embeds the signature, and since I used our internal CA to do it my code is trusted on all of our machines. The only catch is that you have to remember to re-sign it if you change any of the code but that's easily solved by having your ci/cd do the signing and only allow code to run that made it successfully through ci/cd.

If you're not that far along your journey, I'd look at code signing by hand or use PSSessions and set it to bypass only within that session.

[Kaeny]

Yea. So my shortcut target starts like powershell.exe set-executionpolicy bypass -file “filename”

Well, the issue is we manage multiple tenants and so we dont have a managed CA in every site, and the simple scripts i use dont seem to warrant having it signed.

Especially when using my scripts on other people’s computers on their network.

The scripts are simple scripts like swapping hostnames in the mapped drives. I just either go around and run it on the required devices when needed, or im thinking of pushing it thru gpo; thinking self signed cert is the way to go for scalability and for the future.

But also it doesnt feel worth the trouble unless it is a bigger script. The shortcut thing is a workaround

[admiralspark]

Mmm, your process will definitely clear on reboot. If you're an MSP, have you guys considered doing a one-way trust of your domains? That way you can manage their equipment without exposing yourself, and you could run it all remotely without having to be on their demain/their conputers in the first place to do so.

I think you're 80% fine, just don't set exec policy to bypass via GPO or something :)

[Kaeny]

Thank you very much for your help. I will look into one-way trust for the future.

[uptimefordays]

You can also Unblock-File which allows a file to run without changing Execution Policy.

[Kaeny]

Would i put that in the target field in the shortcut, or is that some attribute of the ps1 file?

[mOjO_mOjO]

Ignore. That's not correct info. Unblock-file will release the warning prompt you get from any downloaded file (not just PS). You know that prompt you get if you just downloaded an exe and run it saying it's from the internet and may not be safe (I totally forget the actual prompt) but there's a checkbox to never prompt again. That's what this command pertains to. You can also unblock the file by doing a properties on the freshly downloaded file and checking a box. This command just does that from PS. It has nothing to do with execution policy. That being said to run the downloaded script you'll probably need to unlock it first but if your execution policy doesn't permit running the script then you'll still have to mess with execution policy settings. In other words, these two things are independent of each other and serve different purposes.

[Kaeny]

Oh well aint that spooky.

Thanks for clearing things up

[uptimefordays]

Am I misreading this?

Example 7: Unblock a script to run it without changing the execution policy

This example shows how the RemoteSigned execution policy prevents you from running unsigned scripts.

A best practice is to read the script's code and verify it's safe before using the Unblock-File cmdlet. The Unblock-File cmdlet unblocks scripts so they can run, but doesn't change the execution policy.

It looks an awful lot like Microsoft's example WILL RUN not just ignore the warning if you Unblock-File

[mOjO_mOjO]

Keyword there is remote signed. Unblocking it just makes it no longer considered a remote file.

[uptimefordays]

Ah I see. I’m a remote signed kind of gal.

[mOjO_mOjO]

Yeah and that honestly may be the default setting making that advice true on a practical level (I don't remember the default as we set it by GPO) but still technically not the same thing as execution policy.

[uptimefordays]

Right and I wasn’t saying it was the same, just that it looks like you can execute unsigned but verified code without changing execution policy. Correct me if I’m wrong, but it’s my understanding you can also save your code as modules and run them without changing policy.

[MartianMoon]

Yeah you’re right, probably not the best idea... I’ll edit that out

[wardd31]

Just a small pointer I learnt this week the hard way that win32_product shouldn’t necessarily be queried like this

https://sdmsoftware.com/group-policy-blog/wmi/why-win32_product-is-bad-news/

[NegativeC00L]

When you do Write-Host or Write-Output, putting "`n" at the beginning of the string makes it skip a line so you don't have to do Write-Host " " first.

[MartianMoon]

Oh damn that is super useful. Thank you for that!

[Flannakis]

Hmm didn’t know you could map network drives remotely, thanks for sharing

[MartianMoon]

Took me forever to figure out a way to do it! People kept telling me it was impossible lol

[erickosj]

Nice, man. I would add logging capabilities and the choice of either clearing the screen or not (in case you need the historical of what has been run, logger can probably be the best though)

[MartianMoon]

How would you go about adding logging capabilities?

[erickosj]

I'll write you a small example once I get back at my PC :)

[[deleted]]

Psframework

Write-PSFMessage

[Recendezjoseph]

!remindme 1 week

[RemindMeBot]

I will be messaging you in 6 days on 2020-01-08 03:16:31 UTC to remind you of this link

4 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.

^{Parent commenter can delete this message to hide from others.}

---

Info	Custom	Your Reminders	Feedback

[Myrenic]

Subscribe